# incident

plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 212.56.43.13
description:
Feb  4 13:48:41 ait sshd[4143881]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.56.43.13


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.116.64
description:
2025-02-04 13:48:03 dovecot_plain authenticator failed for (hyallets) [62.182.116.64]:51647: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 74.208.51.38
description:
Feb  4 13:48:34 ait sshd[4143716]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.208.51.38


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.195.160
description:
Feb  4 13:48:03 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.195.160 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.173.231.15
description:
[2025-02-04 13:48:20 +0100] info [webmaild] 45.173.231.15 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.56.43.13
description:
Feb  4 13:48:41 ait sshd[4143881]: pam_imunify(sshd:auth): [IM360_RBL] The IP 212.56.43.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.70.158.32
description:
Feb  4 13:47:59 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.70.158.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.195.160
description:
2025-02-04 13:48:05 dovecot_login authenticator failed for (mobile-166-195-195-160.mycingular.net) [166.195.195.160]:48691: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.180.102
description:
2025-02-04 13:48:26 dovecot_login authenticator failed for 80-15-180-102.ftth.fr.orangecustomers.net [80.15.180.102]:55092: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
description:
2025-02-04 13:48:13 dovecot_plain authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:36608: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.15.180.102
description:
Feb  4 13:48:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.15.180.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.70.158.32
description:
2025-02-04 13:48:01 dovecot_plain authenticator failed for ([1.70.158.32]) [1.70.158.32]:40574: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.207.248.5
description:
Feb  4 13:48:11 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.207.248.5 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Feb  4 13:49:26 ait sshd[4144185]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.44.76.103
description:
Feb  4 13:49:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.44.76.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.51.218
description:
2025-02-04 13:48:47 dovecot_plain authenticator failed for ([94.102.51.218]) [94.102.51.218]:13788: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.175.201.230
description:
[2025-02-04 13:48:53 +0100] info [webmaild] 45.175.201.230 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.18.84
description:
[2025-02-04 13:49:03 +0100] info [webmaild] 179.125.18.84 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.243.43.58
description:
Feb  4 13:49:04 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.243.43.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.243.43.58
description:
2025-02-04 13:49:06 dovecot_plain authenticator failed for ([211.243.43.58]) [211.243.43.58]:48902: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Feb  4 13:49:26 ait sshd[4144185]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.121.60.137
description:
[2025-02-04 13:49:39 +0100] info [webmaild] 138.121.60.137 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.102.51.218
description:
Feb  4 13:48:45 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.102.51.218 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.56.43.13
description:
Feb  4 13:48:43 ait sshd[4143881]: Failed password for invalid user cst from 212.56.43.13 port 43694 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.44.76.103
description:
2025-02-04 13:49:33 dovecot_login authenticator failed for 207.44.76.103.res-cmts.hol.ptd.net [207.44.76.103]:51312: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.3
description:
Feb  4 13:50:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.80.118.222
description:
Feb  4 13:49:55 ait sshd[4144419]: pam_imunify(sshd:auth): [IM360_RBL] The IP 151.80.118.222 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 151.80.118.222
description:
Feb  4 13:49:55 ait sshd[4144419]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.80.118.222


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.156.255.186
description:
Feb  4 13:50:05 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.156.255.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.63.214.213
description:
2025-02-04 13:50:31 dovecot_plain authenticator failed for ([218.15.222.74]) [58.63.214.213]:38296: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.3
description:
2025-02-04 13:50:38 dovecot_plain authenticator failed for (nsg-corporate-3.234.187.122.airtel.in) [122.187.234.3]:40359: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.188.73.223
description:
2025-02-04 13:49:51 dovecot_login authenticator failed for ([27.188.73.223]) [27.188.73.223]:56498: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.0.149.238
description:
Feb  4 13:49:51 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.0.149.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.63.214.213
description:
Feb  4 13:50:29 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.63.214.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.156.255.186
description:
2025-02-04 13:50:07 dovecot_plain authenticator failed for syn-098-156-255-186.res.spectrum.com [98.156.255.186]:53318: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.188.73.223
description:
Feb  4 13:49:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.188.73.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.0.149.238
description:
2025-02-04 13:49:53 dovecot_plain authenticator failed for net-130-0-149-238.cust.vodafonedsl.it (cogeraters) [130.0.149.238]:56196: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 13:50:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 145.255.70.207
description:
[2025-02-04 13:51:08 +0100] info [webmaild] 145.255.70.207 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.70.169.148
description:
Feb  4 13:51:15 ait sshd[4145258]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.70.169.148


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.70.166.51
description:
Feb  4 13:51:17 ait sshd[4145273]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.70.166.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.21.209
description:
Feb  4 13:51:30 ait sshd[4145337]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.21.209  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.80.118.222
description:
Feb  4 13:51:37 ait sshd[4145395]: pam_imunify(sshd:auth): [IM360_RBL] The IP 151.80.118.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.67.185.48
description:
Feb  4 13:51:09 ait sshd[4145204]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.67.185.48 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.82.26.182
description:
Feb  4 13:51:06 ait sshd[4145192]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.82.26.182  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.67.185.48
description:
Feb  4 13:51:09 ait sshd[4145204]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.67.185.48


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.169.148
description:
Feb  4 13:51:15 ait sshd[4145258]: pam_imunify(sshd:auth): [IM360_RBL] The IP 118.70.169.148 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.70.166.51
description:
Feb  4 13:51:17 ait sshd[4145273]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.70.166.51  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.102.233
description:
Feb  4 13:50:48 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.102.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.56.43.13
description:
Feb  4 13:51:36 ait sshd[4145381]: pam_imunify(sshd:auth): [IM360_RBL] The IP 212.56.43.13 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 212.56.43.13
description:
Feb  4 13:51:36 ait sshd[4145381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.56.43.13


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 151.80.118.222
description:
Feb  4 13:51:37 ait sshd[4145395]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.80.118.222


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.91.74.108
description:
[2025-02-04 13:51:40 +0100] info [webmaild] 177.91.74.108 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.82.26.182
description:
Feb  4 13:51:06 ait sshd[4145192]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.82.26.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.102.233
description:
2025-02-04 13:50:50 dovecot_plain authenticator failed for ([183.236.102.233]) [183.236.102.233]:47419: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.203.44.120
description:
Feb  4 13:52:40 ait sshd[4145852]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.44.120


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.230.221.83
description:
[2025-02-04 13:51:52 +0100] info [webmaild] 189.230.221.83 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.174.103.38
description:
Feb  4 13:52:12 ait sshd[4145680]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.174.103.38  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.178.110.65
description:
Feb  4 13:52:19 ait sshd[4145724]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.178.110.65


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Feb  4 13:52:31 ait sshd[4145805]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.223.192.254
description:
Feb  4 13:52:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.223.192.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.44.120
description:
Feb  4 13:52:40 ait sshd[4145852]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.203.44.120 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.203.23.172
description:
Feb  4 13:52:21 ait sshd[4145734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.23.172


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.223.72.106
description:
[2025-02-04 13:52:27 +0100] info [webmaild] 41.223.72.106 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Feb  4 13:52:31 ait sshd[4145805]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.103.38
description:
Feb  4 13:52:12 ait sshd[4145680]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.174.103.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.65
description:
Feb  4 13:52:19 ait sshd[4145724]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.178.110.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.192.254
description:
2025-02-04 13:52:36 dovecot_plain authenticator failed for ([200.223.193.9]) [200.223.192.254]:59649: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.203.44.120
description:
Feb  4 13:52:42 ait sshd[4145852]: Failed password for invalid user goudirect from 159.203.44.120 port 60628 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.81
description:
Feb  4 13:52:51 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.27.81 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 151.80.118.222
description:
Feb  4 13:52:50 ait sshd[4145972]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.80.118.222


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.56.43.13
description:
Feb  4 13:52:52 ait sshd[4145995]: pam_imunify(sshd:auth): [IM360_RBL] The IP 212.56.43.13 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.70.169.148
description:
Feb  4 13:52:44 ait sshd[4145866]: Failed password for invalid user danc from 118.70.169.148 port 60164 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 212.56.43.13
description:
Feb  4 13:52:52 ait sshd[4145995]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.56.43.13


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.169.148
description:
Feb  4 13:52:42 ait sshd[4145866]: pam_imunify(sshd:auth): [IM360_RBL] The IP 118.70.169.148 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.70.169.148
description:
Feb  4 13:52:42 ait sshd[4145866]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.70.169.148


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 13:52:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.80.118.222
description:
Feb  4 13:52:50 ait sshd[4145972]: pam_imunify(sshd:auth): [IM360_RBL] The IP 151.80.118.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
description:
2025-02-04 13:52:53 dovecot_plain authenticator failed for ([27.71.27.81]) [27.71.27.81]:48540: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.7.109.160
description:
Feb  4 13:53:58 ait sshd[4146667]: pam_imunify(sshd:auth): [IM360_RBL] The IP 200.7.109.160 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 200.7.109.160
description:
Feb  4 13:53:58 ait sshd[4146667]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.7.109.160


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Feb  4 13:53:44 ait sshd[4146595]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.0.209.101
description:
[2025-02-04 13:54:36 +0100] info [webmaild] 143.0.209.101 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Feb  4 13:53:44 ait sshd[4146595]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.84.87.10
description:
[2025-02-04 13:54:21 +0100] info [webmaild] 187.84.87.10 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.139.55
description:
2025-02-04 13:54:29 dovecot_login authenticator failed for ([112.194.139.55]) [112.194.139.55]:55260: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 13:54:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.7.17.46
description:
[2025-02-04 13:53:49 +0100] info [webmaild] 201.7.17.46 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.139.55
description:
Feb  4 13:54:27 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.139.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.40.10
description:
Feb  4 13:54:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.40.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.40.10
description:
2025-02-04 13:54:51 dovecot_login authenticator failed for ([112.6.73.140]) [221.2.40.10]:58618: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.168.8.169
description:
[2025-02-04 13:55:14 +0100] info [webmaild] 103.168.8.169 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.247.245.61
description:
Feb  4 13:55:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.247.245.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.247.245.61
description:
2025-02-04 13:55:21 dovecot_plain authenticator failed for ([1.247.245.61]) [1.247.245.61]:57046: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.115.164
description:
Feb  4 13:55:54 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.115.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.252.38.24
description:
Feb  4 13:56:11 ait sshd[4147795]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.252.38.24 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:13-56.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.115.164
description:
2025-02-04 13:55:56 dovecot_plain authenticator failed for ([218.94.115.164]) [218.94.115.164]:35058: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.252.38.24
description:
Feb  4 13:56:11 ait sshd[4147795]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.252.38.24


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.182.71.73
description:
Feb  4 13:57:33 ait sshd[4148190]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.182.71.73 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 137.184.235.158
description:
Feb  4 13:57:38 ait sshd[4148204]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.184.235.158


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.238.49.192
description:
[2025-02-04 13:56:45 +0100] info [webmaild] 170.238.49.192 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.239.168.22
description:
[2025-02-04 13:57:16 +0100] info [webmaild] 37.239.168.22 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.2.110
description:
2025-02-04 13:56:48 dovecot_plain authenticator failed for ([187.12.2.110]) [187.12.2.110]:39277: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.145.142.243
description:
Feb  4 13:56:59 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.145.142.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.57.217.38
description:
Feb  4 13:57:38 ait sshd[4148200]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.57.217.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.184.235.158
description:
Feb  4 13:57:38 ait sshd[4148204]: pam_imunify(sshd:auth): [IM360_RBL] The IP 137.184.235.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.2.110
description:
Feb  4 13:56:46 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.2.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
description:
2025-02-04 13:57:01 dovecot_plain authenticator failed for ([203.145.142.243]) [203.145.142.243]:33134: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 62.217.156.119
description:
[2025-02-04 13:57:23 +0100] info [webmaild] 62.217.156.119 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.182.71.73
description:
Feb  4 13:57:33 ait sshd[4148190]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.182.71.73


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.57.217.38
description:
Feb  4 13:57:38 ait sshd[4148200]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.57.217.38


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-02-04 13:57:58 dovecot_plain authenticator failed for (ansing) [109.166.70.166]:33473: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.123.220.10
description:
Feb  4 13:58:19 ait sshd[4148465]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.123.220.10


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.254.136.116
description:
Feb  4 13:58:32 ait sshd[4148490]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.136.116


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.68.212.2
description:
Feb  4 13:57:46 ait sshd[4148240]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.212.2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
description:
2025-02-04 13:58:07 dovecot_plain authenticator failed for 177-72-87-7.static.as262543.net.br (7.lifedns.com.br) [177.72.87.7]:33222: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.149.154
description:
Feb  4 13:58:08 ait sshd[4148289]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.56.149.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.254.136.116
description:
Feb  4 13:58:32 ait sshd[4148490]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.254.136.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Feb  4 13:57:56 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.123.220.10
description:
Feb  4 13:58:19 ait sshd[4148465]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.123.220.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.28.66.78
description:
Feb  4 13:58:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.28.66.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.28.66.78
description:
2025-02-04 13:58:38 dovecot_plain authenticator failed for ([62.28.66.78]) [62.28.66.78]:57829: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 39.58.244.104
description:
[2025-02-04 13:58:02 +0100] info [webmaild] 39.58.244.104 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.87.7
description:
Feb  4 13:58:05 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.87.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.56.149.154
description:
Feb  4 13:58:08 ait sshd[4148289]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.56.149.154


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.16.4
description:
Feb  4 13:58:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.16.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.16.4
description:
2025-02-04 13:58:51 dovecot_plain authenticator failed for (crocums) [149.0.16.4]:49120: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 13:59:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.121.150.52
description:
[2025-02-04 13:59:29 +0100] info [webmaild] 138.121.150.52 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.225.109.30
description:
Feb  4 14:00:06 ait sshd[4149462]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.225.109.30 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.225.109.30
description:
Feb  4 14:00:06 ait sshd[4149462]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.225.109.30


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.200.60.246
description:
Feb  4 14:00:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.200.60.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.87.212.9
description:
Feb  4 14:00:08 ait sshd[4149459]: pam_imunify(sshd:auth): [IM360_RBL] The IP 77.87.212.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.100.18.224
description:
Feb  4 14:00:23 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.100.18.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.239.23.149
description:
2025-02-04 14:00:34 dovecot_plain authenticator failed for ([91.239.23.149]) [91.239.23.149]:43470: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.100.118.203
description:
[2025-02-04 14:00:05 +0100] info [webmaild] 102.100.118.203 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 77.87.212.9
description:
Feb  4 14:00:08 ait sshd[4149459]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.87.212.9


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 118.179.166.9
description:
[2025-02-04 14:00:16 +0100] info [webmaild] 118.179.166.9 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.100.18.224
description:
2025-02-04 14:00:25 dovecot_plain authenticator failed for ([183.100.18.224]) [183.100.18.224]:53812: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.239.23.149
description:
Feb  4 14:00:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.239.23.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.85.4
description:
Feb  4 14:00:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.85.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.85.4
description:
2025-02-04 14:00:36 dovecot_plain authenticator failed for ([2.55.85.4]) [2.55.85.4]:53848: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.69.156
description:
2025-02-04 14:00:47 dovecot_plain authenticator failed for ([109.195.69.156]) [109.195.69.156]:27066: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.165.243.10
description:
Feb  4 14:01:01 ait sshd[4149841]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.165.243.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-02-04 14:01:06 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:36994: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.69.156
description:
Feb  4 14:00:45 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.69.156 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.72.55
description:
[2025-02-04 14:00:51 +0100] info [webmaild] 84.54.72.55 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.165.243.10
description:
Feb  4 14:01:01 ait sshd[4149841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.165.243.10  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Feb  4 14:01:04 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 188.166.239.212
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:14-02.188.166.239.212


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.12.254.47
description:
2025-02-04 14:02:29 dovecot_login authenticator failed for ([106.12.254.47]) [106.12.254.47]:46545: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.130.215.226
description:
Feb  4 14:02:14 ait sshd[4150346]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.130.215.226


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.254.47
description:
Feb  4 14:02:27 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.12.254.47 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.212.242.11
description:
[2025-02-04 14:02:24 +0100] info [webmaild] 177.212.242.11 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.124.54.6
description:
Feb  4 14:02:16 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.124.54.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.124.54.6
description:
2025-02-04 14:02:18 dovecot_login authenticator failed for ([179.124.54.6]) [179.124.54.6]:38788: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.61
description:
Feb  4 14:02:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.130.215.226
description:
Feb  4 14:02:14 ait sshd[4150346]: pam_imunify(sshd:auth): [IM360_RBL] The IP 34.130.215.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 14:02:23 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.67.143.142
description:
Feb  4 14:02:51 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.67.143.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.67.143.142
description:
2025-02-04 14:02:53 dovecot_plain authenticator failed for (netcomafrica.com) [41.67.143.142]:45684: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-02-04 14:03:05 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:49361: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
description:
2025-02-04 14:03:34 dovecot_plain authenticator failed for ([111.93.177.228]) [111.93.177.228]:56118: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.102.51.218
description:
Feb  4 14:02:50 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.102.51.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.186.33.55
description:
Feb  4 14:03:02 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.186.33.55 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.59.2.137
description:
[2025-02-04 14:03:10 +0100] info [webmaild] 181.59.2.137 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.133.205
description:
Feb  4 14:03:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.133.205 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.208.101.189
description:
[2025-02-04 14:02:56 +0100] info [webmaild] 185.208.101.189 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.117.144.158
description:
2025-02-04 14:03:08 dovecot_plain authenticator failed for ([175.117.144.158]) [175.117.144.158]:59832: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
description:
2025-02-04 14:03:19 dovecot_plain authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:60204: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.133.205
description:
2025-02-04 14:03:28 dovecot_plain authenticator failed for ([45.238.133.205]) [45.238.133.205]:47791: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.37.73.242
description:
Feb  4 14:03:41 ait sshd[4151017]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.37.73.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.61
description:
2025-02-04 14:02:44 dovecot_plain authenticator failed for (m121-202-155-61.smartone.com) [121.202.155.61]:63496: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
description:
2025-02-04 14:02:53 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:48948: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.117.144.158
description:
Feb  4 14:03:06 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.117.144.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.138.69
description:
Feb  4 14:03:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.138.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.73.242
description:
Feb  4 14:03:41 ait sshd[4151017]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.37.73.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.100.186.71
description:
2025-02-04 14:02:53 dovecot_plain authenticator failed for syn-172-100-186-071.res.spectrum.com [172.100.186.71]:60908: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Feb  4 14:03:03 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.82.135.154
description:
2025-02-04 14:03:08 dovecot_plain authenticator failed for ([1.82.135.154]) [1.82.135.154]:40770: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.192.17
description:
Feb  4 14:03:10 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.192.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.100.186.71
description:
Feb  4 14:02:51 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.100.186.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.51.218
description:
2025-02-04 14:02:52 dovecot_plain authenticator failed for ([94.102.51.218]) [94.102.51.218]:26978: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.192.17
description:
2025-02-04 14:03:12 dovecot_plain authenticator failed for ([191.59.192.17]) [191.59.192.17]:60292: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.93.177.228
description:
Feb  4 14:03:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.93.177.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
description:
Feb  4 14:02:51 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.0.108
description:
Feb  4 14:03:06 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.0.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.0.108
description:
2025-02-04 14:03:08 dovecot_plain authenticator failed for ([119.207.0.108]) [119.207.0.108]:44907: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.186.33.55
description:
2025-02-04 14:03:04 dovecot_plain authenticator failed for (h55.33.186.173.dynamic.ip.windstream.net) [173.186.33.55]:40782: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.82.135.154
description:
Feb  4 14:03:06 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.82.135.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.165.148.166
description:
Feb  4 14:04:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.165.148.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.38.74
description:
2025-02-04 14:04:20 dovecot_plain authenticator failed for ([118.122.38.74]) [118.122.38.74]:39804: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.103.142
description:
2025-02-04 14:04:21 dovecot_plain authenticator failed for ([58.18.103.142]) [58.18.103.142]:49245: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
description:
Feb  4 14:04:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.195.20.138
description:
2025-02-04 14:04:41 dovecot_plain authenticator failed for ([50.195.20.138]) [50.195.20.138]:48600: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
description:
Feb  4 14:04:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.42.226.215
description:
Feb  4 14:04:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.42.226.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.241.102
description:
2025-02-04 14:04:35 dovecot_plain authenticator failed for ([112.186.241.102]) [112.186.241.102]:37057: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.217.137.126
description:
2025-02-04 14:04:37 dovecot_plain authenticator failed for ([191.217.137.126]) [191.217.137.126]:43565: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Feb  4 14:04:28 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.198.60
description:
Feb  4 14:04:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.198.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.117.173.81
description:
Feb  4 14:04:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.117.173.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.224.164.194
description:
Feb  4 14:04:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.224.164.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.50.19.94
description:
Feb  4 14:04:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.50.19.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.16.156.103
description:
2025-02-04 14:04:42 dovecot_plain authenticator failed for (173-16-156-103.client.mchsi.com) [173.16.156.103]:45216: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.163.122.138
description:
Feb  4 14:04:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.163.122.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
description:
2025-02-04 14:04:18 dovecot_plain authenticator failed for ([213.230.65.53]) [213.230.65.53]:38520: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.42.104.163
description:
2025-02-04 14:04:22 dovecot_plain authenticator failed for (212-42-104-163.static.elcat.kg) [212.42.104.163]:59406: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.164.194
description:
2025-02-04 14:04:40 dovecot_plain authenticator failed for ([122.224.164.194]) [122.224.164.194]:49751: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.117.173.81
description:
2025-02-04 14:04:40 dovecot_plain authenticator failed for ([183.237.61.147]) [113.117.173.81]:49019: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 59.92.123.104
description:
Feb  4 14:03:49 ait sshd[4151114]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.92.123.104


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
description:
2025-02-04 14:04:25 dovecot_plain authenticator failed for ([185.101.16.250]) [185.101.16.250]:45203: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.93.183
description:
Feb  4 14:04:30 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.93.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
description:
Feb  4 14:04:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.204.52.137
description:
2025-02-04 14:04:19 dovecot_plain authenticator failed for ([88.204.52.137]) [88.204.52.137]:54312: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.108.14.225
description:
2025-02-04 14:04:23 dovecot_plain authenticator failed for ([202.108.14.226]) [202.108.14.225]:50828: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-02-04 14:04:29 dovecot_plain authenticator failed for (12-78-123-185.host.cirex.ru) [185.123.78.13]:49686: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.26.86
description:
Feb  4 14:04:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.26.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-02-04 14:04:23 dovecot_plain authenticator failed for (www.safecleen.com) [58.49.113.138]:10540: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
description:
2025-02-04 14:04:23 dovecot_plain authenticator failed for ([128.185.12.179]) [128.185.12.179]:44936: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.172.120.32
description:
2025-02-04 14:04:27 dovecot_plain authenticator failed for ([111.172.120.32]) [111.172.120.32]:53514: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.87.34.133
description:
Feb  4 14:04:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.87.34.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Feb  4 14:04:21 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
description:
2025-02-04 14:04:32 dovecot_plain authenticator failed for (corporativo.gvt.net.br) [189.115.93.183]:44506: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
description:
Feb  4 14:04:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.222.84
description:
Feb  4 14:04:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.222.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.12.179
description:
Feb  4 14:04:21 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.12.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.44.171
description:
Feb  4 14:04:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.44.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.204.13
description:
Feb  4 14:04:27 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.204.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.19.94
description:
2025-02-04 14:04:42 dovecot_plain authenticator failed for ([187.50.19.94]) [187.50.19.94]:49801: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.134.109.253
description:
Feb  4 14:04:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.134.109.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.179
description:
Feb  4 14:04:35 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.211.197.38
description:
Feb  4 14:04:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.211.197.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.42.104.163
description:
Feb  4 14:04:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.42.104.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.209.109.213
description:
Feb  4 14:04:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.209.109.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.246.94.219
description:
Feb  4 14:04:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.246.94.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.186.241.102
description:
Feb  4 14:04:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.186.241.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.10.15
description:
2025-02-04 14:04:34 dovecot_plain authenticator failed for 111-70-10-15.emome-ip.hinet.net [111.70.10.15]:48521: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.87.34.133
description:
2025-02-04 14:04:35 dovecot_plain authenticator failed for syn-023-087-034-133.res.spectrum.com [23.87.34.133]:53274: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
description:
2025-02-04 14:04:37 dovecot_plain authenticator failed for ([111.171.125.94]) [111.171.125.94]:50855: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.201.228.210
description:
Feb  4 14:04:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.201.228.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.159.117.51
description:
2025-02-04 14:04:18 dovecot_plain authenticator failed for (pool.sevtele.com) [178.159.117.51]:56817: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.119.20.149
description:
Feb  4 14:04:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.119.20.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.125.94
description:
Feb  4 14:04:35 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.210.84.220
description:
Feb  4 14:04:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.210.84.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.195.20.138
description:
Feb  4 14:04:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.195.20.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
description:
Feb  4 14:04:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.205.48.62
description:
2025-02-04 14:04:19 dovecot_plain authenticator failed for 47-205-48-62.tamp.fl.frontiernet.net [47.205.48.62]:36040: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
description:
2025-02-04 14:04:20 dovecot_plain authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:34822: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.9.74
description:
2025-02-04 14:04:21 dovecot_plain authenticator failed for (200151121049.user.veloxzone.com.br) [200.151.9.74]:48967: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.172.120.32
description:
Feb  4 14:04:25 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.172.120.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.204.52.137
description:
Feb  4 14:04:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.204.52.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.176.41.40
description:
2025-02-04 14:04:34 dovecot_plain authenticator failed for ([178.176.41.40]) [178.176.41.40]:42801: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.9.74
description:
Feb  4 14:04:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.9.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.209.109.213
description:
2025-02-04 14:04:24 dovecot_plain authenticator failed for ([175.209.109.213]) [175.209.109.213]:59618: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.184.155
description:
2025-02-04 14:04:21 dovecot_plain authenticator failed for (mail.topkabel.com) [120.197.184.155]:34745: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.102
description:
Feb  4 14:04:23 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
description:
2025-02-04 14:04:24 dovecot_plain authenticator failed for ([96.79.174.131]) [96.79.174.131]:34954: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.210.84.220
description:
2025-02-04 14:04:38 dovecot_plain authenticator failed for ([175.210.84.220]) [175.210.84.220]:53126: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.76
description:
2025-02-04 14:04:26 dovecot_plain authenticator failed for ([95.0.252.76]) [95.0.252.76]:51566: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.65
description:
Feb  4 14:04:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
description:
2025-02-04 14:04:20 dovecot_plain authenticator failed for ([200.165.163.121]) [200.165.148.166]:47693: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.122.138
description:
2025-02-04 14:04:20 dovecot_plain authenticator failed for (abts-north-static-x.138.122.163.122.airtelbroadband.in) [122.163.122.138]:53316: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-02-04 14:04:23 dovecot_plain authenticator failed for ([112.111.61.230]) [112.111.61.229]:59696: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.58.201.106
description:
Feb  4 14:04:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.58.201.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.231.102.189
description:
Feb  4 14:04:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.231.102.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.58.201.106
description:
2025-02-04 14:04:26 dovecot_plain authenticator failed for host-5-58-201-106.bitternet.ua [5.58.201.106]:50017: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.160.70
description:
2025-02-04 14:04:28 dovecot_plain authenticator failed for ([183.238.160.70]) [183.238.160.70]:54852: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
description:
Feb  4 14:04:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.65.53
description:
Feb  4 14:04:16 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.65.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.94.106
description:
2025-02-04 14:04:22 dovecot_plain authenticator failed for ([60.191.94.106]) [60.191.94.106]:56572: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.176.41.40
description:
Feb  4 14:04:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.176.41.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.42.226.215
description:
2025-02-04 14:04:34 dovecot_plain authenticator failed for ([58.42.226.215]) [58.42.226.215]:48246: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.197.38
description:
2025-02-04 14:04:40 dovecot_plain authenticator failed for ([117.211.197.38]) [117.211.197.38]:54078: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.152
description:
2025-02-04 14:04:35 dovecot_plain authenticator failed for (2-55-88-152.orange.net.il) [2.55.88.152]:46702: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.103.142
description:
Feb  4 14:04:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.103.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.191.94.106
description:
Feb  4 14:04:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.191.94.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.119.20.149
description:
2025-02-04 14:04:21 dovecot_plain authenticator failed for ([175.119.20.149]) [175.119.20.149]:42552: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.231.102.189
description:
2025-02-04 14:04:28 dovecot_plain authenticator failed for ([73.231.102.189]) [73.231.102.189]:35754: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.243.2
description:
Feb  4 14:04:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.243.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.143.245.194
description:
2025-02-04 14:04:31 dovecot_plain authenticator failed for ([5.143.245.194]) [5.143.245.194]:44258: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.217.137.126
description:
Feb  4 14:04:35 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.217.137.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.194.38.121
description:
Feb  4 14:04:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.194.38.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.205.48.62
description:
Feb  4 14:04:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.205.48.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.126.114.239
description:
Feb  4 14:04:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.126.114.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.126.114.239
description:
2025-02-04 14:04:20 dovecot_plain authenticator failed for 239.114.126.34.bc.googleusercontent.com [34.126.114.239]:49708: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Feb  4 14:04:21 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.23
description:
2025-02-04 14:04:34 dovecot_plain authenticator failed for ([121.202.152.23]) [121.202.152.23]:48583: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.198.60
description:
2025-02-04 14:04:35 dovecot_plain authenticator failed for ([121.189.198.60]) [121.189.198.60]:41476: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.94.219
description:
2025-02-04 14:04:35 dovecot_plain authenticator failed for ([124.246.94.219]) [124.246.94.219]:44056: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.102
description:
2025-02-04 14:04:25 dovecot_plain authenticator failed for ([121.202.152.102]) [121.202.152.102]:24582: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.73.242
description:
Feb  4 14:03:43 ait sshd[4151017]: Failed password for invalid user Can't open exe from 36.37.73.242 port 43988 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.206.95.195
description:
Feb  4 14:04:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.206.95.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.101.16.250
description:
Feb  4 14:04:23 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.101.16.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.143.245.194
description:
Feb  4 14:04:29 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.143.245.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
description:
2025-02-04 14:04:35 dovecot_plain authenticator failed for ([90.173.78.90]) [90.173.78.90]:57461: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.16.156.103
description:
Feb  4 14:04:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.16.156.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.160.45.26
description:
Feb  4 14:04:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.160.45.26 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.32.121.209
description:
[2025-02-04 14:03:49 +0100] info [webmaild] 179.32.121.209 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.134.126.162
description:
2025-02-04 14:04:17 dovecot_plain authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:4745: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.184.155
description:
Feb  4 14:04:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.184.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.65
description:
2025-02-04 14:04:20 dovecot_plain authenticator failed for (m121-202-154-65.smartone.com) [121.202.154.65]:60684: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.26.86
description:
2025-02-04 14:04:20 dovecot_plain authenticator failed for ([65.76.26.86]) [65.76.26.86]:58514: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.10.15
description:
Feb  4 14:04:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.10.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
description:
2025-02-04 14:04:35 dovecot_plain authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:4949: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.159.117.51
description:
Feb  4 14:04:16 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.159.117.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.120.227.186
description:
Feb  4 14:04:37 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.120.227.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.194.38.121
description:
2025-02-04 14:04:41 dovecot_plain authenticator failed for ([2.194.38.121]) [2.194.38.121]:35476: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.222.84
description:
2025-02-04 14:04:42 dovecot_plain authenticator failed for ([183.234.222.84]) [183.234.222.84]:56027: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.88.152
description:
Feb  4 14:04:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.88.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.134.109.253
description:
2025-02-04 14:04:33 dovecot_plain authenticator failed for ([124.134.109.253]) [124.134.109.253]:46544: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.92.123.104
description:
Feb  4 14:03:49 ait sshd[4151114]: pam_imunify(sshd:auth): [IM360_RBL] The IP 59.92.123.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
description:
2025-02-04 14:04:21 dovecot_plain authenticator failed for ([222.114.200.160]) [222.114.200.160]:47128: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.179
description:
2025-02-04 14:04:37 dovecot_plain authenticator failed for ([182.135.66.179]) [182.135.66.179]:45472: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.227.186
description:
2025-02-04 14:04:39 dovecot_plain authenticator failed for ([220.120.227.186]) [220.120.227.186]:48072: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.134.126.162
description:
Feb  4 14:04:15 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.134.126.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.108.27
description:
Feb  4 14:04:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.108.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
description:
Feb  4 14:04:27 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.108.27
description:
2025-02-04 14:04:22 dovecot_plain authenticator failed for net-93-64-108-27.cust.vodafonedsl.it [93.64.108.27]:46043: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.76
description:
Feb  4 14:04:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.160.70
description:
Feb  4 14:04:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.160.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-02-04 14:04:30 dovecot_plain authenticator failed for ([171.244.40.236]) [171.244.40.236]:42592: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.173.78.90
description:
Feb  4 14:04:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.173.78.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.38.74
description:
Feb  4 14:04:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.38.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.108.14.225
description:
Feb  4 14:04:21 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.108.14.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.23
description:
Feb  4 14:04:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
description:
2025-02-04 14:04:33 dovecot_plain authenticator failed for (18712549.telemar.net.br) [187.76.174.254]:60680: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.243.2
description:
2025-02-04 14:04:33 dovecot_plain authenticator failed for ([183.220.243.2]) [183.220.243.2]:41726: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.95.195
description:
2025-02-04 14:04:19 dovecot_plain authenticator failed for ([47.206.95.195]) [47.206.95.195]:40145: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.204.13
description:
2025-02-04 14:04:29 dovecot_plain authenticator failed for vps-45cb66f2.vps.ovh.net [135.125.204.13]:55390: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.199.5.231
description:
Feb  4 14:04:44 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.199.5.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.89.232.138
description:
2025-02-04 14:04:45 dovecot_plain authenticator failed for ([159.89.232.138]) [159.89.232.138]:25362: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.199.99
description:
Feb  4 14:04:46 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.199.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.114.206
description:
Feb  4 14:04:47 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.114.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.244.39
description:
Feb  4 14:04:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.44.171
description:
2025-02-04 14:04:43 dovecot_plain authenticator failed for ([222.128.44.171]) [222.128.44.171]:2222: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.199.99
description:
2025-02-04 14:04:48 dovecot_plain authenticator failed for (ppp99-lumwana.zamnet.zm) [196.46.199.99]:35624: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
description:
2025-02-04 14:04:43 dovecot_plain authenticator failed for ([62.201.228.210]) [62.201.228.210]:33458: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.213
description:
2025-02-04 14:04:44 dovecot_plain authenticator failed for (m121-202-154-213.smartone.com) [121.202.154.213]:20667: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.244.39
description:
2025-02-04 14:04:44 dovecot_plain authenticator failed for ([103.69.244.39]) [103.69.244.39]:49880: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.115.173.11
description:
Feb  4 14:04:48 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.115.173.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.85.164
description:
2025-02-04 14:04:54 dovecot_plain authenticator failed for (23-94-85-164-host.colocrossing.com) [23.94.85.164]:33456: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.213
description:
Feb  4 14:04:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.160.45.26
description:
2025-02-04 14:04:43 dovecot_plain authenticator failed for ([124.160.45.26]) [124.160.45.26]:51458: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.225.53.149
description:
2025-02-04 14:04:53 dovecot_plain authenticator failed for ([173.225.53.149]) [173.225.53.149]:59357: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
description:
2025-02-04 14:04:43 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:54062: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
description:
2025-02-04 14:04:47 dovecot_plain authenticator failed for (static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:40206: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.225.53.149
description:
Feb  4 14:04:51 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.225.53.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.2.44.54
description:
Feb  4 14:04:45 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.2.44.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
description:
Feb  4 14:04:48 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.114.206
description:
2025-02-04 14:04:49 dovecot_plain authenticator failed for ([39.152.114.206]) [39.152.114.206]:33680: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.85.164
description:
Feb  4 14:04:52 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.85.164 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 223.29.215.61
description:
[2025-02-04 14:05:11 +0100] info [webmaild] 223.29.215.61 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.232.138
description:
Feb  4 14:04:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.232.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.199.5.231
description:
2025-02-04 14:04:46 dovecot_plain authenticator failed for ([211.199.5.231]) [211.199.5.231]:40232: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.50.134.183
description:
Feb  4 14:04:51 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.50.134.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.218.7
description:
Feb  4 14:04:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.218.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
description:
2025-02-04 14:04:50 dovecot_plain authenticator failed for ([220.80.223.144]) [220.80.223.144]:39660: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
description:
2025-02-04 14:04:50 dovecot_plain authenticator failed for ([45.115.173.11]) [45.115.173.11]:54609: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.50.134.183
description:
2025-02-04 14:04:53 dovecot_plain authenticator failed for ([77.50.134.183]) [77.50.134.183]:52746: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.218.7
description:
2025-02-04 14:04:57 dovecot_plain authenticator failed for ([60.173.218.7]) [60.173.218.7]:45221: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.151.218.110
description:
Feb  4 14:06:39 ait sshd[4152716]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.151.218.110


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.150.242.61
description:
[2025-02-04 14:05:43 +0100] info [webmaild] 170.150.242.61 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.2.234.106
description:
Feb  4 14:06:09 ait sshd[4152444]: pam_imunify(sshd:auth): [IM360_RBL] The IP 212.2.234.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 14:06:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.105.73.159
description:
[2025-02-04 14:05:58 +0100] info [webmaild] 41.105.73.159 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 212.2.234.106
description:
Feb  4 14:06:09 ait sshd[4152444]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.2.234.106


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.114.64.219
description:
[2025-02-04 14:06:37 +0100] info [webmaild] 200.114.64.219 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.151.218.110
description:
Feb  4 14:06:39 ait sshd[4152716]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.151.218.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.89.116.5
description:
Feb  4 14:06:44 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.89.116.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
description:
2025-02-04 14:06:46 dovecot_plain authenticator failed for ([70.89.116.5]) [70.89.116.5]:44437: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.25.254
description:
Feb  4 14:06:50 ait sshd[4152760]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.25.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.237.137.30
description:
Feb  4 14:06:54 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.237.137.30 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.97.14
description:
47.128.97.14 - - [04/Feb/2025:14:07:04 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=1703835 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/14/?filter_course-category=205&filter_course-language=198&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.97.14


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.71.17
description:
Feb  4 14:07:40 ait sshd[4153116]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.71.17


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.199.25.254
description:
Feb  4 14:06:50 ait sshd[4152760]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.25.254


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.137.30
description:
2025-02-04 14:06:56 dovecot_plain authenticator failed for ([1.237.137.30]) [1.237.137.30]:41903: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.71.17
description:
Feb  4 14:07:40 ait sshd[4153116]: pam_imunify(sshd:auth): [IM360_RBL] The IP 139.59.71.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.24.138.130
description:
Feb  4 14:07:54 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.24.138.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.115.19.225
description:
Feb  4 14:07:54 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.115.19.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Feb  4 14:08:08 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.127
description:
Feb  4 14:08:23 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.247
description:
Feb  4 14:08:23 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.247
description:
2025-02-04 14:08:25 dovecot_plain authenticator failed for (m121-202-153-247.smartone.com) [121.202.153.247]:2766: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.101.131.83
description:
2025-02-04 14:08:35 dovecot_plain authenticator failed for ([92.101.131.83]) [92.101.131.83]:52881: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.202.94.224
description:
2025-02-04 14:08:10 dovecot_plain authenticator failed for o6z8xc.static.otenet.gr [87.202.94.224]:51598: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.168.106
description:
2025-02-04 14:08:11 dovecot_plain authenticator failed for ([124.115.168.106]) [124.115.168.106]:46935: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.24.138.130
description:
2025-02-04 14:07:56 dovecot_plain authenticator failed for syn-024-024-138-130.res.spectrum.com [24.24.138.130]:60678: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.224.46
description:
2025-02-04 14:08:25 dovecot_plain authenticator failed for p37046-obmd01.osaka.ocn.ne.jp [153.141.224.46]:57472: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.168.106
description:
Feb  4 14:08:09 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.168.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-02-04 14:08:10 dovecot_plain authenticator failed for ([80.82.54.138]) [81.211.77.58]:25767: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-02-04 14:08:20 dovecot_plain authenticator failed for ([59.2.141.155]) [59.2.141.155]:46524: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.224.46
description:
Feb  4 14:08:23 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.224.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Feb  4 14:08:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 164.163.103.232
description:
[2025-02-04 14:08:42 +0100] info [webmaild] 164.163.103.232 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.127
description:
2025-02-04 14:08:25 dovecot_plain authenticator failed for (m121-202-154-127.smartone.com) [121.202.154.127]:18442: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 164.163.195.117
description:
[2025-02-04 14:07:59 +0100] info [webmaild] 164.163.195.117 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Feb  4 14:08:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.173.234
description:
2025-02-04 14:08:32 dovecot_plain authenticator failed for ([220.118.173.234]) [220.118.173.234]:35934: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.101.131.83
description:
Feb  4 14:08:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.101.131.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-02-04 14:08:43 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:40192: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.115.19.225
description:
2025-02-04 14:07:56 dovecot_plain authenticator failed for 24.115.19.225.res-cmts.sm3.ptd.net [24.115.19.225]:47238: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.202.94.224
description:
Feb  4 14:08:08 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.202.94.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.118.173.234
description:
Feb  4 14:08:30 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.118.173.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.241.253
description:
2025-02-04 14:09:29 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:60580: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Feb  4 14:08:48 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.238.25.224
description:
[2025-02-04 14:08:47 +0100] info [webmaild] 160.238.25.224 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.101.36.159
description:
Feb  4 14:09:35 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.101.36.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-02-04 14:08:50 dovecot_plain authenticator failed for (94-43-224-106.dsl.utg.ge) [2.57.219.2]:50438: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.111.139.88
description:
2025-02-04 14:09:02 dovecot_plain authenticator failed for pool-98-111-139-88.phlapa.fios.verizon.net [98.111.139.88]:46440: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
description:
2025-02-04 14:09:37 dovecot_plain authenticator failed for ([89.101.36.159]) [89.101.36.159]:36709: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.241.253
description:
Feb  4 14:09:27 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.241.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.111.139.88
description:
Feb  4 14:09:00 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.111.139.88 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.214.31.15
description:
[2025-02-04 14:09:17 +0100] info [webmaild] 37.214.31.15 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.1.239.146
description:
Feb  4 14:10:06 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.1.239.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.59.2
description:
Feb  4 14:10:13 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.59.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.59.2
description:
2025-02-04 14:10:15 dovecot_plain authenticator failed for syn-074-062-059-002.biz.spectrum.com [74.62.59.2]:33929: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.93.87.71
description:
2025-02-04 14:10:17 dovecot_plain authenticator failed for ([119.93.87.71]) [119.93.87.71]:12548: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.125.94
description:
Feb  4 14:10:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.125.94 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 207.180.230.127
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:shedatowusua1234@gmail.com||WPU:shedatowusua1234@gmail.com||RSV:6.65||T:APACHE||MV:14-10.207.180.230.127


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
description:
2025-02-04 14:10:33 dovecot_plain authenticator failed for ([84.54.115.46]) [84.54.115.46]:48960: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.215.21.164
description:
2025-02-04 14:10:35 dovecot_plain authenticator failed for (dynamicip-176-215-21-164.pppoe.ekat.ertelecom.ru) [176.215.21.164]:54994: 535 Incorrect authentication data (set_id=ug88m8880009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.224.164.194
description:
Feb  4 14:10:07 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.224.164.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.164.194
description:
2025-02-04 14:10:09 dovecot_plain authenticator failed for ([122.224.164.194]) [122.224.164.194]:36122: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.142.157
description:
Feb  4 14:10:23 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.142.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
description:
2025-02-04 14:10:25 dovecot_plain authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:47914: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.215.21.164
description:
Feb  4 14:10:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.215.21.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.114.230
description:
Feb  4 14:10:35 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.114.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.114.230
description:
2025-02-04 14:10:37 dovecot_plain authenticator failed for zdomainaccess.com [216.70.114.230]:38670: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.239.146
description:
2025-02-04 14:10:08 dovecot_plain authenticator failed for ([116.231.84.13]) [218.1.239.146]:16284: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.93.87.71
description:
Feb  4 14:10:15 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.93.87.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
description:
2025-02-04 14:10:22 dovecot_plain authenticator failed for ([111.171.125.94]) [111.171.125.94]:57078: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.54.115.46
description:
Feb  4 14:10:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.54.115.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.131.55
description:
2025-02-04 14:11:11 dovecot_plain authenticator failed for (abts-mum-static-055.131.179.122.airtelbroadband.in) [122.179.131.55]:47416: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.124.221.2
description:
Feb  4 14:11:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.124.221.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
description:
2025-02-04 14:11:19 dovecot_plain authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:38068: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.28.229.151
description:
[2025-02-04 14:11:24 +0100] info [webmaild] 104.28.229.151 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.54.166.34
description:
[2025-02-04 14:10:50 +0100] info [webmaild] 185.54.166.34 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.123.72.205
description:
2025-02-04 14:10:59 dovecot_plain authenticator failed for ([187.123.72.205]) [187.123.72.205]:39282: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.179.131.55
description:
Feb  4 14:11:09 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.179.131.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.123.72.205
description:
Feb  4 14:10:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.123.72.205 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.147.100.165
description:
[2025-02-04 14:11:56 +0100] info [webmaild] 185.147.100.165 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 14:12:12 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 147.45.44.84
description:
[2025-02-04 14:12:21 +0100] info [cpaneld] 147.45.44.84 - lemsas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.99.199.175
description:
[2025-02-04 14:12:30 +0100] info [webmaild] 138.99.199.175 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.160.25.51
description:
2025-02-04 14:12:44 dovecot_plain authenticator failed for ([217.160.25.51]) [217.160.25.51]:62479: 535 Incorrect authentication data (set_id=(iric.us/administrator/index.php))


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.65
description:
Feb  4 14:13:02 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.65 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.160.25.51
description:
[2025-02-04 14:13:06 +0100] info [webmaild] 217.160.25.51 - (iric.usadministratorindex.php) "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 14:13:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.58.235
description:
47.128.58.235 - - [04/Feb/2025:14:13:03 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12958412 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/help.php?file=highscores.html&module=lesson" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.58.235


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.3.198
description:
Feb  4 14:13:14 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.3.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.198
description:
2025-02-04 14:13:16 dovecot_plain authenticator failed for 111-70-3-198.emome-ip.hinet.net [111.70.3.198]:43740: 535 Incorrect authentication data (set_id=zabopiqu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.65
description:
2025-02-04 14:13:04 dovecot_plain authenticator failed for (m121-202-154-65.smartone.com) [121.202.154.65]:49100: 535 Incorrect authentication data (set_id=zabopiqu@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 54.238.102.131
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-13.54.238.102.131


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.91.84.187
description:
[2025-02-04 14:13:37 +0100] info [webmaild] 181.91.84.187 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.250.191.189
description:
Feb  4 14:13:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.250.191.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
description:
2025-02-04 14:13:43 dovecot_plain authenticator failed for (undiverixt) [178.250.191.189]:57350: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.68.140.165
description:
[2025-02-04 14:14:08 +0100] info [webmaild] 190.68.140.165 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-14.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.69.21.11
description:
[2025-02-04 14:14:37 +0100] info [webmaild] 181.69.21.11 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.72.212
description:
[2025-02-04 14:15:12 +0100] info [webmaild] 84.54.72.212 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.52.116
description:
Feb  4 14:16:11 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.52.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 14:16:21 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.52.116
description:
2025-02-04 14:16:13 dovecot_plain authenticator failed for ([111.53.52.116]) [111.53.52.116]:49592: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.37.54
description:
Feb  4 14:15:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.37.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.218.168.67
description:
Feb  4 14:15:51 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.218.168.67 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.156.182.142
description:
[2025-02-04 14:16:18 +0100] info [webmaild] 177.156.182.142 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.32.209.51
description:
2025-02-04 14:16:22 dovecot_plain authenticator failed for ([217.32.209.50]) [217.32.209.51]:35366: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.37.54
description:
2025-02-04 14:15:44 dovecot_plain authenticator failed for 054.37.246.220.static.netvigator.com [220.246.37.54]:55556: 535 Incorrect authentication data (set_id=eng18a00033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.32.209.51
description:
Feb  4 14:16:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.32.209.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.168.67
description:
2025-02-04 14:15:53 dovecot_plain authenticator failed for (189.218.168.67-clientes-izzi.mx) [189.218.168.67]:33683: 535 Incorrect authentication data (set_id=eng18a00033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.72.83.179
description:
2025-02-04 14:17:19 dovecot_plain authenticator failed for ([178.72.83.179]) [178.72.83.179]:56754: 535 Incorrect authentication data (set_id=paakow2@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.230.67.252
description:
[2025-02-04 14:17:04 +0100] info [webmaild] 88.230.67.252 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.72.83.179
description:
Feb  4 14:17:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.72.83.179 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.217.103.158
description:
[2025-02-04 14:17:26 +0100] info [webmaild] 179.217.103.158 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.132.221.103
description:
[2025-02-04 14:18:01 +0100] info [webmaild] 188.132.221.103 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.99
description:
Feb  4 14:18:09 ait sshd[4159525]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.99 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.99
description:
Feb  4 14:18:09 ait sshd[4159525]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.99  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.29.135.230
description:
Feb  4 14:18:21 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.29.135.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.29.135.230
description:
2025-02-04 14:18:23 dovecot_plain authenticator failed for 50.29.135.230.res-cmts.mtp2.ptd.net [50.29.135.230]:40166: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.24.138.130
description:
2025-02-04 14:18:36 dovecot_plain authenticator failed for syn-024-024-138-130.res.spectrum.com [24.24.138.130]:49393: 535 Incorrect authentication data (set_id=vobynuma@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.233.183
description:
2025-02-04 14:18:34 dovecot_plain authenticator failed for ([27.45.233.183]) [27.45.233.183]:41833: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.182.116.62
description:
Feb  4 14:17:46 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.182.116.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.116.62
description:
2025-02-04 14:17:48 dovecot_plain authenticator failed for (ticatiors) [62.182.116.62]:38773: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.24.138.130
description:
Feb  4 14:18:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.24.138.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.134.239.97
description:
Feb  4 14:17:48 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.134.239.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.134.239.97
description:
2025-02-04 14:17:50 dovecot_plain authenticator failed for ([182.134.239.97]) [182.134.239.97]:45766: 535 Incorrect authentication data (set_id=paakow2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.233.183
description:
Feb  4 14:18:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.233.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 14:18:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.213
description:
2025-02-04 14:19:17 dovecot_plain authenticator failed for (m121-202-154-213.smartone.com) [121.202.154.213]:23940: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.29.100.218
description:
2025-02-04 14:19:40 dovecot_plain authenticator failed for ([60.29.100.218]) [60.29.100.218]:39100: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.1.40.151
description:
Feb  4 14:19:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.1.40.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.217.183
description:
2025-02-04 14:19:41 dovecot_plain authenticator failed for (189-56-217-183.customer.tdatabrasil.net.br) [189.56.217.183]:39209: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.117.91.67
description:
2025-02-04 14:19:01 dovecot_plain authenticator failed for ([220.117.91.67]) [220.117.91.67]:34480: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.171.195.70
description:
Feb  4 14:19:07 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.171.195.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.171.195.70
description:
2025-02-04 14:19:09 dovecot_plain authenticator failed for ([216.171.195.70]) [216.171.195.70]:51991: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.251.251
description:
2025-02-04 14:19:12 dovecot_plain authenticator failed for (251.251.223.60.adsl-pool.sx.cn) [60.223.251.251]:39667: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.190.69
description:
Feb  4 14:19:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.255.190.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.174.233.64
description:
Feb  4 14:19:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.174.233.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.174.233.64
description:
2025-02-04 14:19:36 dovecot_plain authenticator failed for h-158-174-233-64.a192.priv.bahnhof.se [158.174.233.64]:44559: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.71.199.46
description:
2025-02-04 14:18:48 dovecot_plain authenticator failed for ([120.71.199.46]) [120.71.199.46]:53394: 535 Incorrect authentication data (set_id=vobynuma)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.146.249.78
description:
[2025-02-04 14:19:01 +0100] info [webmaild] 200.146.249.78 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.238.237.254
description:
Feb  4 14:19:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.238.237.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.88.186.142
description:
Feb  4 14:19:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.88.186.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.238.237.254
description:
2025-02-04 14:19:41 dovecot_plain authenticator failed for ([211.238.237.254]) [211.238.237.254]:35192: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.87.205.105
description:
Feb  4 14:19:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.87.205.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.189.234.37
description:
2025-02-04 14:18:57 dovecot_plain authenticator failed for (ip103-189-234-37.cloudhost.web.id) [103.189.234.37]:58968: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.213
description:
Feb  4 14:19:15 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.79.91.142
description:
2025-02-04 14:19:38 dovecot_plain authenticator failed for wsip-174-79-91-142.br.br.cox.net [174.79.91.142]:60543: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.198.18.3
description:
Feb  4 14:19:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.198.18.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.223.203
description:
Feb  4 14:18:51 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.223.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.200.161
description:
Feb  4 14:19:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.200.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.79.91.142
description:
Feb  4 14:19:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.79.91.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.149.125.227
description:
Feb  4 14:19:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.149.125.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.217.183
description:
Feb  4 14:19:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.217.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
description:
2025-02-04 14:19:38 dovecot_plain authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:51446: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.200.161
description:
2025-02-04 14:19:38 dovecot_plain authenticator failed for (nlos-200-161.zamnet.zm) [196.46.200.161]:48705: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.51.122.230
description:
Feb  4 14:19:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.51.122.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.189.234.37
description:
Feb  4 14:18:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.189.234.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.201.37.210
description:
Feb  4 14:19:35 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.201.37.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.41.137
description:
Feb  4 14:19:35 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.41.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
description:
Feb  4 14:19:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
description:
2025-02-04 14:19:37 dovecot_plain authenticator failed for ([196.190.43.139]) [196.190.41.137]:36241: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.29.100.218
description:
Feb  4 14:19:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.29.100.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.149.125.227
description:
2025-02-04 14:19:38 dovecot_plain authenticator failed for ([197.149.125.227]) [197.149.125.227]:55662: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.51.122.230
description:
2025-02-04 14:19:41 dovecot_plain authenticator failed for ([58.51.122.230]) [58.51.122.230]:39324: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.117.91.67
description:
Feb  4 14:18:59 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.117.91.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.251.251
description:
Feb  4 14:19:10 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.251.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.190.69
description:
2025-02-04 14:19:35 dovecot_plain authenticator failed for ([92.255.190.69]) [92.255.190.69]:47942: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.65.6.241
description:
[2025-02-04 14:19:32 +0100] info [webmaild] 178.65.6.241 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.201.37.210
description:
2025-02-04 14:19:37 dovecot_plain authenticator failed for ([50.201.37.210]) [50.201.37.210]:56503: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.71.199.46
description:
Feb  4 14:18:46 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.71.199.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.223.203
description:
2025-02-04 14:18:53 dovecot_plain authenticator failed for ([210.99.223.203]) [210.99.223.203]:57062: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.205.251
description:
Feb  4 14:19:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.205.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.100.184.80
description:
Feb  4 14:20:12 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.100.184.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.214.52.214
description:
2025-02-04 14:20:29 dovecot_plain authenticator failed for ([175.214.52.214]) [175.214.52.214]:32338: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.202.61.155
description:
2025-02-04 14:19:53 dovecot_plain authenticator failed for 155-61-202-109.kamensktel.ru [109.202.61.155]:35490: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
description:
2025-02-04 14:20:00 dovecot_plain authenticator failed for (www.nettlinx.com) [202.53.94.242]:52118: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.52.202.92
description:
Feb  4 14:19:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.52.202.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.183.11.30
description:
Feb  4 14:19:56 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.183.11.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.17.165
description:
Feb  4 14:20:02 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.17.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.227.118
description:
Feb  4 14:19:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.227.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.183.11.30
description:
2025-02-04 14:19:58 dovecot_plain authenticator failed for ([103.183.11.30]) [103.183.11.30]:46404: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.214.52.214
description:
Feb  4 14:20:27 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.214.52.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.100.184.80
description:
2025-02-04 14:20:14 dovecot_plain authenticator failed for (73.153.212.218.starhub.net.sg) [101.100.184.80]:48550: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.201.228.210
description:
Feb  4 14:19:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.201.228.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.139.39.150
description:
2025-02-04 14:19:48 dovecot_plain authenticator failed for ([182.139.39.150]) [182.139.39.150]:43032: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.101.16.250
description:
Feb  4 14:19:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.101.16.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.102.179
description:
Feb  4 14:19:52 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.102.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 14:20:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.76.127
description:
2025-02-04 14:19:44 dovecot_plain authenticator failed for ([183.107.76.127]) [183.107.76.127]:55969: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.10.46
description:
2025-02-04 14:19:51 dovecot_plain authenticator failed for ([120.197.10.46]) [120.197.10.46]:39062: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.93.113.138
description:
2025-02-04 14:20:00 dovecot_plain authenticator failed for ([41.93.113.138]) [41.93.113.138]:56704: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.17.165
description:
2025-02-04 14:20:04 dovecot_plain authenticator failed for (abts-north-static-165.17.160.122.airtelbroadband.in) [122.160.17.165]:52628: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.239.78.124
description:
Feb  4 14:19:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.239.78.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Feb  4 14:20:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.93.183
description:
Feb  4 14:19:53 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.93.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.66.190.67
description:
Feb  4 14:19:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.66.190.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.87.205.105
description:
2025-02-04 14:19:42 dovecot_plain authenticator failed for ([222.87.205.105]) [222.87.205.105]:60203: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.52.202.92
description:
2025-02-04 14:19:51 dovecot_plain authenticator failed for ([123.52.202.92]) [123.52.202.92]:54918: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.202.61.155
description:
Feb  4 14:19:51 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.202.61.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.120.208.148
description:
2025-02-04 14:20:06 dovecot_plain authenticator failed for ([146.120.208.148]) [146.120.208.148]:59109: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.69.142.186
description:
2025-02-04 14:20:16 dovecot_plain authenticator failed for 61-69-142-186.tpgi.com.au [61.69.142.186]:54676: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-02-04 14:20:28 dovecot_plain authenticator failed for (witrosal) [109.166.70.166]:37606: 535 Incorrect authentication data (set_id=abs65b11556y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.11.25.195
description:
2025-02-04 14:19:51 dovecot_plain authenticator failed for ([66.11.25.195]) [66.11.25.195]:56044: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.89.72
description:
2025-02-04 14:19:50 dovecot_plain authenticator failed for ([112.132.89.72]) [112.132.89.72]:51747: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
description:
2025-02-04 14:19:51 dovecot_plain authenticator failed for ([185.134.179.106]) [185.101.16.250]:45213: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.102.179
description:
2025-02-04 14:19:54 dovecot_plain authenticator failed for ([183.238.102.179]) [183.238.102.179]:34724: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.66.190.67
description:
2025-02-04 14:19:59 dovecot_plain authenticator failed for ([116.66.190.67]) [116.66.190.67]:34706: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.88.186.142
description:
2025-02-04 14:19:42 dovecot_plain authenticator failed for ([201.88.186.142]) [201.88.186.142]:47663: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.54.7.176
description:
[2025-02-04 14:20:27 +0100] info [webmaild] 177.54.7.176 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
description:
2025-02-04 14:19:43 dovecot_plain authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:60503: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.89.72
description:
Feb  4 14:19:48 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.89.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.11.25.195
description:
Feb  4 14:19:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.11.25.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.227.118
description:
2025-02-04 14:19:59 dovecot_plain authenticator failed for ([14.48.227.118]) [14.48.227.118]:36076: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.69.142.186
description:
Feb  4 14:20:14 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.69.142.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.10.46
description:
Feb  4 14:19:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.10.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.205.251
description:
2025-02-04 14:19:51 dovecot_plain authenticator failed for ([183.236.205.251]) [183.236.205.251]:52245: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.148.187.146
description:
Feb  4 14:19:56 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.148.187.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.53.94.242
description:
Feb  4 14:19:58 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.53.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
description:
Feb  4 14:19:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
description:
2025-02-04 14:19:51 dovecot_plain authenticator failed for ([62.201.228.210]) [62.201.228.210]:42742: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
description:
2025-02-04 14:19:57 dovecot_plain authenticator failed for ([182.239.78.124]) [182.239.78.124]:48140: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.148.187.146
description:
2025-02-04 14:19:58 dovecot_plain authenticator failed for (azteca-comunicaciones.com) [186.148.187.146]:33838: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.18.3
description:
2025-02-04 14:19:42 dovecot_plain authenticator failed for ([175.198.18.3]) [175.198.18.3]:50295: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.139.39.150
description:
Feb  4 14:19:46 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.139.39.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
description:
2025-02-04 14:19:55 dovecot_plain authenticator failed for (corporativo.gvt.net.br) [189.115.93.183]:38552: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.93.113.138
description:
Feb  4 14:19:58 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.93.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 14:21:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.236.111.18
description:
Feb  4 14:20:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.236.111.18 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.20.154
description:
[2025-02-04 14:20:52 +0100] info [webmaild] 45.70.20.154 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.71.7.68
description:
[2025-02-04 14:21:48 +0100] info [webmaild] 105.71.7.68 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 14:22:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.81.190.29
description:
[2025-02-04 14:22:20 +0100] info [webmaild] 170.81.190.29 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.193.133
description:
Feb  4 14:22:29 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.193.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.193.133
description:
2025-02-04 14:22:31 dovecot_plain authenticator failed for (emacetor) [65.20.193.133]:51929: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.194.148.67
description:
[2025-02-04 14:23:30 +0100] info [webmaild] 186.194.148.67 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.185.159.235
description:
[2025-02-04 14:22:54 +0100] info [webmaild] 197.185.159.235 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.0.148
description:
2025-02-04 14:24:20 dovecot_plain authenticator failed for ool-43530094.dyn.optonline.net [67.83.0.148]:61262: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.77.212.116
description:
Feb  4 14:24:27 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.77.212.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.99
description:
Feb  4 14:24:28 ait sshd[4162648]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.99 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.99
description:
Feb  4 14:24:28 ait sshd[4162648]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.99  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.77.212.116
description:
2025-02-04 14:24:29 dovecot_plain authenticator failed for ([5.77.212.116]) [5.77.212.116]:42536: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Feb  4 14:23:46 ait sshd[4162353]: Invalid user heilos-abwassertechnik.com 2a03 from 122.51.104.242 port 53272


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Feb  4 14:23:46 ait sshd[4162353]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  4 14:23:46 ait sshd[4162353]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.83.0.148
description:
Feb  4 14:24:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.83.0.148 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.220.15.230
description:
[2025-02-04 14:24:25 +0100] info [webmaild] 179.220.15.230 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 14:25:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.195.36.27
description:
[2025-02-04 14:25:40 +0100] info [webmaild] 168.195.36.27 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.236.34.38
description:
[2025-02-04 14:24:56 +0100] info [webmaild] 188.236.34.38 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.99
description:
Feb  4 14:26:36 ait sshd[4163597]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.99  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.106.60.88
description:
[2025-02-04 14:26:17 +0100] info [webmaild] 91.106.60.88 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.99
description:
Feb  4 14:26:36 ait sshd[4163597]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.99 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.81.156.176
description:
[2025-02-04 14:28:10 +0100] info [webmaild] 170.81.156.176 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 14:28:28 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.177.13.46
description:
[2025-02-04 14:27:44 +0100] info [webmaild] 45.177.13.46 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 165.154.227.235
description:
2025-02-04 14:28:02 H=(mail.university-publishing.com) [165.154.227.235]:56291 F=<fdynecm@university-publishing.com> rejected RCPT <validxxxg@gmail.com>: Sender verify failed


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Feb  4 14:30:42 ait sshd[4165977]: Invalid user heilos-abwassertechnik.com 2a03 from 122.51.104.242 port 37676


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.218.88.24
description:
Feb  4 14:30:10 ait sshd[4165659]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.218.88.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.54.52.170
description:
[2025-02-04 14:30:16 +0100] info [webmaild] 186.54.52.170 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.242.71.107
description:
Feb  4 14:30:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.242.71.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.59.157
description:
Feb  4 14:30:28 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.59.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.255.34.171
description:
2025-02-04 14:30:15 dovecot_plain authenticator failed for broadband-188-255-34-171.ip.moscow.rt.ru [188.255.34.171]:51226: 535 Incorrect authentication data (set_id=baah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.90
description:
Feb  4 14:30:30 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Feb  4 14:29:50 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.218.88.24
description:
Feb  4 14:30:10 ait sshd[4165659]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.218.88.24  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.255.34.171
description:
Feb  4 14:30:13 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.255.34.171 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Feb  4 14:30:38 ait sshd[4165973]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-02-04 14:29:52 dovecot_plain authenticator failed for (suffe) [109.166.70.166]:18010: 535 Incorrect authentication data (set_id=nanette.huggins@jaster.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.242.71.107
description:
2025-02-04 14:30:21 dovecot_plain authenticator failed for ([36.32.223.199]) [58.242.71.107]:47454: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
description:
2025-02-04 14:30:30 dovecot_plain authenticator failed for ([195.222.59.157]) [195.222.59.157]:48104: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.176.88.120
description:
[2025-02-04 14:29:44 +0100] info [webmaild] 103.176.88.120 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-29.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.90
description:
2025-02-04 14:30:32 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:49052: 535 Incorrect authentication data (set_id=baah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Feb  4 14:31:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-02-04 14:31:40 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (salica) [87.103.126.54]:35301: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Feb  4 14:30:42 ait sshd[4165977]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  4 14:30:42 ait sshd[4165977]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Feb  4 14:30:44 ait sshd[4165977]: Failed password for invalid user heilos-abwassertechnik.com 2a03 from 122.51.104.242 port 37676 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.190.202.223
description:
[2025-02-04 14:30:49 +0100] info [webmaild] 45.190.202.223 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 14:31:03 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.99.79
description:
47.128.99.79 - - [04/Feb/2025:14:31:23 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=22794621 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=120%2C99%2C118%2C121&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.99.79


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 123.253.94.53
description:
[2025-02-04 14:31:56 +0100] info [webmaild] 123.253.94.53 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Feb  4 14:32:04 ait sshd[4166592]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 205.164.241.56
description:
[2025-02-04 14:32:30 +0100] info [webmaild] 205.164.241.56 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Feb  4 14:32:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-02-04 14:32:35 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:53926: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.195.103
description:
Feb  4 14:32:47 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.195.103 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.184.15
description:
[2025-02-04 14:32:59 +0100] info [webmaild] 170.239.184.15 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
description:
2025-02-04 14:33:08 dovecot_plain authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:58372: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 38.57.3.41
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:wadminw||WPU:wadminw||RSV:6.65||T:APACHE||MV:14-32.38.57.3.41


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.103
description:
2025-02-04 14:32:49 dovecot_plain authenticator failed for (m121-202-195-103.smartone.com) [121.202.195.103]:28022: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
description:
Feb  4 14:33:06 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.61.7.100
description:
Feb  4 14:33:30 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.61.7.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.121.173.19
description:
[2025-02-04 14:33:29 +0100] info [webmaild] 103.121.173.19 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.7.100
description:
2025-02-04 14:33:32 dovecot_plain authenticator failed for 100.7.61.94.rev.vodafone.pt [94.61.7.100]:38910: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.28.26.250
description:
Feb  4 14:33:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.28.26.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.7.52.183
description:
2025-02-04 14:34:12 dovecot_plain authenticator failed for ([110.7.52.183]) [110.7.52.183]:57998: 535 Incorrect authentication data (set_id=adsby)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.175.122
description:
Feb  4 14:33:50 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.175.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.175.122
description:
2025-02-04 14:33:52 dovecot_plain authenticator failed for ([120.236.175.122]) [120.236.175.122]:39900: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.28.26.250
description:
2025-02-04 14:33:59 dovecot_plain authenticator failed for (201-28-26-250.customer.tdatabrasil.net.br) [201.28.26.250]:37675: 535 Incorrect authentication data (set_id=adsby@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
description:
Feb  4 14:34:10 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.158.200.50
description:
[2025-02-04 14:34:43 +0100] info [webmaild] 186.158.200.50 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.84.238.16
description:
[2025-02-04 14:35:19 +0100] info [webmaild] 177.84.238.16 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Feb  4 14:35:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
description:
2025-02-04 14:35:36 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (marsupcong) [81.225.30.107]:51990: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.30.43.181
description:
[2025-02-04 14:35:44 +0100] info [webmaild] 177.30.43.181 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.41.161
description:
47.128.41.161 - - [04/Feb/2025:14:35:49 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20120514 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/a6317f?panel=config" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.41.161


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.250.107.160
description:
[2025-02-04 14:36:15 +0100] info [webmaild] 167.250.107.160 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
description:
2025-02-04 14:36:32 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (unther) [81.225.30.107]:57048: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 146.190.135.197
description:
[2025-02-04 14:36:29 +0100] info [cpaneld] 146.190.135.197 - lemsas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Feb  4 14:36:30 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.250
description:
Feb  4 14:36:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.250
description:
2025-02-04 14:36:36 dovecot_plain authenticator failed for ([121.202.155.250]) [121.202.155.250]:44326: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.71.254.162
description:
2025-02-04 14:36:51 dovecot_plain authenticator failed for ([223.71.254.162]) [223.71.254.162]:54479: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.148.115.56
description:
[2025-02-04 14:37:26 +0100] info [webmaild] 201.148.115.56 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.71.254.162
description:
Feb  4 14:36:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.71.254.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.183.192.246
description:
[2025-02-04 14:38:05 +0100] info [webmaild] 45.183.192.246 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.122
description:
Feb  4 14:38:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.122
description:
2025-02-04 14:38:22 dovecot_plain authenticator failed for ([103.79.175.122]) [103.79.175.122]:50561: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.222.90.178
description:
Feb  4 14:38:35 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.222.90.178 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.109.238.210
description:
[2025-02-04 14:38:35 +0100] info [webmaild] 103.109.238.210 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.222.90.178
description:
2025-02-04 14:38:37 dovecot_plain authenticator failed for ([200.222.80.81]) [200.222.90.178]:44564: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.142.69.112
description:
[2025-02-04 14:39:08 +0100] info [webmaild] 103.142.69.112 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.25.36.197
description:
Feb  4 14:39:11 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.25.36.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.25.36.197
description:
2025-02-04 14:39:13 dovecot_plain authenticator failed for ([37.25.36.197]) [37.25.36.197]:40664: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.215.188.37
description:
Feb  4 14:39:23 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.215.188.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.37
description:
2025-02-04 14:39:25 dovecot_plain authenticator failed for ([102.215.188.37]) [102.215.188.37]:33369: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.14.180.34
description:
Feb  4 14:40:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.14.180.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.14.180.34
description:
2025-02-04 14:40:28 dovecot_plain authenticator failed for ([218.14.180.34]) [218.14.180.34]:41082: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.148.78
description:
Feb  4 14:40:35 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.148.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.148.78
description:
2025-02-04 14:40:37 dovecot_plain authenticator failed for broadband-37-110-148-78.ip.moscow.rt.ru [37.110.148.78]:54972: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.236.239.19
description:
[2025-02-04 14:40:12 +0100] info [webmaild] 176.236.239.19 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.79.19
description:
2025-02-04 14:40:56 dovecot_plain authenticator failed for ([103.187.79.19]) [103.187.79.19]:46206: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.188.187.85
description:
Feb  4 14:40:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.188.187.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.79.19
description:
Feb  4 14:40:54 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.187.79.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.239.87.6
description:
Feb  4 14:41:01 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.239.87.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.239.87.6
description:
2025-02-04 14:41:03 dovecot_plain authenticator failed for (eniseep) [96.239.87.6]:38460: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.33.64.228
description:
[2025-02-04 14:41:36 +0100] info [webmaild] 189.33.64.228 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
description:
2025-02-04 14:40:45 dovecot_plain authenticator failed for ([196.188.187.85]) [196.188.187.85]:40710: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.235.182.69
description:
[2025-02-04 14:40:50 +0100] info [webmaild] 176.235.182.69 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 118.67.214.233
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-40.118.67.214.233


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.205.113.152
description:
[2025-02-04 14:42:09 +0100] info [webmaild] 37.205.113.152 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Feb  4 14:42:11 ait sshd[4171367]: Invalid user heilos-abwassertechnik.com 2a03 from 122.51.104.242 port 48512


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  4 14:42:11 ait sshd[4171367]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Feb  4 14:42:13 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-02-04 14:42:15 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (jagenessro) [87.103.126.54]:43563: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.90.58.82
description:
[2025-02-04 14:43:16 +0100] info [webmaild] 168.90.58.82 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
description:
Feb  4 14:43:25 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
description:
2025-02-04 14:43:43 dovecot_plain authenticator failed for ([220.161.52.149]) [220.161.52.149]:52306: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.206.136.24
description:
Feb  4 14:43:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.206.136.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.206.136.24
description:
2025-02-04 14:43:24 dovecot_plain authenticator failed for ([218.206.136.24]) [218.206.136.24]:56484: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
description:
2025-02-04 14:43:27 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:40890: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.7.203.177
description:
Feb  4 14:43:35 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.7.203.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.7.203.177
description:
2025-02-04 14:43:37 dovecot_plain authenticator failed for ([59.7.203.177]) [59.7.203.177]:54484: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.161.52.149
description:
Feb  4 14:43:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.161.52.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.31.93.182
description:
Feb  4 14:43:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.31.93.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.223.193.232
description:
Feb  4 14:43:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.223.193.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.223.193.232
description:
2025-02-04 14:43:45 dovecot_plain authenticator failed for ([88.223.193.232]) [88.223.193.232]:57296: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.223.154.170
description:
Feb  4 14:43:53 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.223.154.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.248.178.230
description:
Feb  4 14:44:16 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.248.178.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.93.182
description:
2025-02-04 14:43:44 dovecot_plain authenticator failed for ([112.31.93.182]) [112.31.93.182]:53930: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.229
description:
Feb  4 14:43:48 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.223.154.170
description:
2025-02-04 14:43:55 dovecot_plain authenticator failed for ([102.223.154.170]) [102.223.154.170]:51156: 535 Incorrect authentication data (set_id=eng21a00034y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-02-04 14:43:56 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:50263: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Feb  4 14:43:54 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.55.231.17
description:
[2025-02-04 14:43:54 +0100] info [webmaild] 177.55.231.17 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
description:
2025-02-04 14:43:50 dovecot_plain authenticator failed for ([196.189.124.229]) [196.189.124.229]:39910: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.248.178.230
description:
2025-02-04 14:44:18 dovecot_plain authenticator failed for 60-248-178-230.hinet-ip.hinet.net [60.248.178.230]:41866: 535 Incorrect authentication data (set_id=eng21a00034y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Feb  4 14:44:38 ait sshd[4172421]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.239.1.134
description:
Feb  4 14:45:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.239.1.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.239.1.134
description:
2025-02-04 14:45:36 dovecot_plain authenticator failed for (134-1-239-197.r.airtel.ug) [197.239.1.134]:52848: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.103.101.239
description:
[2025-02-04 14:45:38 +0100] info [webmaild] 105.103.101.239 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
description:
2025-02-04 14:44:53 dovecot_plain authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:53674: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 175.29.185.105
description:
[2025-02-04 14:45:05 +0100] info [webmaild] 175.29.185.105 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.170.28
description:
2025-02-04 14:45:26 dovecot_plain authenticator failed for ([103.207.170.28]) [103.207.170.28]:41780: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.21.191.178
description:
Feb  4 14:45:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.21.191.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.21.191.178
description:
2025-02-04 14:45:35 dovecot_plain authenticator failed for host-79-21-191-178.retail.telecomitalia.it [79.21.191.178]:37064: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.14.24.50
description:
Feb  4 14:44:51 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.14.24.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.102
description:
Feb  4 14:45:23 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.102
description:
2025-02-04 14:45:25 dovecot_plain authenticator failed for (nsg-corporate-102.234.187.122.airtel.in) [122.187.234.102]:49360: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.170.28
description:
Feb  4 14:45:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.170.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.9.73.59
description:
2025-02-04 14:45:34 dovecot_plain authenticator failed for (vm3161699.firstbyte.club) [45.9.73.59]:55836: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.9.73.59
description:
Feb  4 14:45:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.9.73.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.206.42
description:
Feb  4 14:45:09 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.206.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.206.42
description:
2025-02-04 14:45:11 dovecot_plain authenticator failed for ([122.227.206.42]) [122.227.206.42]:46242: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.145.160.120
description:
Feb  4 14:45:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.145.160.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.145.160.120
description:
2025-02-04 14:45:22 dovecot_plain authenticator failed for 120.sub-166-145-160.myvzw.com [166.145.160.120]:46900: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.107.243.16
description:
[2025-02-04 14:46:39 +0100] info [webmaild] 109.107.243.16 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-45.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.134.3.118
description:
[2025-02-04 14:46:04 +0100] info [webmaild] 103.134.3.118 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.216.7.163
description:
2025-02-04 14:47:32 dovecot_plain authenticator failed for 61-216-7-163.hinet-ip.hinet.net (61-216-7-165.hinet-ip.hinet.net) [61.216.7.163]:37078: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.216.7.163
description:
Feb  4 14:47:30 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.216.7.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.0.180
description:
2025-02-04 14:47:45 dovecot_plain authenticator failed for 110-4-0-180.static.pccw-hkt.com [110.4.0.180]:44798: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.203.245.53
description:
[2025-02-04 14:48:25 +0100] info [webmaild] 177.203.245.53 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.0.180
description:
Feb  4 14:47:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.0.180 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.234.224.75
description:
[2025-02-04 14:47:53 +0100] info [webmaild] 177.234.224.75 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.254.44.30
description:
Feb  4 14:48:44 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.254.44.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.184.119.106
description:
2025-02-04 14:48:46 dovecot_plain authenticator failed for ([117.184.119.106]) [117.184.119.106]:18355: 535 Incorrect authentication data (set_id=ads20a00141y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.100.105.194
description:
Feb  4 14:48:56 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.100.105.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
description:
2025-02-04 14:48:58 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:48780: 535 Incorrect authentication data (set_id=ads20a00141y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.253.152
description:
Feb  4 14:49:01 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.253.152 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.90.172.5
description:
[2025-02-04 14:49:25 +0100] info [webmaild] 41.90.172.5 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.184.119.106
description:
Feb  4 14:48:44 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.184.119.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.254.44.30
description:
2025-02-04 14:48:46 dovecot_plain authenticator failed for cl-185-254-44-30.b4net.lt [185.254.44.30]:48942: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.198.154.123
description:
[2025-02-04 14:48:50 +0100] info [webmaild] 41.198.154.123 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.62.34.216
description:
Feb  4 14:48:56 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.62.34.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.100.105.194
description:
2025-02-04 14:48:58 dovecot_plain authenticator failed for d96469c2.static.ziggozakelijk.nl ([217.100.105.195]) [217.100.105.194]:42295: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.253.152
description:
2025-02-04 14:49:03 dovecot_plain authenticator failed for (nonal) [65.20.253.152]:57635: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.61
description:
Feb  4 14:50:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.61
description:
2025-02-04 14:50:34 dovecot_plain authenticator failed for (m121-202-155-61.smartone.com) [121.202.155.61]:48944: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.227.203
description:
Feb  4 14:50:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.227.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.227.203
description:
2025-02-04 14:50:38 dovecot_plain authenticator failed for ([118.70.227.203]) [118.70.227.203]:48999: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.171.64.170
description:
Feb  4 14:50:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.171.64.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.64.170
description:
2025-02-04 14:50:21 dovecot_plain authenticator failed for ([50.171.64.170]) [50.171.64.170]:59142: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.115.106.12
description:
[2025-02-04 14:50:43 +0100] info [webmaild] 190.115.106.12 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.164.246.53
description:
2025-02-04 14:50:49 dovecot_plain authenticator failed for 53.246.164.109.static.wline.lns.sme.cust.swisscom.ch (hambus) [109.164.246.53]:35125: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.130.160
description:
Feb  4 14:50:56 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.130.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.164.246.53
description:
Feb  4 14:50:47 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.164.246.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
description:
2025-02-04 14:50:58 dovecot_plain authenticator failed for ([165.220.130.160]) [165.220.130.160]:33684: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.237.39.133
description:
[2025-02-04 14:51:16 +0100] info [webmaild] 103.237.39.133 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.118.186.221
description:
[2025-02-04 14:51:31 +0100] info [webmaild] 154.118.186.221 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Feb  4 14:51:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-02-04 14:51:40 dovecot_plain authenticator failed for ([128.106.196.150]) [128.106.196.150]:4210: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
description:
2025-02-04 14:52:35 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (magosous) [176.37.212.85]:55583: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.112.6.186
description:
2025-02-04 14:51:58 dovecot_plain authenticator failed for ([116.112.6.186]) [116.112.6.186]:39315: 535 Incorrect authentication data (set_id=rnunator)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 118.67.214.233
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-52.118.67.214.233


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.239.87.6
description:
Feb  4 14:52:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.239.87.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.244.126.105
description:
Feb  4 14:52:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.244.126.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.239.87.6
description:
2025-02-04 14:52:26 dovecot_plain authenticator failed for (myctury) [96.239.87.6]:34958: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.37.212.85
description:
Feb  4 14:52:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.37.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.112.6.186
description:
Feb  4 14:51:56 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.112.6.186 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.178.84
description:
[2025-02-04 14:52:22 +0100] info [webmaild] 177.37.178.84 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
description:
2025-02-04 14:52:28 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (enton) [92.244.126.105]:51326: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.196.240
description:
Feb  4 14:52:50 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.196.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.196.240
description:
2025-02-04 14:52:52 dovecot_plain authenticator failed for (mobile-166-195-196-240.mycingular.net) [166.195.196.240]:39597: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.250.67.14
description:
Feb  4 14:53:02 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.250.67.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.67.14
description:
2025-02-04 14:53:04 dovecot_plain authenticator failed for ([170.250.67.14]) [170.250.67.14]:33813: 535 Incorrect authentication data (set_id=sates1)


plugin: modsec
rule: 77350274
name: IM360 WAF: Theme customization in WordPress
abuser: 102.22.15.203
domain: iric.us
description:
IM360 WAF: Theme customization in WordPress||MVN:ARGS:wp_customize||MV:on||WPU:ENG20A00078Y||RSV:6.65||T:APACHE||


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 185.88.154.204
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:wwwadmin||WPU:wwwadmin||RSV:6.65||T:APACHE||MV:14-53.185.88.154.204


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 54.238.102.131
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:14-54.54.238.102.131


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.32.117.1
description:
[2025-02-04 14:54:42 +0100] info [webmaild] 181.32.117.1 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.207.1.89
description:
[2025-02-04 14:53:57 +0100] info [webmaild] 102.207.1.89 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.66.192.62
description:
[2025-02-04 14:54:31 +0100] info [webmaild] 102.66.192.62 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.144.42.225
description:
Feb  4 14:54:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.144.42.225 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.90.143
description:
[2025-02-04 14:55:18 +0100] info [webmaild] 84.54.90.143 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.144.42.225
description:
2025-02-04 14:54:42 dovecot_plain authenticator failed for (TINY-1D00AC06) [136.144.42.225]:19562: 535 Incorrect authentication data (set_id=ads20b00294y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.144.42.225
description:
Feb  4 14:54:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.144.42.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.59.125
description:
Feb  4 14:56:15 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.59.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.59.125
description:
2025-02-04 14:56:17 dovecot_plain authenticator failed for ([103.171.59.125]) [103.171.59.125]:49542: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.172.95.18
description:
[2025-02-04 14:56:41 +0100] info [webmaild] 85.172.95.18 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Feb  4 14:55:52 ait sshd[4178080]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.196.106
description:
2025-02-04 14:57:41 dovecot_plain authenticator failed for 186-247-196-106.user.veloxzone.com.br [186.247.196.106]:41034: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.227.214.33
description:
2025-02-04 14:56:46 dovecot_plain authenticator failed for ([182.227.214.33]) [182.227.214.33]:34586: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.98.197.221
description:
[2025-02-04 14:57:14 +0100] info [webmaild] 41.98.197.221 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.237.58.253
description:
[2025-02-04 14:57:17 +0100] info [webmaild] 45.237.58.253 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.185.248.152
description:
[2025-02-04 14:57:23 +0100] info [webmaild] 177.185.248.152 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.196.106
description:
Feb  4 14:57:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.196.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.227.214.33
description:
Feb  4 14:56:44 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.227.214.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.57.205.7
description:
2025-02-04 14:58:32 dovecot_plain authenticator failed for ([117.57.205.7]) [117.57.205.7]:49160: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.78.157.185
description:
Feb  4 14:57:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.78.157.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.78.157.185
description:
2025-02-04 14:57:57 dovecot_plain authenticator failed for (host-79-78-157-185.static.as9105.net) [79.78.157.185]:57779: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.221.67.162
description:
[2025-02-04 14:57:59 +0100] info [webmaild] 131.221.67.162 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.57.205.7
description:
Feb  4 14:58:30 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.57.205.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.72.128.185
description:
2025-02-04 14:58:53 dovecot_plain authenticator failed for (187-072-128-185.static.ctbctelecom.com.br) [187.72.128.185]:51606: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.55.98
description:
2025-02-04 14:59:30 dovecot_plain authenticator failed for ([122.225.55.98]) [122.225.55.98]:47394: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.66.41.130
description:
Feb  4 14:59:04 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.66.41.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.225.55.98
description:
Feb  4 14:59:28 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.225.55.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Feb  4 14:59:10 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.37
description:
2025-02-04 14:59:16 dovecot_plain authenticator failed for ([102.215.188.37]) [102.215.188.37]:55570: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.216.7.163
description:
Feb  4 14:59:01 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.216.7.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.216.7.163
description:
2025-02-04 14:59:03 dovecot_plain authenticator failed for 61-216-7-163.hinet-ip.hinet.net (61-216-7-164.hinet-ip.hinet.net) [61.216.7.163]:39621: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.66.41.130
description:
2025-02-04 14:59:06 dovecot_plain authenticator failed for 130.pool207-66-41.dynamic.orange.es [207.66.41.130]:39697: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-02-04 14:59:12 dovecot_plain authenticator failed for ([112.111.61.230]) [112.111.61.229]:50154: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.215.188.37
description:
Feb  4 14:59:14 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.215.188.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.72.128.185
description:
Feb  4 14:58:51 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.72.128.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.49.179.157
description:
Feb  4 14:58:54 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.49.179.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.49.179.157
description:
2025-02-04 14:58:56 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:43859: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.116.226
description:
Feb  4 15:00:28 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.116.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.116.226
description:
2025-02-04 15:00:30 dovecot_plain authenticator failed for ([117.176.116.226]) [117.176.116.226]:55370: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.176.149.10
description:
Feb  4 15:00:37 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.176.149.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.149.10
description:
2025-02-04 15:00:39 dovecot_plain authenticator failed for (abts-north-dynamic-010.149.176.122.airtelbroadband.in) [122.176.149.10]:35823: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.123.9.253
description:
[2025-02-04 14:59:48 +0100] info [webmaild] 190.123.9.253 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.31.192.216
description:
[2025-02-04 15:00:08 +0100] info [webmaild] 191.31.192.216 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.75.76.226
description:
[2025-02-04 15:00:22 +0100] info [webmaild] 177.75.76.226 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.29.196.170
description:
Feb  4 15:01:12 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.29.196.170 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-01.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.159.14.187
description:
2025-02-04 15:01:35 dovecot_plain authenticator failed for (200-168-190-81.jandaia.com) [200.159.14.187]:42918: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.159.14.187
description:
Feb  4 15:01:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.159.14.187 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.238.0.13
description:
[2025-02-04 15:00:43 +0100] info [webmaild] 37.238.0.13 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.220.149.129
description:
Feb  4 15:01:44 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.220.149.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.170.102
description:
2025-02-04 15:02:08 dovecot_plain authenticator failed for ([183.234.170.102]) [183.234.170.102]:60753: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
description:
2025-02-04 15:02:22 dovecot_plain authenticator failed for ([50.217.255.171]) [50.217.255.171]:33607: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.252.204.203
description:
2025-02-04 15:01:53 dovecot_plain authenticator failed for ([1.252.204.203]) [1.252.204.203]:57017: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.252.204.203
description:
Feb  4 15:01:51 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.252.204.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.170.102
description:
Feb  4 15:02:06 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.170.102 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.97.160.72
description:
[2025-02-04 15:02:38 +0100] info [webmaild] 177.97.160.72 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.129
description:
2025-02-04 15:01:46 dovecot_plain authenticator failed for ([118.220.149.129]) [118.220.149.129]:40756: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.217.255.171
description:
Feb  4 15:02:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.217.255.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.147
description:
2025-02-04 15:03:34 dovecot_plain authenticator failed for (kormakme) [65.20.205.147]:50672: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.236.55.76
description:
[2025-02-04 15:03:12 +0100] info [webmaild] 45.236.55.76 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 15:03:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.165.23
description:
Feb  4 15:03:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.165.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.147
description:
Feb  4 15:03:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.4.35.157
description:
[2025-02-04 15:03:06 +0100] info [webmaild] 45.4.35.157 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.120.67.149
description:
2025-02-04 15:03:36 dovecot_plain authenticator failed for ([87.120.67.149]) [87.120.67.149]:44676: 535 Incorrect authentication data (set_id=ads22a00092y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.165.23
description:
2025-02-04 15:03:28 dovecot_plain authenticator failed for ([45.118.165.23]) [45.118.165.23]:35378: 535 Incorrect authentication data (set_id=ads22a00092y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.120.67.149
description:
Feb  4 15:03:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.120.67.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.89.72
description:
Feb  4 15:04:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.89.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.109.253.156
description:
2025-02-04 15:04:16 dovecot_plain authenticator failed for ([172.109.253.156]) [172.109.253.156]:38336: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.165.23
description:
Feb  4 15:04:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.165.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.241.253
description:
Feb  4 15:04:27 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.241.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.40.166.147
description:
2025-02-04 15:04:04 dovecot_plain authenticator failed for ([8.40.166.147]) [8.40.166.147]:2994: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.250
description:
2025-02-04 15:04:20 dovecot_plain authenticator failed for ([121.202.154.250]) [121.202.154.250]:49816: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.20.131
description:
Feb  4 15:04:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.20.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.40.166.147
description:
Feb  4 15:04:02 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.40.166.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.241.150
description:
Feb  4 15:04:11 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.241.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.245.214.226
description:
Feb  4 15:04:13 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.245.214.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.208.76.154
description:
Feb  4 15:04:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.208.76.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.241.100.90
description:
Feb  4 15:04:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.241.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.100.90
description:
2025-02-04 15:04:34 dovecot_plain authenticator failed for ([223.241.100.90]) [223.241.100.90]:39177: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.194.9.65
description:
Feb  4 15:04:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.194.9.65 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.215.56.83
description:
[2025-02-04 15:03:43 +0100] info [webmaild] 31.215.56.83 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.255.231.10
description:
Feb  4 15:04:16 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.255.231.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.255.231.10
description:
2025-02-04 15:04:18 dovecot_plain authenticator failed for ([106.255.231.10]) [106.255.231.10]:36515: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.241.253
description:
2025-02-04 15:04:29 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:53774: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.94.206.187
description:
2025-02-04 15:04:35 dovecot_plain authenticator failed for (177-94-206-187.dsl.telesp.net.br) [177.94.206.187]:50624: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 118.67.214.233
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-03.118.67.214.233


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.109.253.156
description:
Feb  4 15:04:14 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.109.253.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.214.226
description:
2025-02-04 15:04:15 dovecot_plain authenticator failed for (broadband.actcorp.in) [115.245.214.226]:47154: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.208.76.154
description:
2025-02-04 15:04:24 dovecot_plain authenticator failed for (186-208-76-154.veloo.com.br) [186.208.76.154]:50353: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.17.90.246
description:
Feb  4 15:04:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.17.90.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.94.206.187
description:
Feb  4 15:04:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.94.206.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.46.105.16
description:
2025-02-04 15:04:07 dovecot_plain authenticator failed for host16.sub-63-46-105.myvzw.com [63.46.105.16]:53520: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.250
description:
Feb  4 15:04:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.20.131
description:
2025-02-04 15:04:22 dovecot_plain authenticator failed for ([123.212.20.131]) [123.212.20.131]:42450: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.17.90.246
description:
2025-02-04 15:04:33 dovecot_plain authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:42392: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.46.105.16
description:
Feb  4 15:04:05 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.46.105.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.241.150
description:
2025-02-04 15:04:13 dovecot_plain authenticator failed for ([61.143.241.150]) [61.143.241.150]:39975: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.165.23
description:
2025-02-04 15:04:20 dovecot_plain authenticator failed for ([45.118.165.23]) [45.118.165.23]:39162: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.20.22.58
description:
Feb  4 15:05:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.20.22.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
description:
2025-02-04 15:05:33 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.154.175]:57901: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.47.190
description:
Feb  4 15:05:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.47.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.164.165
description:
2025-02-04 15:05:41 dovecot_plain authenticator failed for ([5.11.164.165]) [5.11.164.165]:47507: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.207.117
description:
2025-02-04 15:05:23 dovecot_plain authenticator failed for bzq-85-130-207-117.static-ip.bezeqint.net [85.130.207.117]:45126: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.170.149
description:
Feb  4 15:05:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.170.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.20.159.141
description:
2025-02-04 15:05:25 dovecot_plain authenticator failed for ([115.20.159.141]) [115.20.159.141]:46505: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
description:
2025-02-04 15:05:27 dovecot_plain authenticator failed for ([36.39.140.2]) [36.39.140.2]:48862: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.189.118.24
description:
2025-02-04 15:05:28 dovecot_plain authenticator failed for (5.189.118.24-FTTB.planeta.tc) [5.189.118.24]:34762: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
description:
2025-02-04 15:05:31 dovecot_plain authenticator failed for ([177.43.106.73]) [177.43.106.73]:37384: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.202.59.203
description:
2025-02-04 15:05:36 dovecot_plain authenticator failed for (dyn-cable-cust.203.59.202.213.quicknet.ch) [213.202.59.203]:54522: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.89.72
description:
2025-02-04 15:04:43 dovecot_plain authenticator failed for ([112.132.89.72]) [112.132.89.72]:59684: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.109.10.69
description:
Feb  4 15:05:13 ait sshd[4182816]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.109.10.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.181
description:
2025-02-04 15:05:23 dovecot_plain authenticator failed for ([203.193.168.181]) [203.193.168.181]:52126: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.189.118.24
description:
Feb  4 15:05:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.189.118.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.54.106.83
description:
Feb  4 15:05:37 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.54.106.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.24.45.150
description:
Feb  4 15:05:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.24.45.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.242.149.240
description:
Feb  4 15:05:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.242.149.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.22.255.28
description:
2025-02-04 15:05:33 dovecot_plain authenticator failed for ([58.22.255.28]) [58.22.255.28]:58046: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.54
description:
2025-02-04 15:05:34 dovecot_plain authenticator failed for (m121-202-154-54.smartone.com) [121.202.154.54]:18472: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.10.69
description:
Feb  4 15:05:13 ait sshd[4182816]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.10.69


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.189.180.243
description:
Feb  4 15:05:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.189.180.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.66.151.154
description:
Feb  4 15:05:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.66.151.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.66.151.154
description:
2025-02-04 15:05:21 dovecot_plain authenticator failed for 154.151-66-87.adsl-dyn.isp.belgacom.be [87.66.151.154]:52634: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.140.69
description:
Feb  4 15:04:52 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.140.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.182
description:
Feb  4 15:05:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.61.7.100
description:
Feb  4 15:05:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.61.7.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.19.149
description:
Feb  4 15:05:37 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.19.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
description:
Feb  4 15:05:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.35.217.44
description:
2025-02-04 15:05:30 dovecot_plain authenticator failed for net-2-35-217-44.cust.vodafonedsl.it [2.35.217.44]:49292: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
description:
2025-02-04 15:05:38 dovecot_plain authenticator failed for ([84.238.92.245]) [84.238.92.245]:42977: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.17
description:
2025-02-04 15:05:40 dovecot_plain authenticator failed for ([121.154.90.17]) [121.154.90.17]:52604: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.194.9.65
description:
2025-02-04 15:04:44 dovecot_plain authenticator failed for syn-024-194-009-065.res.spectrum.com [24.194.9.65]:38432: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.140.69
description:
2025-02-04 15:04:54 dovecot_plain authenticator failed for (unsion) [65.20.140.69]:43920: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.94.18.69
description:
Feb  4 15:05:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.94.18.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.100.136
description:
Feb  4 15:05:29 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.100.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.20.159.141
description:
Feb  4 15:05:23 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.20.159.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.47.3.217
description:
2025-02-04 15:05:36 dovecot_plain authenticator failed for ([14.47.3.217]) [14.47.3.217]:41462: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.90.239.158
description:
Feb  4 15:05:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.90.239.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.154.175
description:
Feb  4 15:05:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.154.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.189
description:
2025-02-04 15:05:32 dovecot_plain authenticator failed for 189.46.246.220.static.netvigator.com [220.246.46.189]:61191: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.193.168.181
description:
Feb  4 15:05:21 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.193.168.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.178.251.33
description:
Feb  4 15:05:25 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.178.251.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.39.140.2
description:
Feb  4 15:05:25 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.39.140.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.208.186.206
description:
Feb  4 15:05:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.208.186.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.94.18.69
description:
2025-02-04 15:05:21 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:44442: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.205.232
description:
2025-02-04 15:05:34 dovecot_plain authenticator failed for (abts-ap-dynamic-232.205.169.122.airtelbroadband.in) [122.169.205.232]:54572: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.249.14.253
description:
[2025-02-04 15:05:42 +0100] info [webmaild] 167.249.14.253 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.154.90.17
description:
Feb  4 15:05:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.154.90.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.134.31.193
description:
Feb  4 15:05:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.134.31.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
description:
Feb  4 15:05:29 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.180.102
description:
2025-02-04 15:05:30 dovecot_plain authenticator failed for 80-15-180-102.ftth.fr.orangecustomers.net [80.15.180.102]:56082: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.22.255.28
description:
Feb  4 15:05:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.22.255.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.92.149.1
description:
Feb  4 15:05:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.92.149.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.202.1.58
description:
2025-02-04 15:05:41 dovecot_plain authenticator failed for ([177.202.1.58]) [177.202.1.58]:39036: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.24.45.150
description:
2025-02-04 15:05:22 dovecot_plain authenticator failed for ([192.24.45.150]) [192.24.45.150]:50039: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.214.65.245
description:
Feb  4 15:05:25 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.214.65.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.205.232
description:
Feb  4 15:05:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.205.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.112
description:
2025-02-04 15:05:31 dovecot_plain authenticator failed for (122.11.169-112.unknown.starhub.net.sg) [122.11.169.112]:2633: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.54.106.83
description:
2025-02-04 15:05:39 dovecot_plain authenticator failed for 83.106.54.198.in-addr.arpa [198.54.106.83]:52835: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.207.117
description:
Feb  4 15:05:21 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.207.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.98.208.115
description:
Feb  4 15:05:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.98.208.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.7.100
description:
2025-02-04 15:05:28 dovecot_plain authenticator failed for 100.7.61.94.rev.vodafone.pt [94.61.7.100]:49454: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.227.66.92
description:
Feb  4 15:05:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.227.66.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
description:
2025-02-04 15:05:41 dovecot_plain authenticator failed for ([220.80.223.144]) [220.80.223.144]:34682: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.63
description:
Feb  4 15:05:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
description:
2025-02-04 15:05:28 dovecot_plain authenticator failed for ([121.134.31.193]) [121.134.31.193]:56160: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.54
description:
Feb  4 15:05:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.164.165
description:
Feb  4 15:05:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.164.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.34.73.139
description:
2025-02-04 15:05:32 dovecot_plain authenticator failed for (139.73.34.171.adsl-pool.jx.chinaunicom.com) [171.34.73.139]:1138: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.227.66.92
description:
2025-02-04 15:05:33 dovecot_plain authenticator failed for ([188.227.66.92]) [188.227.66.92]:49350: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.226.228
description:
Feb  4 15:05:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.226.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
description:
2025-02-04 15:05:25 dovecot_plain authenticator failed for ([211.109.75.68]) [211.109.75.69]:60072: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.143.14.7
description:
2025-02-04 15:05:31 dovecot_plain authenticator failed for ([117.143.14.7]) [117.143.14.7]:44900: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.202.154.245
description:
2025-02-04 15:05:32 dovecot_plain authenticator failed for ([94.202.154.245]) [94.202.154.245]:45452: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.19.149
description:
2025-02-04 15:05:39 dovecot_plain authenticator failed for 111-70-19-149.emome-ip.hinet.net [111.70.19.149]:36504: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.28.66.78
description:
Feb  4 15:05:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.28.66.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.208.186.206
description:
2025-02-04 15:05:28 dovecot_plain authenticator failed for ([175.208.186.206]) [175.208.186.206]:40936: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.202.154.245
description:
Feb  4 15:05:30 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.202.154.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.86
description:
2025-02-04 15:05:35 dovecot_plain authenticator failed for ([58.230.236.86]) [58.230.236.86]:59124: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.69.157.215
description:
Feb  4 15:05:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.69.157.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.97.98
description:
2025-02-04 15:05:28 dovecot_plain authenticator failed for (undefined.hostname.localhost) [103.90.97.98]:48540: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.202.1.58
description:
Feb  4 15:05:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.202.1.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.34.73.139
description:
Feb  4 15:05:30 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.34.73.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.234
description:
2025-02-04 15:05:38 dovecot_plain authenticator failed for ([116.114.84.234]) [116.114.84.234]:46700: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.69.157.215
description:
2025-02-04 15:05:21 dovecot_plain authenticator failed for ([151.69.157.215]) [151.69.157.215]:40249: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.28.66.78
description:
2025-02-04 15:05:21 dovecot_plain authenticator failed for ([62.28.66.78]) [62.28.66.78]:43198: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.63
description:
2025-02-04 15:05:26 dovecot_plain authenticator failed for (m121-202-154-63.smartone.com) [121.202.154.63]:23037: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.86
description:
Feb  4 15:05:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.234
description:
Feb  4 15:05:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.226.228
description:
2025-02-04 15:05:21 dovecot_plain authenticator failed for broadband-77-37-226-228.ip.moscow.rt.ru [77.37.226.228]:53288: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
description:
2025-02-04 15:05:24 dovecot_plain authenticator failed for ([117.247.239.202]) [117.247.239.202]:54554: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.242.149.240
description:
2025-02-04 15:05:24 dovecot_plain authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:49140: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.33.109.90
description:
2025-02-04 15:05:25 dovecot_plain authenticator failed for (90.109.33.58.broad.xw.sh.dynamic.163data.com.cn) [58.33.109.90]:32839: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.208.136.225
description:
Feb  4 15:05:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.208.136.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
description:
Feb  4 15:05:23 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.98.208.115
description:
2025-02-04 15:05:24 dovecot_plain authenticator failed for ([201.98.208.115]) [201.98.208.115]:46087: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.138.101.106
description:
Feb  4 15:05:29 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.138.101.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.84.60.88
description:
2025-02-04 15:05:30 dovecot_plain authenticator failed for ([103.177.205.100]) [58.84.60.88]:30218: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.202.59.203
description:
Feb  4 15:05:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.202.59.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.253
description:
2025-02-04 15:05:03 dovecot_plain authenticator failed for (m121-202-152-253.smartone.com) [121.202.152.253]:6064: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.170.149
description:
2025-02-04 15:05:26 dovecot_plain authenticator failed for ([218.149.170.149]) [218.149.170.149]:34378: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.75.188.242
description:
2025-02-04 15:05:28 dovecot_plain authenticator failed for ([115.75.188.242]) [115.75.188.242]:53176: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.237.100.136
description:
2025-02-04 15:05:31 dovecot_plain authenticator failed for ([103.237.100.136]) [103.237.100.136]:52670: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.97.98
description:
Feb  4 15:05:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.97.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.35.217.44
description:
Feb  4 15:05:28 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.35.217.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.136.225
description:
2025-02-04 15:05:41 dovecot_plain authenticator failed for 31-208-136-225.cust.bredband2.com [31.208.136.225]:60595: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.46.189
description:
Feb  4 15:05:30 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.46.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.135.188.125
description:
2025-02-04 15:05:41 dovecot_plain authenticator failed for ([121.135.188.125]) [121.135.188.125]:44582: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.75.188.242
description:
Feb  4 15:05:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.75.188.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.90.239.158
description:
2025-02-04 15:05:40 dovecot_plain authenticator failed for (mail.salee.co.kr) [220.90.239.158]:48811: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.178.251.33
description:
2025-02-04 15:05:27 dovecot_plain authenticator failed for ([210.178.251.33]) [210.178.251.33]:54759: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.20.22.58
description:
2025-02-04 15:05:35 dovecot_plain authenticator failed for ([8.20.22.58]) [8.20.22.58]:61556: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.52.131.183
description:
Feb  4 15:05:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.52.131.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.214.65.245
description:
2025-02-04 15:05:27 dovecot_plain authenticator failed for ([123.214.65.245]) [123.214.65.245]:45822: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.112
description:
Feb  4 15:05:29 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.50.134.183
description:
Feb  4 15:05:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.50.134.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.169.144.176
description:
Feb  4 15:05:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.169.144.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.143.14.7
description:
Feb  4 15:05:29 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.143.14.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.135.188.125
description:
Feb  4 15:05:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.135.188.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.253
description:
Feb  4 15:05:01 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.33.109.90
description:
Feb  4 15:05:23 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.33.109.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.42.173.64
description:
Feb  4 15:05:23 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.42.173.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.15.180.102
description:
Feb  4 15:05:28 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.15.180.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.156.255.186
description:
Feb  4 15:04:51 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.156.255.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.189.180.243
description:
2025-02-04 15:05:21 dovecot_plain authenticator failed for ([90.189.180.243]) [90.189.180.243]:41713: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.42.173.64
description:
2025-02-04 15:05:25 dovecot_plain authenticator failed for ([115.42.173.64]) [115.42.173.64]:50313: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.138.101.106
description:
2025-02-04 15:05:31 dovecot_plain authenticator failed for ([123.138.101.106]) [123.138.101.106]:57276: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.50.134.183
description:
2025-02-04 15:05:41 dovecot_plain authenticator failed for ([77.50.134.183]) [77.50.134.183]:52760: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.156.255.186
description:
2025-02-04 15:04:53 dovecot_plain authenticator failed for syn-098-156-255-186.res.spectrum.com [98.156.255.186]:42922: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.239.202
description:
Feb  4 15:05:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.239.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.182
description:
2025-02-04 15:05:26 dovecot_plain authenticator failed for 111-70-49-182.emome-ip.hinet.net [111.70.49.182]:57439: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.186.241.102
description:
Feb  4 15:05:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.186.241.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.233
description:
2025-02-04 15:05:45 dovecot_plain authenticator failed for (nsg-corporate-233.228.187.122.airtel.in) [122.187.228.233]:36391: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.172.203.43
description:
2025-02-04 15:05:46 dovecot_plain authenticator failed for ([220.172.203.43]) [220.172.203.43]:34523: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.57.96.109
description:
2025-02-04 15:05:48 dovecot_plain authenticator failed for ([58.19.13.200]) [113.57.96.109]:13888: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
description:
Feb  4 15:05:48 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.199.57.220
description:
2025-02-04 15:05:54 dovecot_plain authenticator failed for ([192.199.57.220]) [192.199.57.220]:38318: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.245.144.69
description:
[2025-02-04 15:05:55 +0100] info [webmaild] 170.245.144.69 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.12
description:
Feb  4 15:05:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.57.96.109
description:
Feb  4 15:05:46 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.57.96.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
description:
2025-02-04 15:05:59 dovecot_plain authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:56904: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.170.28
description:
2025-02-04 15:06:02 dovecot_plain authenticator failed for ([103.207.170.28]) [103.207.170.28]:34258: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.230.98
description:
2025-02-04 15:05:48 dovecot_plain authenticator failed for ([1.180.230.112]) [1.180.230.98]:55000: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.97
description:
2025-02-04 15:05:58 dovecot_plain authenticator failed for (97.196.181.45.datasysteminfor.com.br) [45.181.196.97]:57904: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.132.206
description:
Feb  4 15:05:45 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.132.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.96.91.71
description:
Feb  4 15:05:45 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.96.91.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.170.28
description:
Feb  4 15:06:00 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.170.28 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.68.76.219
description:
[2025-02-04 15:06:14 +0100] info [webmaild] 102.68.76.219 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
description:
2025-02-04 15:05:50 dovecot_plain authenticator failed for (paraphoo) [102.53.15.18]:43927: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.92.149.1
description:
2025-02-04 15:05:44 dovecot_plain authenticator failed for ([157.92.149.1]) [157.92.149.1]:50747: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.132.206
description:
2025-02-04 15:05:47 dovecot_plain authenticator failed for ([222.68.132.206]) [222.68.132.206]:35454: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.96.91.71
description:
2025-02-04 15:05:47 dovecot_plain authenticator failed for ([27.96.91.71]) [27.96.91.71]:33506: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.34.73.139
description:
2025-02-04 15:05:48 dovecot_plain authenticator failed for (139.73.34.171.adsl-pool.jx.chinaunicom.com) [171.34.73.139]:1154: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.79
description:
Feb  4 15:05:51 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.79 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.86.57.122
description:
[2025-02-04 15:06:39 +0100] info [webmaild] 103.86.57.122 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.52.131.183
description:
2025-02-04 15:05:43 dovecot_plain authenticator failed for ([211.52.131.183]) [211.52.131.183]:39849: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.172.203.43
description:
Feb  4 15:05:44 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.172.203.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.133.161
description:
2025-02-04 15:05:57 dovecot_plain authenticator failed for (abts-north-dynamic-161.133.176.122.airtelbroadband.in) [122.176.133.161]:58140: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.150.100.139
description:
2025-02-04 15:05:59 dovecot_plain authenticator failed for ([107.150.100.139]) [107.150.100.139]:19534: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.9.38.92
description:
Feb  4 15:06:06 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.9.38.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.38.92
description:
2025-02-04 15:06:08 dovecot_plain authenticator failed for ([59.9.38.92]) [59.9.38.92]:43694: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.12
description:
2025-02-04 15:05:44 dovecot_plain authenticator failed for (nsg-corporate-12.229.187.122.airtel.in) [122.187.229.12]:46468: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
description:
2025-02-04 15:05:54 dovecot_plain authenticator failed for ([96.79.174.131]) [96.79.174.131]:34975: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.169.144.176
description:
2025-02-04 15:05:44 dovecot_plain authenticator failed for 136.169.144.176.dynamic.ufanet.ru [136.169.144.176]:51336: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.68.50
description:
Feb  4 15:05:51 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.68.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
description:
Feb  4 15:05:52 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.52.109
description:
Feb  4 15:05:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.233
description:
Feb  4 15:05:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
description:
2025-02-04 15:05:44 dovecot_plain authenticator failed for ([185.255.47.190]) [185.255.47.190]:58550: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.230.98
description:
Feb  4 15:05:46 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.230.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.176.133.161
description:
Feb  4 15:05:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.176.133.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.196.97
description:
Feb  4 15:05:56 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.196.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.114.215
description:
Feb  4 15:06:07 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.114.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.114.215
description:
2025-02-04 15:06:09 dovecot_plain authenticator failed for ([103.123.114.215]) [103.123.114.215]:52932: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.241.102
description:
2025-02-04 15:05:43 dovecot_plain authenticator failed for ([112.186.241.102]) [112.186.241.102]:35095: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.68.50
description:
2025-02-04 15:05:53 dovecot_plain authenticator failed for ([61.185.68.50]) [61.185.68.50]:38483: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.150.100.139
description:
Feb  4 15:05:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.150.100.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.199.57.220
description:
Feb  4 15:05:52 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.199.57.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.79
description:
2025-02-04 15:05:53 dovecot_plain authenticator failed for 079.42.246.220.static.netvigator.com [220.246.42.79]:59645: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.32.227.248
description:
Feb  4 15:07:38 ait sshd[4184144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.32.227.248


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.161.197.130
description:
Feb  4 15:06:47 ait sshd[4183786]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.161.197.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-02-04 15:07:21 dovecot_plain authenticator failed for (habies) [109.166.70.166]:59538: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.32.227.248
description:
Feb  4 15:07:38 ait sshd[4184144]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.32.227.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Feb  4 15:07:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.161.197.130
description:
Feb  4 15:06:47 ait sshd[4183786]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.197.130


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.126.223.175
description:
Feb  4 15:08:25 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.126.223.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.152.91.221
description:
Feb  4 15:08:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.152.91.221 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 61.151.239.210
description:
Feb  4 15:07:52 ait sshd[4184213]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.151.239.210


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.151.239.210
description:
Feb  4 15:07:52 ait sshd[4184213]: pam_imunify(sshd:auth): [IM360_RBL] The IP 61.151.239.210 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.50.102.43
description:
[2025-02-04 15:08:32 +0100] info [webmaild] 181.50.102.43 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
description:
2025-02-04 15:08:27 dovecot_plain authenticator failed for ([92.126.223.175]) [92.126.223.175]:42130: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.122.115.9
description:
Feb  4 15:08:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.122.115.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.217.183
description:
Feb  4 15:08:58 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.217.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.7.135.13
description:
2025-02-04 15:09:02 dovecot_plain authenticator failed for ([119.7.135.13]) [119.7.135.13]:52219: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.152.91.221
description:
2025-02-04 15:08:43 dovecot_plain authenticator failed for ([124.152.91.221]) [124.152.91.221]:43454: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.122.115.9
description:
2025-02-04 15:08:59 dovecot_plain authenticator failed for ([220.122.115.9]) [220.122.115.9]:48021: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.90.89.66
description:
Feb  4 15:09:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.90.89.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.170.218.142
description:
Feb  4 15:09:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.170.218.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.93.183
description:
Feb  4 15:08:45 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.93.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.196.237.146
description:
2025-02-04 15:08:49 dovecot_plain authenticator failed for ([120.196.237.146]) [120.196.237.146]:52698: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.217.183
description:
2025-02-04 15:09:00 dovecot_plain authenticator failed for (189-56-217-183.customer.tdatabrasil.net.br) [189.56.217.183]:54924: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.4.150.142
description:
Feb  4 15:09:05 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.4.150.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.90.89.66
description:
2025-02-04 15:09:19 dovecot_plain authenticator failed for ([66.90.89.66]) [66.90.89.66]:60344: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.170.218.142
description:
2025-02-04 15:09:35 dovecot_plain authenticator failed for ([121.170.218.142]) [121.170.218.142]:49503: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.196.237.146
description:
Feb  4 15:08:47 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.196.237.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
description:
2025-02-04 15:08:47 dovecot_plain authenticator failed for (corporativo.gvt.net.br) [189.115.93.183]:57640: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.20.66.160
description:
[2025-02-04 15:09:00 +0100] info [webmaild] 201.20.66.160 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.7.135.13
description:
Feb  4 15:09:00 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.7.135.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.83.156.141
description:
[2025-02-04 15:09:04 +0100] info [webmaild] 170.83.156.141 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.4.150.142
description:
2025-02-04 15:09:07 dovecot_plain authenticator failed for ([112.4.150.142]) [112.4.150.142]:44290: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.189.144.86
description:
[2025-02-04 15:09:37 +0100] info [webmaild] 179.189.144.86 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.235.82.88
description:
Feb  4 15:10:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.235.82.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.235.82.88
description:
2025-02-04 15:10:42 dovecot_plain authenticator failed for ([222.235.82.88]) [222.235.82.88]:46072: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.240.49.222
description:
Feb  4 15:10:04 ait sshd[4185282]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.240.49.222


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.82.26.182
description:
Feb  4 15:10:06 ait sshd[4185381]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.82.26.182 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.82.26.182
description:
Feb  4 15:10:06 ait sshd[4185381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.82.26.182


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.106.172.226
description:
Feb  4 15:10:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.106.172.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.249.131
description:
Feb  4 15:10:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.249.131 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.69.14.128
description:
[2025-02-04 15:10:13 +0100] info [cpaneld] 38.69.14.128 - ait002 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.106.172.226
description:
2025-02-04 15:10:24 dovecot_plain authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:49126: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.249.131
description:
2025-02-04 15:10:26 dovecot_plain authenticator failed for ([60.31.249.131]) [60.31.249.131]:56233: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.217.255.171
description:
Feb  4 15:10:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.217.255.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 15:11:25 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.95.150.16
description:
Feb  4 15:10:44 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.95.150.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
description:
2025-02-04 15:10:43 dovecot_plain authenticator failed for ([50.217.255.171]) [50.217.255.171]:37594: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.95.150.16
description:
2025-02-04 15:10:46 dovecot_plain authenticator failed for syn-070-095-150-016.res.spectrum.com [70.95.150.16]:62045: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.166.207.76
description:
Feb  4 15:10:52 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.166.207.76 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.187.6.197
description:
[2025-02-04 15:11:14 +0100] info [webmaild] 45.187.6.197 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.225.12
description:
Feb  4 15:11:16 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.225.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.163.122.133
description:
Feb  4 15:11:25 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.163.122.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.207.76
description:
2025-02-04 15:10:54 dovecot_plain authenticator failed for wsip-70-166-207-76.ph.ph.cox.net ([70.166.207.65]) [70.166.207.76]:48376: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.225.12
description:
2025-02-04 15:11:18 dovecot_plain authenticator failed for p38012-obmd01.osaka.ocn.ne.jp [153.141.225.12]:43780: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.106.198.35
description:
Feb  4 15:10:59 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.106.198.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.106.198.35
description:
2025-02-04 15:11:01 dovecot_plain authenticator failed for ([222.106.198.35]) [222.106.198.35]:39224: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
description:
2025-02-04 15:11:27 dovecot_plain authenticator failed for ([182.163.122.133]) [182.163.122.133]:19077: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.69.163.102
description:
Feb  4 15:11:50 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.69.163.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.69.163.102
description:
2025-02-04 15:11:52 dovecot_plain authenticator failed for ([102.69.163.102]) [102.69.163.102]:34422: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.15.163.18
description:
2025-02-04 15:11:55 dovecot_plain authenticator failed for wsip-68-15-163-18.no.no.cox.net [68.15.163.18]:48307: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.252.209.189
description:
2025-02-04 15:12:02 dovecot_plain authenticator failed for ([195.252.209.189]) [195.252.209.189]:45132: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.194.34
description:
Feb  4 15:12:03 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.194.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.194.34
description:
2025-02-04 15:12:05 dovecot_plain authenticator failed for (34.194.75.138.unknown.m1.com.sg) [138.75.194.34]:35033: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 87.106.239.80
domain: iric.us
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:yanz@123457||User:titlemas||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  4 15:12:02 ait sshd[4186226]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.7.110.6
description:
[2025-02-04 15:11:49 +0100] info [webmaild] 45.7.110.6 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.59.214.71
description:
2025-02-04 15:11:49 dovecot_plain authenticator failed for s142-59-214-71.ab.hsia.telus.net [142.59.214.71]:47439: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.252.209.189
description:
Feb  4 15:12:00 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.252.209.189 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.147.102.51
description:
[2025-02-04 15:12:03 +0100] info [webmaild] 185.147.102.51 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.4.12.44
description:
Feb  4 15:12:37 ait sshd[4186517]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.4.12.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.59.214.71
description:
Feb  4 15:11:47 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.59.214.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.15.163.18
description:
Feb  4 15:11:53 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.15.163.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.12.14
description:
Feb  4 15:12:02 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.12.14 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  4 15:12:02 ait sshd[4186226]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.12.14
description:
2025-02-04 15:12:04 dovecot_plain authenticator failed for (14.12.168.188.retail.ttk.ru) [188.168.12.14]:60712: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.4.12.44
description:
Feb  4 15:12:37 ait sshd[4186517]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.4.12.44


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.72.24.36
description:
[2025-02-04 15:12:54 +0100] info [webmaild] 177.72.24.36 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Feb  4 15:12:56 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
description:
2025-02-04 15:12:58 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (prette) [94.45.76.149]:55526: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.225.198.193
description:
[2025-02-04 15:14:10 +0100] info [webmaild] 45.225.198.193 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.36.58.133
description:
[2025-02-04 15:14:43 +0100] info [webmaild] 138.36.58.133 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.194.40
description:
2025-02-04 15:15:14 dovecot_plain authenticator failed for (cotoh) [65.20.194.40]:44258: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.19.108
description:
Feb  4 15:15:15 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.19.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-02-04 15:15:25 dovecot_plain authenticator failed for (undenellde) [81.211.77.58]:31709: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.66.97.9
description:
[2025-02-04 15:15:30 +0100] info [webmaild] 201.66.97.9 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.245.96.220
description:
[2025-02-04 15:14:55 +0100] info [webmaild] 103.245.96.220 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
description:
Feb  4 15:15:09 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.194.40
description:
Feb  4 15:15:12 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.194.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
description:
2025-02-04 15:15:11 dovecot_plain authenticator failed for (trangazed) [102.53.15.17]:45486: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.19.108
description:
2025-02-04 15:15:17 dovecot_plain authenticator failed for (popubby) [149.0.19.108]:59222: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Feb  4 15:15:23 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Feb  4 15:16:42 ait sshd[4188165]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.183.209
description:
Feb  4 15:16:28 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.183.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
description:
2025-02-04 15:16:36 dovecot_plain authenticator failed for (satophen) [102.53.15.54]:46236: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  4 15:16:42 ait sshd[4188165]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.183.209
description:
2025-02-04 15:16:30 dovecot_plain authenticator failed for (fitent) [65.20.183.209]:54928: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Feb  4 15:16:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
description:
2025-02-04 15:16:36 dovecot_plain authenticator failed for (sigion) [185.65.238.250]:53103: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.65.238.250
description:
Feb  4 15:16:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.65.238.250 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 118.67.214.233
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-16.118.67.214.233


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Feb  4 15:16:44 ait sshd[4188165]: Failed password for invalid user Can't open exe from 122.51.104.242 port 38304 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.181.123.89
description:
[2025-02-04 15:16:51 +0100] info [webmaild] 168.181.123.89 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.234.202.25
description:
[2025-02-04 15:17:25 +0100] info [webmaild] 103.234.202.25 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.151.51.223
description:
2025-02-04 15:18:06 dovecot_plain authenticator failed for customer-ip-193-151-51-223.ipv.net.pl [193.151.51.223]:33956: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.124.66
description:
Feb  4 15:18:16 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.124.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
description:
2025-02-04 15:18:39 dovecot_plain authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:44156: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.77.137.236
description:
Feb  4 15:18:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.77.137.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.223.193.232
description:
2025-02-04 15:18:40 dovecot_plain authenticator failed for ([88.223.193.232]) [88.223.193.232]:42545: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.10.195.198
description:
Feb  4 15:17:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.10.195.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.151.51.223
description:
Feb  4 15:18:04 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.151.51.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.68.0.210
description:
2025-02-04 15:18:41 dovecot_plain authenticator failed for ([218.68.0.210]) [218.68.0.210]:56644: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.90.34.32
description:
2025-02-04 15:18:41 dovecot_plain authenticator failed for syn-071-090-034-032.res.spectrum.com [71.90.34.32]:46885: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.6.20
description:
Feb  4 15:18:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.6.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.28.26.250
description:
Feb  4 15:18:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.28.26.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.42.226.215
description:
Feb  4 15:18:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.42.226.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
description:
2025-02-04 15:18:42 dovecot_plain authenticator failed for ([110.77.137.236]) [110.77.137.236]:55916: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
description:
2025-02-04 15:18:02 dovecot_plain authenticator failed for 42-200-60-186.static.imsbiz.com [42.200.60.186]:50681: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.241.121.9
description:
Feb  4 15:18:05 ait sshd[4188568]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.241.121.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.223.193.232
description:
Feb  4 15:18:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.223.193.232 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.241.121.9
description:
Feb  4 15:18:05 ait sshd[4188568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.241.121.9


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 59.56.18.8
description:
Feb  4 15:18:10 ait sshd[4188603]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.56.18.8


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.239.241.198
description:
Feb  4 15:18:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.239.241.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.239.241.198
description:
2025-02-04 15:18:41 dovecot_plain authenticator failed for ([115.239.241.198]) [115.239.241.198]:33043: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.195.198
description:
2025-02-04 15:17:57 dovecot_plain authenticator failed for ([221.10.195.198]) [221.10.195.198]:42099: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.60.186
description:
Feb  4 15:18:00 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.60.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.39.191.14
description:
Feb  4 15:18:42 ait sshd[4188877]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.39.191.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.6.81.59
description:
Feb  4 15:18:37 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.6.81.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.199.29.111
description:
Feb  4 15:18:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.199.29.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.28.26.250
description:
2025-02-04 15:18:40 dovecot_plain authenticator failed for (201-28-26-250.customer.tdatabrasil.net.br) [201.28.26.250]:55603: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.199.29.111
description:
2025-02-04 15:18:41 dovecot_plain authenticator failed for ([124.199.29.111]) [124.199.29.111]:41672: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.56.18.8
description:
Feb  4 15:18:10 ait sshd[4188603]: pam_imunify(sshd:auth): [IM360_RBL] The IP 59.56.18.8 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.39.191.14
description:
Feb  4 15:18:42 ait sshd[4188877]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.191.14


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.211.16.20
description:
Feb  4 15:18:35 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.211.16.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.81.242
description:
Feb  4 15:18:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.81.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.68.0.210
description:
Feb  4 15:18:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.68.0.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.90.34.32
description:
Feb  4 15:18:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.90.34.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.181.74
description:
2025-02-04 15:18:41 dovecot_plain authenticator failed for ([103.65.227.71]) [114.130.181.74]:37191: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
description:
Feb  4 15:18:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.169.109.208
description:
[2025-02-04 15:18:12 +0100] info [webmaild] 45.169.109.208 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.124.66
description:
2025-02-04 15:18:18 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:51351: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.16.20
description:
2025-02-04 15:18:37 dovecot_plain authenticator failed for 217-211-16-20-no600.tbcn.telia.com [217.211.16.20]:52782: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.181.74
description:
Feb  4 15:18:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.181.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
description:
2025-02-04 15:18:43 dovecot_plain authenticator failed for ([111.50.70.34]) [111.50.70.34]:34954: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.81.242
description:
2025-02-04 15:18:44 dovecot_plain authenticator failed for ([58.18.81.242]) [58.18.81.242]:52619: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.160.119.116
description:
2025-02-04 15:19:20 dovecot_plain authenticator failed for ([61.160.119.116]) [61.160.119.116]:52136: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.75.188.242
description:
Feb  4 15:18:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.75.188.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.250
description:
2025-02-04 15:19:15 dovecot_plain authenticator failed for ([211.247.127.250]) [211.247.127.250]:34590: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.39.191.14
description:
Feb  4 15:18:44 ait sshd[4188877]: Failed password for invalid user lawyer from 54.39.191.14 port 49806 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.6.20
description:
2025-02-04 15:18:44 dovecot_plain authenticator failed for 111-70-6-20.emome-ip.hinet.net [111.70.6.20]:54909: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.75.227.38
description:
Feb  4 15:18:46 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.75.227.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Feb  4 15:18:54 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-02-04 15:19:14 dovecot_plain authenticator failed for ([112.111.61.230]) [112.111.61.229]:58920: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.76.106.226
description:
Feb  4 15:18:58 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.76.106.226 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.190.234.25
description:
[2025-02-04 15:19:41 +0100] info [webmaild] 78.190.234.25 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.57.104.252
description:
2025-02-04 15:18:52 dovecot_plain authenticator failed for 95.57.104.252.dynamic.telecom.kz [95.57.104.252]:53913: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.171.185
description:
Feb  4 15:18:54 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.171.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.138
description:
Feb  4 15:18:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.26.59
description:
Feb  4 15:19:00 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.26.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.85.205
description:
Feb  4 15:19:09 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.85.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.85.137
description:
2025-02-04 15:19:12 dovecot_plain authenticator failed for ([177.174.85.129]) [177.174.85.137]:33924: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.21.113
description:
Feb  4 15:18:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.21.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.4.255.205
description:
2025-02-04 15:18:49 dovecot_plain authenticator failed for ([59.4.255.205]) [59.4.255.205]:59165: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.26.59
description:
2025-02-04 15:19:02 dovecot_plain authenticator failed for ([195.158.26.59]) [195.158.26.59]:49252: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
description:
Feb  4 15:18:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.18.71.134
description:
Feb  4 15:18:56 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.18.71.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.247.207.98
description:
Feb  4 15:19:02 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.247.207.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 15:18:58 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.76.106.226
description:
2025-02-04 15:19:00 dovecot_plain authenticator failed for (226.106.76.200.static.redip.topnet.com.mx) [200.76.106.226]:46352: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.160.119.116
description:
Feb  4 15:19:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.160.119.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.230.214
description:
Feb  4 15:18:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.230.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.21.113
description:
2025-02-04 15:18:45 dovecot_plain authenticator failed for ([117.158.21.113]) [117.158.21.113]:59353: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.4.255.205
description:
Feb  4 15:18:47 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.4.255.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Feb  4 15:18:54 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.32.11.3
description:
Feb  4 15:18:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.32.11.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.148.173.150
description:
Feb  4 15:18:58 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.148.173.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.42.226.215
description:
2025-02-04 15:18:44 dovecot_plain authenticator failed for ([58.42.226.215]) [58.42.226.215]:48080: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Feb  4 15:19:12 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.138
description:
2025-02-04 15:18:57 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:34173: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.111.139.88
description:
Feb  4 15:19:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.111.139.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.230.214
description:
2025-02-04 15:18:45 dovecot_plain authenticator failed for ([94.204.230.214]) [94.204.230.214]:49012: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.75.227.38
description:
2025-02-04 15:18:48 dovecot_plain authenticator failed for 128-75-227-38.broadband.corbina.ru [128.75.227.38]:45058: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.203.210.119
description:
Feb  4 15:18:52 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.203.210.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.11.145.163
description:
Feb  4 15:18:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.11.145.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.171.185
description:
2025-02-04 15:18:56 dovecot_plain authenticator failed for ([220.180.171.185]) [220.180.171.185]:40232: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
description:
2025-02-04 15:18:57 dovecot_plain authenticator failed for ([115.22.247.178]) [115.22.247.178]:57155: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.111.139.88
description:
2025-02-04 15:19:24 dovecot_plain authenticator failed for pool-98-111-139-88.phlapa.fios.verizon.net [98.111.139.88]:56739: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-02-04 15:18:56 dovecot_plain authenticator failed for ([171.244.40.236]) [171.244.40.236]:29214: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.247.207.98
description:
2025-02-04 15:19:04 dovecot_plain authenticator failed for ([114.247.207.98]) [114.247.207.98]:56540: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.205.193.3
description:
[2025-02-04 15:18:48 +0100] info [webmaild] 181.205.193.3 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.203.210.119
description:
2025-02-04 15:18:54 dovecot_plain authenticator failed for ([103.203.210.119]) [103.203.210.119]:60896: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.162
description:
2025-02-04 15:18:57 dovecot_plain authenticator failed for ([149.54.15.162]) [149.54.15.162]:55442: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.75.188.242
description:
2025-02-04 15:18:57 dovecot_plain authenticator failed for ([115.75.188.242]) [115.75.188.242]:47502: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.18.71.134
description:
2025-02-04 15:18:58 dovecot_plain authenticator failed for (20118071134.host.telemar.net.br) [201.18.71.134]:50466: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.148.173.150
description:
2025-02-04 15:19:00 dovecot_plain authenticator failed for ([189.108.24.17]) [200.148.173.150]:57799: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.247.127.250
description:
Feb  4 15:19:13 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.247.127.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.15.162
description:
Feb  4 15:18:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.15.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.32.11.3
description:
2025-02-04 15:18:59 dovecot_plain authenticator failed for ([119.32.11.3]) [119.32.11.3]:42219: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-19.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.57.104.252
description:
Feb  4 15:18:50 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.57.104.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-02-04 15:18:56 dovecot_plain authenticator failed for ([2.57.219.14]) [2.57.219.2]:59750: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.11.145.163
description:
2025-02-04 15:18:57 dovecot_plain authenticator failed for ([121.11.145.163]) [121.11.145.163]:46929: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.85.137
description:
Feb  4 15:19:10 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.85.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.85.205
description:
2025-02-04 15:19:11 dovecot_plain authenticator failed for 131-106-85-205.s1483.c3-0.tlg-cbr5.atw-tlg.pa.cable.rcncustomer.com [131.106.85.205]:35542: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 83.222.191.62
description:
Feb  4 15:20:24 ait sshd[4189760]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=83.222.191.62


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.222.191.62
description:
Feb  4 15:20:24 ait sshd[4189760]: pam_imunify(sshd:auth): [IM360_RBL] The IP 83.222.191.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.202.187.108
description:
[2025-02-04 15:20:12 +0100] info [webmaild] 143.202.187.108 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.187.22.206
description:
Feb  4 15:21:02 ait sshd[4190153]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.22.206


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.247.115.27
description:
[2025-02-04 15:21:31 +0100] info [webmaild] 170.247.115.27 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.187.22.206
description:
Feb  4 15:21:02 ait sshd[4190153]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.187.22.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.53.158
description:
[2025-02-04 15:20:54 +0100] info [webmaild] 45.70.53.158 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.18.55.49
description:
Feb  4 15:21:28 ait sshd[4190258]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.18.55.49 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.18.55.49
description:
Feb  4 15:21:28 ait sshd[4190258]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.18.55.49


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.202.145.229
description:
[2025-02-04 15:21:50 +0100] info [webmaild] 143.202.145.229 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 165.154.251.134
description:
2025-02-04 15:23:27 H=(mail.worldwide-university.com) [165.154.251.134]:60297 F=<sunol@worldwide-university.com> rejected RCPT <validxxxg@gmail.com>: Rejected relay attempt: '165.154.251.134' From: 'sunol@worldwide-university.com' To: 'validxxxg@gmail.com'


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.91.178.116
description:
2025-02-04 15:22:46 dovecot_plain authenticator failed for pd95bb274.dip0.t-ipconnect.de (biden) [217.91.178.116]:41210: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.227.2.181
description:
Feb  4 15:23:04 ait sshd[4190936]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.227.2.181


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.99.174
description:
47.128.99.174 - - [04/Feb/2025:15:23:04 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15486285 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/a6317f?panel=logger" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.99.174


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.65.25
description:
[2025-02-04 15:22:44 +0100] info [webmaild] 157.100.65.25 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.26.80.169
description:
[2025-02-04 15:23:16 +0100] info [webmaild] 103.26.80.169 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.91.178.116
description:
Feb  4 15:22:44 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.91.178.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 15:23:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.227.2.181
description:
Feb  4 15:23:04 ait sshd[4190936]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.227.2.181 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.76.60.180
description:
[2025-02-04 15:24:31 +0100] info [webmaild] 189.76.60.180 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.221.174.188
description:
[2025-02-04 15:23:54 +0100] info [webmaild] 91.221.174.188 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Feb  4 15:24:07 ait sshd[4191351]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Feb  4 15:24:07 ait sshd[4191351]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.55.243.17
description:
[2025-02-04 15:25:41 +0100] info [webmaild] 217.55.243.17 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 15:24:52 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.45.143.159
description:
Feb  4 15:24:45 ait sshd[4191664]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.45.143.159 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.45.143.159
description:
Feb  4 15:24:45 ait sshd[4191664]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.45.143.159


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  4 15:25:43 ait sshd[4192287]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.148.250.148
description:
[2025-02-04 15:26:12 +0100] info [webmaild] 201.148.250.148 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  4 15:25:43 ait sshd[4192287]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.29.150.175
description:
[2025-02-04 15:26:38 +0100] info [webmaild] 189.29.150.175 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Feb  4 15:27:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.218.200
description:
Feb  4 15:27:21 ait sshd[4192841]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.218.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.136.29.20
description:
2025-02-04 15:27:09 dovecot_plain authenticator failed for ([114.53.252.246]) [124.136.29.20]:43839: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.82.197.235
description:
Feb  4 15:27:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.82.197.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 15:27:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 15:26:46 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.136.29.20
description:
Feb  4 15:27:07 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.136.29.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.82.197.235
description:
2025-02-04 15:27:22 dovecot_plain authenticator failed for ([120.82.197.235]) [120.82.197.235]:53251: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.218.200
description:
Feb  4 15:27:21 ait sshd[4192841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.218.200


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 124.29.216.68
description:
[2025-02-04 15:27:22 +0100] info [webmaild] 124.29.216.68 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.239.187.13
description:
2025-02-04 15:27:49 dovecot_plain authenticator failed for ([20.239.187.13]) [20.239.187.13]:57080: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.59.53
description:
2025-02-04 15:27:57 dovecot_plain authenticator failed for ([185.167.59.53]) [185.167.59.53]:37526: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.73.48.210
description:
Feb  4 15:28:18 ait sshd[4193242]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.73.48.210 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.73.48.210
description:
Feb  4 15:28:18 ait sshd[4193242]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.73.48.210


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.181.22.113
description:
[2025-02-04 15:28:26 +0100] info [webmaild] 45.181.22.113 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-02-04 15:27:42 dovecot_plain authenticator failed for (dected) [207.188.157.230]:19631: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 15:28:00 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.59.53
description:
Feb  4 15:27:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.59.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.239.187.13
description:
Feb  4 15:27:47 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.239.187.13 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 118.67.214.233
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-30.118.67.214.233


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.237.83.130
description:
2025-02-04 15:30:32 dovecot_plain authenticator failed for ([23.237.83.130]) [23.237.83.130]:38042: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.237.83.130
description:
Feb  4 15:30:30 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.237.83.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.145.142.243
description:
Feb  4 15:29:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.145.142.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
description:
2025-02-04 15:29:45 dovecot_plain authenticator failed for ([203.145.142.243]) [203.145.142.243]:52730: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.65.146.131
description:
[2025-02-04 15:30:06 +0100] info [webmaild] 196.65.146.131 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.32.184.197
description:
[2025-02-04 15:31:10 +0100] info [webmaild] 189.32.184.197 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
description:
Feb  4 15:31:11 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.222.90.178
description:
2025-02-04 15:30:45 dovecot_plain authenticator failed for ([200.222.90.178]) [200.222.90.178]:44628: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.96.43.215
description:
Feb  4 15:30:54 ait sshd[916]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.43.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.32.132.170
description:
2025-02-04 15:31:01 dovecot_plain authenticator failed for ([117.32.132.170]) [117.32.132.170]:44089: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.96.43.215
description:
Feb  4 15:30:54 ait sshd[916]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.96.43.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.32.132.170
description:
Feb  4 15:30:59 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.32.132.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
description:
2025-02-04 15:31:13 dovecot_plain authenticator failed for ([60.166.31.198]) [60.166.31.198]:44648: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.222.90.178
description:
Feb  4 15:30:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.222.90.178 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.84.116
description:
[2025-02-04 15:31:44 +0100] info [webmaild] 84.54.84.116 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.71.62.79
description:
Feb  4 15:32:12 ait sshd[1303]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.62.79


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.165.222.29
description:
[2025-02-04 15:32:33 +0100] info [webmaild] 45.165.222.29 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.62.79
description:
Feb  4 15:32:57 ait sshd[1631]: Failed password for invalid user test from 167.71.62.79 port 58618 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.8.213.37
description:
[2025-02-04 15:33:10 +0100] info [webmaild] 191.8.213.37 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.40.122.250
description:
Feb  4 15:33:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.40.122.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
description:
2025-02-04 15:33:40 dovecot_plain authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:58800: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.99.64
description:
Feb  4 15:33:03 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.99.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.99.64
description:
2025-02-04 15:33:05 dovecot_plain authenticator failed for ([116.86.99.64]) [116.86.99.64]:36129: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.70.166.51
description:
Feb  4 15:33:10 ait sshd[1733]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.70.166.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.71.62.79
description:
Feb  4 15:32:55 ait sshd[1631]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.62.79


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.70.166.51
description:
Feb  4 15:33:10 ait sshd[1733]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.70.166.51


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 15:33:46 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.57.86.244
description:
[2025-02-04 15:33:51 +0100] info [webmaild] 95.57.86.244 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.130.177.18
description:
[2025-02-04 15:34:23 +0100] info [webmaild] 179.130.177.18 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.39.54
description:
Feb  4 15:34:44 ait sshd[2214]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.39.54


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.24.154.232
description:
Feb  4 15:35:12 ait sshd[2635]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.24.154.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.139.133.238
description:
Feb  4 15:35:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.139.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Feb  4 15:35:06 ait sshd[2624]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Feb  4 15:35:06 ait sshd[2624]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.24.154.232
description:
Feb  4 15:35:12 ait sshd[2635]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.24.154.232


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.143.203
description:
[2025-02-04 15:35:13 +0100] info [webmaild] 179.125.143.203 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.139.133.238
description:
2025-02-04 15:35:38 dovecot_plain authenticator failed for ([123.139.133.238]) [123.139.133.238]:50050: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Feb  4 15:35:52 ait sshd[3175]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.71.37.202
description:
2025-02-04 15:35:55 dovecot_plain authenticator failed for ([47.98.191.121]) [101.71.37.202]:47769: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.48.194.21
description:
Feb  4 15:36:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.48.194.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.194.21
description:
2025-02-04 15:36:40 dovecot_plain authenticator failed for ([103.48.194.21]) [103.48.194.21]:40558: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 110.76.128.100
description:
[2025-02-04 15:35:50 +0100] info [webmaild] 110.76.128.100 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.71.37.202
description:
Feb  4 15:35:53 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.71.37.202 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Feb  4 15:35:52 ait sshd[3175]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 15:35:58 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.219.210.194
description:
[2025-02-04 15:36:27 +0100] info [webmaild] 102.219.210.194 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.81.70.80
description:
Feb  4 15:36:50 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.81.70.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.81.70.80
description:
2025-02-04 15:36:52 dovecot_plain authenticator failed for (50-81-70-80.client.mchsi.com) [50.81.70.80]:59054: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.152
description:
Feb  4 15:36:53 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.151.239.210
description:
Feb  4 15:36:56 ait sshd[3486]: pam_imunify(sshd:auth): [IM360_RBL] The IP 61.151.239.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.229
description:
Feb  4 15:37:07 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.63.46.34
description:
Feb  4 15:37:25 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.63.46.34 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 61.151.239.210
description:
Feb  4 15:36:56 ait sshd[3486]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.151.239.210


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
description:
2025-02-04 15:36:55 dovecot_plain authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:40705: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 15:37:12 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.63.46.34
description:
2025-02-04 15:37:27 dovecot_plain authenticator failed for ([203.29.84.253]) [203.63.46.34]:64405: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-37.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 15:37:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 158.181.40.30
description:
[2025-02-04 15:37:00 +0100] info [webmaild] 158.181.40.30 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.229
description:
2025-02-04 15:37:09 dovecot_plain authenticator failed for (m121-202-153-229.smartone.com) [121.202.153.229]:35818: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.34.189.60
description:
[2025-02-04 15:37:17 +0100] info [webmaild] 177.34.189.60 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.85.12.142
description:
2025-02-04 15:37:45 dovecot_plain authenticator failed for ([61.85.12.142]) [61.85.12.142]:41821: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.231.199.118
description:
[2025-02-04 15:38:05 +0100] info [webmaild] 190.231.199.118 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Feb  4 15:38:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
description:
2025-02-04 15:38:38 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (ovanave) [81.225.30.107]:59849: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.85.12.142
description:
Feb  4 15:37:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.85.12.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.125
description:
2025-02-04 15:39:15 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.125]:41978: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.133.238
description:
Feb  4 15:39:29 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.57.71
description:
Feb  4 15:39:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.57.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.125
description:
Feb  4 15:39:13 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.166
description:
Feb  4 15:39:21 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.166
description:
2025-02-04 15:39:23 dovecot_plain authenticator failed for ([218.149.228.166]) [218.149.228.166]:46836: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.237.166.223
description:
[2025-02-04 15:38:43 +0100] info [webmaild] 186.237.166.223 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
description:
2025-02-04 15:39:31 dovecot_plain authenticator failed for (189-44-133-238.customer.tdatabrasil.net.br) [189.44.133.238]:37802: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.57.71
description:
2025-02-04 15:39:40 dovecot_plain authenticator failed for n220246057071.netvigator.com [220.246.57.71]:51909: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.4.89.143
description:
[2025-02-04 15:39:12 +0100] info [webmaild] 201.4.89.143 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Feb  4 15:40:23 ait sshd[5291]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.135.129.166
description:
[2025-02-04 15:39:46 +0100] info [webmaild] 190.135.129.166 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.103.235.223
description:
Feb  4 15:39:52 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.103.235.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.61.183.212
description:
2025-02-04 15:39:44 dovecot_plain authenticator failed for host-82-61-183-212.retail.telecomitalia.it [82.61.183.212]:44638: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.103.235.223
description:
2025-02-04 15:39:54 dovecot_plain authenticator failed for ([222.103.235.223]) [222.103.235.223]:50563: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
description:
Feb  4 15:40:23 ait sshd[5291]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.61.183.212
description:
Feb  4 15:39:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.61.183.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.192.131
description:
Feb  4 15:40:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.192.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.131
description:
2025-02-04 15:40:36 dovecot_plain authenticator failed for ([1.235.192.131]) [1.235.192.131]:40832: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Feb  4 15:40:06 ait sshd[5214]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.105.234
description:
Feb  4 15:41:02 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.105.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.234
description:
2025-02-04 15:41:04 dovecot_plain authenticator failed for 110-25-105-234.adsl.fetnet.net [110.25.105.234]:44586: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.161.166.113
description:
Feb  4 15:41:09 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.161.166.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.251.49.106
description:
2025-02-04 15:41:19 dovecot_plain authenticator failed for 116-251-49-106.pool.activ8me.net.au [116.251.49.106]:38298: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.237.193
description:
Feb  4 15:40:46 ait sshd[5504]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.245.237.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 15:40:56 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.81
description:
Feb  4 15:41:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.27.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.181.133.153
description:
Feb  4 15:40:47 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.181.133.153 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.126.23.21
description:
[2025-02-04 15:41:09 +0100] info [webmaild] 103.126.23.21 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.161.166.113
description:
2025-02-04 15:41:11 dovecot_plain authenticator failed for static-css-csu-166113.business.bouyguestelecom.com [176.161.166.113]:41461: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
description:
Feb  4 15:41:37 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
description:
2025-02-04 15:41:39 dovecot_plain authenticator failed for ([171.244.63.170]) [171.244.63.170]:56557: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
description:
2025-02-04 15:41:41 dovecot_plain authenticator failed for ([27.71.27.81]) [27.71.27.81]:13006: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.97.63.209
description:
Feb  4 15:41:13 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.97.63.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.97.63.209
description:
2025-02-04 15:41:15 dovecot_plain authenticator failed for ([211.97.63.209]) [211.97.63.209]:46651: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.251.49.106
description:
Feb  4 15:41:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.251.49.106 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.245.237.193
description:
Feb  4 15:40:46 ait sshd[5504]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.245.237.193


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
description:
2025-02-04 15:40:49 dovecot_plain authenticator failed for ([179.181.135.1]) [179.181.133.153]:33939: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-02-04 15:42:02 dovecot_plain authenticator failed for ([121.186.131.108]) [121.186.131.108]:51014: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.159.91.86
description:
Feb  4 15:42:37 ait sshd[6104]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.159.91.86 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.236.200.53
description:
[2025-02-04 15:42:34 +0100] info [webmaild] 200.236.200.53 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.159.91.86
description:
Feb  4 15:42:37 ait sshd[6104]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.159.91.86


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.249.155.141
description:
[2025-02-04 15:41:47 +0100] info [webmaild] 185.249.155.141 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.186.131.108
description:
Feb  4 15:42:00 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.186.131.108 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.175.105.104
description:
[2025-02-04 15:41:58 +0100] info [webmaild] 109.175.105.104 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.245
description:
Feb  4 15:42:47 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.245
description:
2025-02-04 15:42:49 dovecot_plain authenticator failed for (m121-202-152-245.smartone.com) [121.202.152.245]:34260: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 118.67.214.233
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-43.118.67.214.233


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.186.221.174
description:
Feb  4 15:43:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.186.221.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.221.174
description:
2025-02-04 15:43:22 dovecot_plain authenticator failed for ([103.186.221.174]) [103.186.221.174]:59712: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.190.70.170
description:
[2025-02-04 15:43:58 +0100] info [webmaild] 177.190.70.170 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.67.185.48
description:
Feb  4 15:43:52 ait sshd[6536]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.67.185.48 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.67.185.48
description:
Feb  4 15:43:52 ait sshd[6536]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.67.185.48


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.163
description:
Feb  4 15:43:56 ait sshd[6550]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.136
description:
Feb  4 15:44:11 ait sshd[6774]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.136 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.136
description:
Feb  4 15:44:11 ait sshd[6774]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.136


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.121.173.45
description:
[2025-02-04 15:44:38 +0100] info [webmaild] 103.121.173.45 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.163
description:
Feb  4 15:43:56 ait sshd[6550]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.227.4
description:
2025-02-04 15:45:10 dovecot_plain authenticator failed for wsip-70-183-227-4.pn.at.cox.net [70.183.227.4]:43126: 535 Incorrect authentication data (set_id=ads19b00191y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Feb  4 15:45:13 ait sshd[7200]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.4.102
description:
Feb  4 15:45:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.4.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.4.102
description:
2025-02-04 15:45:26 dovecot_plain authenticator failed for ([200.149.4.102]) [200.149.4.102]:52047: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.120.224.227
description:
Feb  4 15:45:09 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.120.224.227 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Feb  4 15:45:13 ait sshd[7200]: Invalid user seecamping-zittau.com 2a00 from 122.51.104.242 port 58728


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.249.234.242
description:
2025-02-04 15:45:20 dovecot_plain authenticator failed for pool-96-249-234-242.nrflva.fios.verizon.net [96.249.234.242]:59924: 535 Incorrect authentication data (set_id=ads19b00191y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.239.251.214
description:
Feb  4 15:45:30 ait sshd[7306]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.239.251.214


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.183.227.4
description:
Feb  4 15:45:08 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.183.227.4 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  4 15:45:13 ait sshd[7200]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.108.240.27
description:
[2025-02-04 15:45:17 +0100] info [webmaild] 187.108.240.27 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.251.214
description:
Feb  4 15:45:30 ait sshd[7306]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.239.251.214 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 147.235.213.238
description:
[2025-02-04 15:44:44 +0100] info [webmaild] 147.235.213.238 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.224.227
description:
2025-02-04 15:45:11 dovecot_plain authenticator failed for ([220.120.224.227]) [220.120.224.227]:51350: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.249.234.242
description:
Feb  4 15:45:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.249.234.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.124.66
description:
Feb  4 15:46:14 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.124.66 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  4 15:46:13 ait sshd[7809]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.105.246.224
description:
Feb  4 15:46:32 ait sshd[7893]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.105.246.224 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Feb  4 15:46:12 ait sshd[7809]: Invalid user seecamping-zittau.com 2a00 from 122.51.104.242 port 52788


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.236.104
description:
2025-02-04 15:45:59 dovecot_plain authenticator failed for ([27.45.236.104]) [27.45.236.104]:34286: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.124.66
description:
2025-02-04 15:46:16 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:38857: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Feb  4 15:46:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-02-04 15:46:24 dovecot_plain authenticator failed for (wayed) [77.51.214.170]:44871: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.236.104
description:
Feb  4 15:45:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.236.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.105.246.224
description:
Feb  4 15:46:32 ait sshd[7893]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.105.246.224


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Feb  4 15:46:13 ait sshd[7809]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 209.45.48.84
description:
[2025-02-04 15:47:35 +0100] info [webmaild] 209.45.48.84 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.227.166.128
description:
[2025-02-04 15:46:46 +0100] info [webmaild] 168.227.166.128 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.105.204.156
description:
[2025-02-04 15:47:26 +0100] info [webmaild] 176.105.204.156 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.35
description:
Feb  4 15:47:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
description:
2025-02-04 15:47:35 dovecot_plain authenticator failed for ([114.242.61.35]) [114.242.61.35]:58112: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.154.149
description:
Feb  4 15:47:53 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.154.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.66.190.67
description:
Feb  4 15:47:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.66.190.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.154.149
description:
2025-02-04 15:47:55 dovecot_plain authenticator failed for ([175.156.154.149]) [175.156.154.149]:56502: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.118.167.148
description:
[2025-02-04 15:48:10 +0100] info [webmaild] 179.118.167.148 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.216.119.13
description:
Feb  4 15:48:38 ait sshd[8741]: pam_imunify(sshd:auth): [IM360_RBL] The IP 118.216.119.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.164.165
description:
Feb  4 15:48:05 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.164.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.164.165
description:
2025-02-04 15:48:07 dovecot_plain authenticator failed for ([5.11.164.165]) [5.11.164.165]:36887: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.152.28
description:
Feb  4 15:47:46 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.152.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.133.205
description:
Feb  4 15:47:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.133.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.133.205
description:
2025-02-04 15:47:59 dovecot_plain authenticator failed for ([45.238.133.205]) [45.238.133.205]:47746: 535 Incorrect authentication data (set_id=ads19b00188y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.62.219
description:
47.128.62.219 - - [04/Feb/2025:15:48:04 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16735047 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/dafd2d?panel=form" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.62.219


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.216.119.13
description:
Feb  4 15:48:38 ait sshd[8741]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.216.119.13


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.56.18.8
description:
Feb  4 15:47:43 ait sshd[8361]: pam_imunify(sshd:auth): [IM360_RBL] The IP 59.56.18.8 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 59.56.18.8
description:
Feb  4 15:47:43 ait sshd[8361]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.56.18.8


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.28
description:
2025-02-04 15:47:48 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.152.28]:41018: 535 Incorrect authentication data (set_id=ads19b00188y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.66.190.67
description:
2025-02-04 15:47:57 dovecot_plain authenticator failed for ([116.66.190.67]) [116.66.190.67]:48850: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 15:48:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
description:
2025-02-04 15:49:02 dovecot_plain authenticator failed for (attophous) [102.53.15.17]:33389: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.23.210.188
description:
2025-02-04 15:49:22 dovecot_plain authenticator failed for (depodural) [89.23.210.188]:52263: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.23.210.188
description:
Feb  4 15:49:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.23.210.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.254.99.82
description:
Feb  4 15:48:52 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.254.99.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.254.99.82
description:
2025-02-04 15:48:54 dovecot_plain authenticator failed for ([101.254.99.94]) [101.254.99.82]:42919: 535 Incorrect authentication data (set_id=ads20b00294y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
description:
Feb  4 15:49:00 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.113.31.149
description:
[2025-02-04 15:49:37 +0100] info [webmaild] 217.113.31.149 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.232.39.165
description:
Feb  4 15:49:05 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.232.39.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.232.39.165
description:
2025-02-04 15:49:07 dovecot_plain authenticator failed for ([185.232.39.165]) [185.232.39.165]:53167: 535 Incorrect authentication data (set_id=ads20b00294y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 15:49:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.61.84.43
description:
[2025-02-04 15:50:28 +0100] info [webmaild] 46.61.84.43 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.136
description:
Feb  4 15:50:18 ait sshd[9771]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.136 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.136
description:
Feb  4 15:50:18 ait sshd[9771]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.136


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.227.134
description:
Feb  4 15:50:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.227.134 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.178.174.147
description:
[2025-02-04 15:50:16 +0100] info [webmaild] 191.178.174.147 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.250.134.35
description:
Feb  4 15:50:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.250.134.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.250.134.35
description:
2025-02-04 15:50:21 dovecot_plain authenticator failed for ([130.250.134.35]) [130.250.134.35]:32786: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.227.134
description:
2025-02-04 15:50:41 dovecot_plain authenticator failed for (134.227.160.222.adsl-pool.jlccptt.net.cn) [222.160.227.134]:59790: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 89.146.68.37
description:
[2025-02-04 15:51:01 +0100] info [webmaild] 89.146.68.37 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Feb  4 15:51:07 ait sshd[10134]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Feb  4 15:51:07 ait sshd[10134]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.237.178.130
description:
Feb  4 15:50:46 ait sshd[9978]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.237.178.130


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
description:
2025-02-04 15:50:46 dovecot_plain authenticator failed for (inage) [64.72.74.162]:50360: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
description:
Feb  4 15:50:44 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.237.178.130
description:
Feb  4 15:50:46 ait sshd[9978]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.237.178.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.151.19
description:
Feb  4 15:52:08 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.151.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.254.23.40
description:
Feb  4 15:52:24 ait sshd[10938]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.254.23.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.113
description:
Feb  4 15:51:59 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.113 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.123.220.10
description:
Feb  4 15:52:19 ait sshd[10921]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.123.220.10


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.113
description:
2025-02-04 15:52:01 dovecot_plain authenticator failed for (113.20.167.124.adsl-pool.sx.cn) [124.167.20.113]:49835: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.123.220.10
description:
Feb  4 15:52:19 ait sshd[10921]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.123.220.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.66.1.168
description:
[2025-02-04 15:52:25 +0100] info [webmaild] 105.66.1.168 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.254.23.40
description:
Feb  4 15:52:24 ait sshd[10938]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.254.23.40


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.151.19
description:
2025-02-04 15:52:10 dovecot_plain authenticator failed for ([95.165.151.19]) [95.165.151.19]:33214: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.115.159
description:
Feb  4 15:52:50 ait sshd[11055]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.115.159 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.18.55.49
description:
Feb  4 15:53:30 ait sshd[11427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.18.55.49


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.116.41.2
description:
Feb  4 15:53:31 ait sshd[11425]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.116.41.2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.114.196
description:
Feb  4 15:53:33 ait sshd[11431]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.114.196


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
description:
2025-02-04 15:53:22 dovecot_plain authenticator failed for ([179.181.135.1]) [179.181.133.153]:41431: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.52.193.185
description:
Feb  4 15:53:24 ait sshd[11401]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.52.193.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.18.55.49
description:
Feb  4 15:53:30 ait sshd[11427]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.18.55.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.181.133.153
description:
Feb  4 15:53:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.181.133.153 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.52.193.185
description:
Feb  4 15:53:24 ait sshd[11401]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.52.193.185


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.116.41.2
description:
Feb  4 15:53:31 ait sshd[11425]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.116.41.2 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.115.159
description:
Feb  4 15:52:50 ait sshd[11055]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.115.159


