# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.237.42.54
country_id: 2017370
description:
Feb  6 15:47:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.237.42.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.199.147
country_id: 1819730
description:
Feb  6 15:47:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.199.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.235.62
country_id: 3469034
description:
Feb  6 15:47:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.235.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.80.68
country_id: 1835841
description:
2025-02-06 15:47:57 dovecot_plain authenticator failed for ([211.44.80.68]) [211.44.80.68]:59498: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.147.184
country_id: 3469034
description:
2025-02-06 15:47:57 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.147.184]:48950: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.6.225.90
country_id: 1820814
description:
2025-02-06 15:47:26 dovecot_login authenticator failed for (90-225.adsl.static.espeed.com.bn) [61.6.225.90]:43250: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.118.123.44
country_id: 6252001
description:
Feb  6 15:47:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.118.123.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.9.38.92
country_id: 1835841
description:
Feb  6 15:47:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.9.38.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.161.242.146
country_id: 1814991
description:
2025-02-06 15:47:43 dovecot_plain authenticator failed for (146.242.161.222.adsl-pool.jlccptt.net.cn) [222.161.242.146]:8008: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.237.42.54
country_id: 2017370
description:
2025-02-06 15:47:45 dovecot_plain authenticator failed for (ANO-SH-21.Moscow.access.comstar.ru) [83.237.42.54]:40256: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.152.34.229
country_id: 1814991
description:
2025-02-06 15:47:58 dovecot_plain authenticator failed for ([124.152.34.229]) [124.152.34.229]:53700: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.44.217.237
country_id: 2077456
description:
2025-02-06 15:48:20 dovecot_plain authenticator failed for ([121.44.217.237]) [121.44.217.237]:43328: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.163.154
country_id: 1210997
description:
2025-02-06 15:48:03 dovecot_plain authenticator failed for ([103.231.163.154]) [103.231.163.154]:14148: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.159.150.111
country_id: 3469034
description:
Feb  6 15:47:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.159.150.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.118.123.44
country_id: 6252001
description:
2025-02-06 15:47:36 dovecot_plain authenticator failed for syn-172-118-123-044.res.spectrum.com [172.118.123.44]:43143: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.54.3.2
country_id: 1814991
description:
Feb  6 15:47:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.54.3.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.208.65.46
country_id: 2017370
description:
Feb  6 15:47:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.208.65.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.65.46
country_id: 2017370
description:
2025-02-06 15:47:57 dovecot_plain authenticator failed for (est.giport.ru) [82.208.65.46]:4603: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.147.184
country_id: 3469034
description:
Feb  6 15:47:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.147.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.11.25.195
country_id: 6252001
description:
Feb  6 15:48:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.11.25.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.19.47.79
country_id: 3469034
description:
Feb  6 15:48:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.19.47.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.74
country_id: 3175395
description:
2025-02-06 15:47:30 dovecot_login authenticator failed for (ADMIN) [156.146.41.74]:34772: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.11.207
country_id: 2017370
description:
Feb  6 15:47:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.11.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.159.150.111
country_id: 3469034
description:
2025-02-06 15:47:34 dovecot_login authenticator failed for ([177.159.150.111]) [177.159.150.111]:42718: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.254
country_id: 1668284
description:
Feb  6 15:47:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.167.238
country_id: 6252001
description:
Feb  6 15:47:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.167.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.50.150
country_id: 1814991
description:
Feb  6 15:47:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.50.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.79.249.83
country_id: 6252001
description:
Feb  6 15:47:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.79.249.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.6.109
country_id: 2017370
description:
Feb  6 15:47:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.6.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.12.219
country_id: 1668284
description:
Feb  6 15:47:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.12.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2025-02-06 15:48:19 dovecot_plain authenticator failed for ([122.186.174.35]) [122.186.174.35]:35082: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.44.217.237
country_id: 2077456
description:
Feb  6 15:48:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.44.217.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.62
country_id: 1819730
description:
Feb  6 15:47:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.80.68
country_id: 1835841
description:
Feb  6 15:47:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.80.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.54.3.2
country_id: 1814991
description:
2025-02-06 15:47:56 dovecot_plain authenticator failed for ([182.54.3.2]) [182.54.3.2]:41222: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.173
country_id: 1814991
description:
2025-02-06 15:47:56 dovecot_plain authenticator failed for ([182.135.66.173]) [182.135.66.173]:53694: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.19.47.79
country_id: 3469034
description:
2025-02-06 15:48:09 dovecot_plain authenticator failed for ([187.19.47.79]) [187.19.47.79]:43909: 535 Incorrect authentication data (set_id=admin@elma-hk.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.6.225.90
country_id: 1820814
description:
Feb  6 15:47:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.6.225.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
country_id: 1814991
description:
2025-02-06 15:47:41 dovecot_plain authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.50.150]:35750: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.200.216.246
country_id: 1814991
description:
2025-02-06 15:47:44 dovecot_plain authenticator failed for ([113.200.216.246]) [113.200.216.246]:48278: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.111
country_id: 3469034
description:
2025-02-06 15:47:55 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.111]:43681: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.90.34.32
country_id: 6252001
description:
2025-02-06 15:47:54 dovecot_plain authenticator failed for syn-071-090-034-032.res.spectrum.com [71.90.34.32]:37372: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.231.163.154
country_id: 1210997
description:
Feb  6 15:48:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.231.163.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.200.216.246
country_id: 1814991
description:
Feb  6 15:47:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.200.216.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.34.73.139
country_id: 1814991
description:
Feb  6 15:47:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.34.73.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.228.190.124
country_id: 3865483
description:
2025-02-06 15:47:45 dovecot_plain authenticator failed for 45-228-190-124.obercom.net.ar [45.228.190.124]:40613: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
country_id: 3469034
description:
2025-02-06 15:47:51 dovecot_plain authenticator failed for ([177.6.235.62]) [177.6.235.62]:58906: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.156.115.37
country_id: 338010
description:
Feb  6 15:48:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.156.115.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.191.163.102
country_id: 1814991
description:
Feb  6 15:47:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.191.163.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
country_id: 2017370
description:
2025-02-06 15:47:39 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:52032: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.228.190.124
country_id: 3865483
description:
Feb  6 15:47:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.228.190.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.79.249.83
country_id: 6252001
description:
2025-02-06 15:47:44 dovecot_plain authenticator failed for ([50.79.249.83]) [50.79.249.83]:24103: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.173
country_id: 1814991
description:
Feb  6 15:47:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.174
country_id: 1814991
description:
2025-02-06 15:47:39 dovecot_plain authenticator failed for ([27.40.100.174]) [27.40.100.174]:60899: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.161.242.146
country_id: 1814991
description:
Feb  6 15:47:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.161.242.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.87.122.207
country_id: 1880251
description:
Feb  6 15:47:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.87.122.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.12.219
country_id: 1668284
description:
2025-02-06 15:47:59 dovecot_plain authenticator failed for 111-70-12-219.emome-ip.hinet.net [111.70.12.219]:45961: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
country_id: 2077456
description:
Feb  6 15:48:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
country_id: 2017370
description:
Feb  6 15:47:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.90.34.32
country_id: 6252001
description:
Feb  6 15:47:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.90.34.32 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.214.211.160
country_id: 1512440
description:
[2025-02-06 15:47:57 +0100] info [webmaild] 95.214.211.160 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.87.122.207
country_id: 1880251
description:
2025-02-06 15:47:58 dovecot_plain authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:59320: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.38.92
country_id: 1835841
description:
2025-02-06 15:47:40 dovecot_plain authenticator failed for ([59.9.38.92]) [59.9.38.92]:34768: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.111
country_id: 3469034
description:
Feb  6 15:47:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.139.195
country_id: 1880251
description:
Feb  6 15:48:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.139.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.115.37
country_id: 338010
description:
2025-02-06 15:48:07 dovecot_plain authenticator failed for ([197.156.115.37]) [197.156.115.37]:55100: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.174
country_id: 1814991
description:
Feb  6 15:47:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.210.134.9
country_id: 1814991
description:
2025-02-06 15:47:47 dovecot_plain authenticator failed for ([221.210.134.9]) [221.210.134.9]:38505: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.152.34.229
country_id: 1814991
description:
Feb  6 15:47:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.152.34.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.139.195
country_id: 1880251
description:
2025-02-06 15:48:02 dovecot_plain authenticator failed for ([175.156.139.195]) [175.156.139.195]:51706: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.11.25.195
country_id: 6252001
description:
2025-02-06 15:48:05 dovecot_plain authenticator failed for ([66.11.25.195]) [66.11.25.195]:49054: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.186.174.35
country_id: 1269750
description:
Feb  6 15:48:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.186.174.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.196.184.120
country_id: 6252001
description:
Feb  6 15:47:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.196.184.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.120
country_id: 6252001
description:
2025-02-06 15:47:36 dovecot_plain authenticator failed for ([74.196.184.120]) [74.196.184.120]:49334: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.210.134.9
country_id: 1814991
description:
Feb  6 15:47:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.210.134.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.254
country_id: 1668284
description:
2025-02-06 15:47:51 dovecot_plain authenticator failed for 111-70-23-254.emome-ip.hinet.net [111.70.23.254]:34640: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.6.109
country_id: 2017370
description:
2025-02-06 15:47:56 dovecot_plain authenticator failed for 95-31-6-109.static.corbina.ru [95.31.6.109]:55278: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-02-06 15:47:41 dovecot_login authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:62211: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
country_id: 2077456
description:
2025-02-06 15:48:17 dovecot_plain authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:36025: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.164.28
country_id: 1269750
description:
Feb  6 15:48:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.164.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.164.28
country_id: 1269750
description:
2025-02-06 15:48:29 dovecot_login authenticator failed for (abts-north-static-028.164.160.122.airtelbroadband.in) [122.160.164.28]:45018: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.84.89
country_id: 3469034
description:
Feb  6 15:48:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.84.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.102.61.21
country_id: 1814991
description:
Feb  6 15:48:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.102.61.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.61.21
country_id: 1814991
description:
2025-02-06 15:48:43 dovecot_plain authenticator failed for ([112.102.61.21]) [112.102.61.21]:57938: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.91.84.89
country_id: 3469034
description:
2025-02-06 15:48:43 dovecot_login authenticator failed for ([187.92.76.49]) [201.91.84.89]:48246: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.198.138.185
country_id: 1814991
description:
Feb  6 15:50:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.198.138.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.198.138.185
country_id: 1814991
description:
2025-02-06 15:50:03 dovecot_plain authenticator failed for ([120.198.138.185]) [120.198.138.185]:33771: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 54.238.102.131
country_id: 1861060
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-50.54.238.102.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.2.198
country_id: 1668284
description:
2025-02-06 15:50:15 dovecot_plain authenticator failed for 111-70-2-198.emome-ip.hinet.net [111.70.2.198]:33071: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.2.198
country_id: 1668284
description:
Feb  6 15:50:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.2.198 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.50.230.73
country_id: 3469034
description:
[2025-02-06 15:49:25 +0100] info [webmaild] 189.50.230.73 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-50.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
country_id: 99237
description:
Feb  6 15:51:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-02-06 15:51:07 dovecot_plain authenticator failed for (lacre) [65.20.205.197]:52334: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 15:51:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.163.116.221
country_id: 1210997
description:
[2025-02-06 15:50:26 +0100] info [webmaild] 103.163.116.221 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.175
country_id: 1269750
description:
2025-02-06 15:51:50 dovecot_plain authenticator failed for (nsg-corporate-175.229.187.122.airtel.in) [122.187.229.175]:41992: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.29
country_id: 1814991
description:
Feb  6 15:51:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.32.93
country_id: 6252001
description:
2025-02-06 15:52:03 dovecot_plain authenticator failed for ([158.140.32.93]) [158.140.32.93]:55910: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.145.108.234
country_id: 6251999
description:
2025-02-06 15:51:40 dovecot_plain authenticator failed for ([216.145.108.234]) [216.145.108.234]:45643: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.175
country_id: 1269750
description:
Feb  6 15:51:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.29
country_id: 1814991
description:
2025-02-06 15:51:56 dovecot_plain authenticator failed for ([117.175.160.29]) [117.175.160.29]:41194: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.241.15
country_id: 2017370
description:
2025-02-06 15:52:05 dovecot_plain authenticator failed for broadband-5-228-241-15.ip.moscow.rt.ru [5.228.241.15]:49738: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.145.108.234
country_id: 6251999
description:
Feb  6 15:51:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.145.108.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 15:51:51 ait sshd[1266370]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.32.93
country_id: 6252001
description:
Feb  6 15:52:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.32.93 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 15:51:51 ait sshd[1266370]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.241.15
country_id: 2017370
description:
Feb  6 15:52:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.241.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.241.232.14
country_id: 2921044
description:
Feb  6 15:51:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.241.232.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.126.212.27
country_id: 3469034
description:
[2025-02-06 15:51:31 +0100] info [webmaild] 189.126.212.27 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2025-02-06 15:51:33 dovecot_plain authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:53990: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
country_id: 3017382
description:
2025-02-06 15:52:43 dovecot_plain authenticator failed for (sempitery) [185.113.51.55]:44608: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.101.235.203
country_id: 1861060
description:
2025-02-06 15:52:44 dovecot_login authenticator failed for p101203-obmd01.tokyo.ocn.ne.jp [124.101.235.203]:54148: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.36.64.247
country_id: 3175395
description:
Feb  6 15:52:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.36.64.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.36.64.247
country_id: 3175395
description:
2025-02-06 15:52:53 dovecot_login authenticator failed for net-2-36-64-247.cust.vodafonedsl.it [2.36.64.247]:36191: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.86.20
country_id: 1512440
description:
[2025-02-06 15:52:28 +0100] info [webmaild] 213.230.86.20 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
country_id: 3017382
description:
Feb  6 15:52:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.101.235.203
country_id: 1861060
description:
Feb  6 15:52:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.101.235.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 15:52:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
country_id: 1269750
description:
2025-02-06 15:53:48 dovecot_login authenticator failed for ([49.249.76.221]) [49.249.76.221]:46842: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.222.63.135
country_id: 3469034
description:
[2025-02-06 15:53:51 +0100] info [webmaild] 191.222.63.135 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.118.53
country_id: 3865483
description:
Feb  6 15:53:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.118.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
country_id: 3865483
description:
2025-02-06 15:53:31 dovecot_login authenticator failed for ([167.250.118.53]) [167.250.118.53]:44943: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.249.76.221
country_id: 1269750
description:
Feb  6 15:53:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.249.76.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.214.166.82
country_id: 6252001
description:
Feb  6 15:53:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.214.166.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.166.82
country_id: 6252001
description:
2025-02-06 15:53:56 dovecot_login authenticator failed for (ADMIN) [181.214.166.82]:51880: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.22.46
country_id: 3469034
description:
Feb  6 15:54:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.22.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.167.241
country_id: 3469034
description:
Feb  6 15:54:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.167.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.22.46
country_id: 3469034
description:
2025-02-06 15:54:24 dovecot_login authenticator failed for (186-201-180-17.customer.tdatabrasil.net.br) [187.93.22.46]:51241: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.243.93
country_id: 2542007
description:
Feb  6 15:54:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.243.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.174.182.38
country_id: 2077456
description:
Feb  6 15:54:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.174.182.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2025-02-06 15:54:39 dovecot_login authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:33893: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.239.211.89
country_id: 690791
description:
[2025-02-06 15:54:41 +0100] info [webmaild] 188.239.211.89 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.70.166.51
country_id: 298795
description:
Feb  6 15:55:20 ait sshd[1267930]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.70.166.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.8.167.241
country_id: 3469034
description:
2025-02-06 15:54:26 dovecot_login authenticator failed for (186-201-10-10.customer.tdatabrasil.net.br) [177.8.167.241]:23711: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-02-06 15:54:37 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:56614: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.70.166.51
country_id: 298795
description:
Feb  6 15:55:20 ait sshd[1267930]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.70.166.51


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.172.156.150
country_id: 1269750
description:
Feb  6 15:55:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.172.156.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.115.76.186
country_id: 6252001
description:
Feb  6 15:55:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.115.76.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.172.156.150
country_id: 1269750
description:
2025-02-06 15:55:26 dovecot_plain authenticator failed for ([110.172.156.150]) [110.172.156.150]:51309: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.47.129.58
country_id: 587116
description:
[2025-02-06 15:55:45 +0100] info [webmaild] 212.47.129.58 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.115.76.186
country_id: 6252001
description:
2025-02-06 15:55:45 dovecot_plain authenticator failed for ool-45734cba.dyn.optonline.net [69.115.76.186]:47632: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.177.90.113
country_id: 2661886
description:
2025-02-06 15:56:44 dovecot_plain authenticator failed for c151-177-90-113.bredband.tele2.se (seure) [151.177.90.113]:34040: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-56.194.163.182.227


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.62.151.164
country_id: 99237
description:
[2025-02-06 15:56:39 +0100] info [webmaild] 5.62.151.164 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.177.90.113
country_id: 2661886
description:
Feb  6 15:56:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.177.90.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.70
country_id: 617790
description:
Feb  6 15:57:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.70
country_id: 617790
description:
2025-02-06 15:57:17 dovecot_plain authenticator failed for ([185.167.56.70]) [185.167.56.70]:52596: 535 Incorrect authentication data (set_id=admin@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.86.7.65
country_id: 1814991
description:
2025-02-06 15:57:29 dovecot_plain authenticator failed for ([218.86.7.65]) [218.86.7.65]:48187: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.208.238
country_id: 1814991
description:
2025-02-06 15:57:44 dovecot_login authenticator failed for ([221.195.208.238]) [221.195.208.238]:17926: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.233.134
country_id: 1814991
description:
Feb  6 15:58:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.233.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.233.134
country_id: 1814991
description:
2025-02-06 15:58:07 dovecot_login authenticator failed for ([27.45.233.134]) [27.45.233.134]:49106: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-58.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.86.7.65
country_id: 1814991
description:
Feb  6 15:57:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.86.7.65 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.69.53.232
country_id: 3865483
description:
[2025-02-06 15:57:50 +0100] info [webmaild] 200.69.53.232 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.64.54
country_id: 1814991
description:
Feb  6 15:58:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.64.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.64.54
country_id: 1814991
description:
2025-02-06 15:58:17 dovecot_plain authenticator failed for ([58.18.64.54]) [58.18.64.54]:42675: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.105.241.188
country_id: 298795
description:
Feb  6 15:58:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.105.241.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.195.208.238
country_id: 1814991
description:
Feb  6 15:57:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.195.208.238 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.13.7.199
country_id: 3686110
description:
[2025-02-06 15:58:40 +0100] info [webmaild] 179.13.7.199 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.239.171.226
country_id: 2017370
description:
Feb  6 15:58:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.239.171.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  6 15:58:43 ait sshd[1269406]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  6 15:58:43 ait sshd[1269406]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.171.226
country_id: 2017370
description:
2025-02-06 15:58:45 dovecot_plain authenticator failed for ([83.239.171.226]) [83.239.171.226]:56143: 535 Incorrect authentication data (set_id=ads20a00071y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.90.250
country_id: 1814991
description:
2025-02-06 15:58:35 dovecot_plain authenticator failed for ([58.18.90.250]) [58.18.90.250]:45427: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.90.250
country_id: 1814991
description:
Feb  6 15:58:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.90.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 15:58:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.241.188
country_id: 298795
description:
2025-02-06 15:58:27 dovecot_plain authenticator failed for ([85.105.241.188]) [85.105.241.188]:34420: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.41.223
country_id: 1269750
description:
Feb  6 15:59:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.41.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.41.223
country_id: 1269750
description:
2025-02-06 15:59:48 dovecot_login authenticator failed for (abts-mh-dynamic-223.41.169.122.airtelbroadband.in) [122.169.41.223]:59513: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.218.168.67
country_id: 3996063
description:
Feb  6 16:00:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.218.168.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
country_id: 3469034
description:
Feb  6 16:00:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.175.194.139
country_id: 6252001
description:
2025-02-06 16:00:19 dovecot_plain authenticator failed for syn-072-175-194-139.res.spectrum.com [72.175.194.139]:33496: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.69.242.122
country_id: 1814991
description:
Feb  6 15:59:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.69.242.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.245.222.217
country_id: 1835841
description:
Feb  6 15:59:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.245.222.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.245.222.217
country_id: 1835841
description:
2025-02-06 15:59:57 dovecot_plain authenticator failed for ([211.245.222.217]) [211.245.222.217]:61146: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.174.147
country_id: 2077456
description:
2025-02-06 16:00:04 dovecot_login authenticator failed for (unknown.bwdc.fsg.ordnance.co) [103.79.174.147]:55455: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.42.162
country_id: 6252001
description:
2025-02-06 15:59:54 dovecot_plain authenticator failed for c-73-95-42-162.hsd1.co.comcast.net [73.95.42.162]:32794: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.201.45
country_id: 1814991
description:
Feb  6 16:00:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.201.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.201.45
country_id: 1814991
description:
2025-02-06 16:00:04 dovecot_plain authenticator failed for (45.201.33.36.adsl-pool.ah.cnuninet.net) [36.33.201.45]:33296: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.218
country_id: 3865483
description:
2025-02-06 16:00:14 dovecot_login authenticator failed for (201-234-106-218.static.impsat.net.ar) [201.234.106.218]:40663: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.42.162
country_id: 6252001
description:
Feb  6 15:59:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.42.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.37.177.99
country_id: 6252001
description:
Feb  6 15:59:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.37.177.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.168.67
country_id: 3996063
description:
2025-02-06 16:00:24 dovecot_login authenticator failed for (189.218.168.67-clientes-izzi.mx) [189.218.168.67]:37587: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.140.240
country_id: 1814991
description:
Feb  6 15:59:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.140.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.174.147
country_id: 2077456
description:
Feb  6 16:00:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.174.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.234.106.218
country_id: 3865483
description:
Feb  6 16:00:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.234.106.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.163.174.112
country_id: 3469034
description:
[2025-02-06 16:00:07 +0100] info [webmaild] 45.163.174.112 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
country_id: 3469034
description:
2025-02-06 16:00:09 dovecot_login authenticator failed for (187-8-163-70.customer.tdatabrasil.net.br) [187.8.163.70]:37167: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.108.143.34
country_id: 1814991
description:
Feb  6 15:59:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.108.143.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.108.143.34
country_id: 1814991
description:
2025-02-06 15:59:46 dovecot_plain authenticator failed for ([218.108.143.34]) [218.108.143.34]:57576: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.175.194.139
country_id: 6252001
description:
Feb  6 16:00:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.175.194.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.37.177.99
country_id: 6252001
description:
2025-02-06 15:59:27 dovecot_plain authenticator failed for syn-047-037-177-099.res.spectrum.com [47.37.177.99]:55400: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.140.240
country_id: 1814991
description:
2025-02-06 15:59:38 dovecot_plain authenticator failed for ([111.48.140.240]) [111.48.140.240]:54644: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.69.242.122
country_id: 1814991
description:
2025-02-06 15:59:51 dovecot_login authenticator failed for ([101.69.242.122]) [101.69.242.122]:50101: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-02-06 16:00:33 dovecot_plain authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:51363: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-02-06 16:00:36 dovecot_plain authenticator failed for (cohnis) [102.53.15.17]:39756: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.54.251.236
country_id: 3469034
description:
[2025-02-06 16:01:02 +0100] info [webmaild] 177.54.251.236 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.92.248
country_id: 1269750
description:
Feb  6 16:01:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.92.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.151.142.219
country_id: 2661886
description:
Feb  6 16:00:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.151.142.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
country_id: 2017370
description:
2025-02-06 16:00:42 dovecot_plain authenticator failed for (12-78-123-185.host.cirex.ru) [185.123.78.13]:26483: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.151.142.219
country_id: 2661886
description:
2025-02-06 16:00:43 dovecot_plain authenticator failed for c188-151-142-219.bredband.tele2.se (procachene) [188.151.142.219]:46064: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.14.24.50
country_id: 2658434
description:
Feb  6 16:00:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.14.24.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
country_id: 2542007
description:
Feb  6 16:00:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
country_id: 2017370
description:
Feb  6 16:00:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.92.248
country_id: 1269750
description:
2025-02-06 16:01:22 dovecot_login authenticator failed for (106.51.92.248.actcorp.in) [106.51.92.248]:60426: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.1.239.146
country_id: 1814991
description:
Feb  6 16:00:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.1.239.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.239.146
country_id: 1814991
description:
2025-02-06 16:00:33 dovecot_plain authenticator failed for ([218.1.239.146]) [218.1.239.146]:58614: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.124.120
country_id: 1835841
description:
Feb  6 16:01:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.124.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2025-02-06 16:01:23 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:46092: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.129.92
country_id: 1814991
description:
2025-02-06 16:01:39 dovecot_login authenticator failed for ([111.53.129.92]) [111.53.129.92]:44656: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.232.39.165
country_id: 2510769
description:
Feb  6 16:01:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.232.39.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.129.92
country_id: 1814991
description:
Feb  6 16:01:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.129.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.202.94.224
country_id: 390903
description:
Feb  6 16:01:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.202.94.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.48.103
country_id: 1835841
description:
2025-02-06 16:01:39 dovecot_login authenticator failed for ([222.116.48.103]) [222.116.48.103]:35407: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.202.94.224
country_id: 390903
description:
2025-02-06 16:01:40 dovecot_login authenticator failed for o6z8xc.static.otenet.gr [87.202.94.224]:46784: 535 Incorrect authentication data (set_id=21m1150009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.134.10.18
country_id: 2017370
description:
Feb  6 16:02:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.134.10.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.232.39.165
country_id: 2510769
description:
2025-02-06 16:01:52 dovecot_login authenticator failed for ([185.232.39.165]) [185.232.39.165]:57796: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
country_id: 1562822
description:
Feb  6 16:01:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
country_id: 1562822
description:
2025-02-06 16:01:56 dovecot_plain authenticator failed for ([171.244.40.236]) [171.244.40.236]:46977: 535 Incorrect authentication data (set_id=eng20a00118y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.134.10.18
country_id: 2017370
description:
2025-02-06 16:02:13 dovecot_plain authenticator failed for (188x134x10x18.static-business.spb.ertelecom.ru) [188.134.10.18]:53888: 535 Incorrect authentication data (set_id=eng20a00118y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.116.48.103
country_id: 1835841
description:
Feb  6 16:01:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.116.48.103 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.197.21.73
country_id: 2017370
description:
[2025-02-06 16:03:20 +0100] info [webmaild] 91.197.21.73 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.93.172.127
country_id: 1562822
description:
Feb  6 16:03:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.93.172.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.255.112.6
country_id: 6252001
description:
Feb  6 16:03:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.255.112.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.222
country_id: 1819730
description:
Feb  6 16:03:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.222
country_id: 1819730
description:
2025-02-06 16:03:15 dovecot_login authenticator failed for (m121-202-205-222.smartone.com) [121.202.205.222]:14676: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.97.92.116
country_id: 272103
description:
[2025-02-06 16:02:28 +0100] info [webmaild] 185.97.92.116 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 185.220.100.240
country_id: 2921044
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:16-02.185.220.100.240


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-02-06 16:02:59 dovecot_login authenticator failed for ([216.194.174.103]) [216.194.174.27]:54151: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-02.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
country_id: 6252001
description:
Feb  6 16:02:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.148.43
country_id: 1835841
description:
2025-02-06 16:03:16 dovecot_login authenticator failed for ([183.109.148.43]) [183.109.148.43]:55208: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.148.43
country_id: 1835841
description:
Feb  6 16:03:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.148.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.93.172.127
country_id: 1562822
description:
2025-02-06 16:03:03 dovecot_login authenticator failed for (static.vinacis.com) [180.93.172.127]:41662: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.255.112.6
country_id: 6252001
description:
2025-02-06 16:03:11 dovecot_plain authenticator failed for 6.112.255.173.bc.googleusercontent.com [173.255.112.6]:39566: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 16:03:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.223.192.254
country_id: 3469034
description:
Feb  6 16:03:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.223.192.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.192.254
country_id: 3469034
description:
2025-02-06 16:03:33 dovecot_plain authenticator failed for ([200.223.192.254]) [200.223.192.254]:56277: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 16:04:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.233.110
country_id: 99237
description:
Feb  6 16:03:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.233.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-02-06 16:03:48 dovecot_plain authenticator failed for (triont) [65.20.233.110]:35007: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.83.9.138
country_id: 1269750
description:
Feb  6 16:05:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.83.9.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.9.138
country_id: 1269750
description:
2025-02-06 16:05:06 dovecot_plain authenticator failed for ([103.83.9.138]) [103.83.9.138]:50958: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.247
country_id: 1269750
description:
Feb  6 16:05:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
country_id: 1269750
description:
2025-02-06 16:05:20 dovecot_plain authenticator failed for (nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:59162: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.94.79.51
country_id: 3865483
description:
[2025-02-06 16:05:23 +0100] info [webmaild] 181.94.79.51 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.94.176.186
country_id: 3469034
description:
[2025-02-06 16:04:30 +0100] info [webmaild] 138.94.176.186 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.115.191.84
country_id: 1835841
description:
2025-02-06 16:06:10 dovecot_plain authenticator failed for ([211.115.191.84]) [211.115.191.84]:41967: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.18.71.134
country_id: 3469034
description:
Feb  6 16:05:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.18.71.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.18.71.134
country_id: 3469034
description:
2025-02-06 16:05:55 dovecot_plain authenticator failed for (20118071134.host.telemar.net.br) [201.18.71.134]:60889: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.115.191.84
country_id: 1835841
description:
Feb  6 16:06:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.115.191.84 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.81.179.31
country_id: 3469034
description:
[2025-02-06 16:06:47 +0100] info [webmaild] 170.81.179.31 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.174.142.78
country_id: 1814991
description:
Feb  6 16:07:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.174.142.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 16:07:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.247.207.98
country_id: 1814991
description:
2025-02-06 16:07:05 dovecot_plain authenticator failed for ([114.247.207.98]) [114.247.207.98]:45230: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.174.142.78
country_id: 1814991
description:
2025-02-06 16:07:19 dovecot_plain authenticator failed for ([222.174.142.78]) [222.174.142.78]:42594: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
country_id: 2077456
description:
Feb  6 16:07:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
country_id: 2077456
description:
2025-02-06 16:07:26 dovecot_plain authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:36720: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.42.226.215
country_id: 1814991
description:
Feb  6 16:07:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.42.226.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 16:07:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.236.141.106
country_id: 290291
description:
Feb  6 16:07:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.236.141.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.207.241.168
country_id: 2245662
description:
Feb  6 16:08:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.207.241.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
country_id: 1835841
description:
2025-02-06 16:08:20 dovecot_login authenticator failed for ([211.109.75.67]) [211.109.75.69]:52373: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 194.44.99.255
country_id: 690791
description:
[2025-02-06 16:07:37 +0100] info [webmaild] 194.44.99.255 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.42.226.215
country_id: 1814991
description:
2025-02-06 16:07:46 dovecot_plain authenticator failed for ([58.42.226.215]) [58.42.226.215]:55669: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.241.168
country_id: 2245662
description:
2025-02-06 16:08:10 dovecot_login authenticator failed for ([196.207.241.168]) [196.207.241.168]:40127: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
country_id: 1835841
description:
Feb  6 16:08:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.236.141.106
country_id: 290291
description:
2025-02-06 16:07:48 dovecot_plain authenticator failed for ([87.236.141.106]) [87.236.141.106]:57636: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.34.242.144
country_id: 2963597
description:
2025-02-06 16:09:17 dovecot_login authenticator failed for (ADMIN) [149.34.242.144]:47924: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.108.165
country_id: 1814991
description:
Feb  6 16:08:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.108.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
country_id: 3469034
description:
2025-02-06 16:09:25 dovecot_plain authenticator failed for (corporativo.gvt.net.br) [189.115.93.183]:41073: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.139
country_id: 1835841
description:
Feb  6 16:09:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.26.221.92
country_id: 1269750
description:
2025-02-06 16:09:17 dovecot_login authenticator failed for (ADMIN) [23.26.221.92]:36486: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 123.253.65.179
country_id: 1210997
description:
[2025-02-06 16:09:26 +0100] info [webmaild] 123.253.65.179 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.94.128.230
country_id: 3469034
description:
[2025-02-06 16:08:29 +0100] info [webmaild] 187.94.128.230 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.70.94.155
country_id: 1814991
description:
2025-02-06 16:08:30 dovecot_plain authenticator failed for ([117.70.94.155]) [117.70.94.155]:42232: 535 Incorrect authentication data (set_id=eng18a00033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.139
country_id: 1835841
description:
2025-02-06 16:09:12 dovecot_plain authenticator failed for ([61.108.83.254]) [61.108.83.139]:47749: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.93.183
country_id: 3469034
description:
Feb  6 16:09:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.93.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.70.94.155
country_id: 1814991
description:
Feb  6 16:08:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.70.94.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.108.165
country_id: 1814991
description:
2025-02-06 16:08:43 dovecot_plain authenticator failed for ([116.116.108.165]) [116.116.108.165]:46054: 535 Incorrect authentication data (set_id=eng18a00033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.73.71
country_id: 1814991
description:
Feb  6 16:10:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.73.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.73.71
country_id: 1814991
description:
2025-02-06 16:10:09 dovecot_plain authenticator failed for ([218.21.73.71]) [218.21.73.71]:37713: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.129.92
country_id: 1814991
description:
Feb  6 16:10:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.129.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.50.67.114
country_id: 3469034
description:
Feb  6 16:10:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.50.67.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.76.194.159
country_id: 6252001
description:
Feb  6 16:09:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.76.194.159 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-09.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.147.184
country_id: 3469034
description:
2025-02-06 16:10:06 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.147.184]:36630: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 16:10:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.129.92
country_id: 1814991
description:
2025-02-06 16:10:22 dovecot_plain authenticator failed for ([111.53.129.92]) [111.53.129.92]:55278: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-02-06 16:09:52 dovecot_plain authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:40661: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.147.184
country_id: 3469034
description:
Feb  6 16:10:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.147.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.72.156
country_id: 2017370
description:
Feb  6 16:10:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.72.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.246.89.195
country_id: 1814991
description:
Feb  6 16:11:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.246.89.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.100.181
country_id: 2017370
description:
Feb  6 16:11:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.100.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.111.59.146
country_id: 6252001
description:
2025-02-06 16:10:42 dovecot_plain authenticator failed for ([75.111.59.146]) [75.111.59.146]:36552: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.200.139
country_id: 6251999
description:
2025-02-06 16:11:16 dovecot_plain authenticator failed for 198-91-200-139.cpe.distributel.net [198.91.200.139]:52324: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.239.100.3
country_id: 99237
description:
[2025-02-06 16:11:02 +0100] info [webmaild] 37.239.100.3 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.122
country_id: 2077456
description:
2025-02-06 16:11:03 dovecot_login authenticator failed for ([103.79.175.122]) [103.79.175.122]:52459: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.122
country_id: 2077456
description:
Feb  6 16:11:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.100.181
country_id: 2017370
description:
2025-02-06 16:11:02 dovecot_plain authenticator failed for ([37.204.100.181]) [37.204.100.181]:59228: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.241.253
country_id: 2017370
description:
2025-02-06 16:11:11 dovecot_login authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:59694: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.72.156
country_id: 2017370
description:
2025-02-06 16:10:32 dovecot_plain authenticator failed for ([95.165.72.156]) [95.165.72.156]:34392: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.241.253
country_id: 2017370
description:
Feb  6 16:11:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.241.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.200.139
country_id: 6251999
description:
Feb  6 16:11:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.200.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.111.59.146
country_id: 6252001
description:
Feb  6 16:10:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.111.59.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.246.89.195
country_id: 1814991
description:
2025-02-06 16:11:22 dovecot_plain authenticator failed for ([183.246.89.195]) [183.246.89.195]:39072: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.67.114
country_id: 3469034
description:
2025-02-06 16:10:27 dovecot_plain authenticator failed for (187-93-74-213.customer.tdatabrasil.net.br) [187.50.67.114]:39088: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.20
country_id: 1269750
description:
2025-02-06 16:10:36 dovecot_plain authenticator failed for ([103.190.91.20]) [103.190.91.20]:34408: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
country_id: 1269750
description:
2025-02-06 16:10:57 dovecot_plain authenticator failed for ([59.96.62.29]) [59.96.62.29]:39638: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.20
country_id: 1269750
description:
Feb  6 16:10:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.96.62.29
country_id: 1269750
description:
Feb  6 16:10:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.96.62.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.166.68.184
country_id: 2017370
description:
Feb  6 16:11:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.166.68.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.145.27.1
country_id: 1643084
description:
Feb  6 16:11:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.145.27.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.82.33
country_id: 290557
description:
Feb  6 16:12:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.82.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.4.150
country_id: 1814991
description:
2025-02-06 16:12:04 dovecot_plain authenticator failed for ([222.180.4.150]) [222.180.4.150]:36775: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.171.84.113
country_id: 298795
description:
[2025-02-06 16:11:52 +0100] info [webmaild] 78.171.84.113 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.63.175
country_id: 1814991
description:
Feb  6 16:12:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.63.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.63.175
country_id: 1814991
description:
2025-02-06 16:12:13 dovecot_plain authenticator failed for ([182.135.63.175]) [182.135.63.175]:52533: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.127.16.197
country_id: 798544
description:
2025-02-06 16:12:20 dovecot_plain authenticator failed for ip-188-127-16-197.ennet.pl [188.127.16.197]:56982: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.31.47.232
country_id: 6252001
description:
Feb  6 16:11:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.31.47.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.4.150
country_id: 1814991
description:
Feb  6 16:12:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.4.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
country_id: 3017382
description:
2025-02-06 16:11:36 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (gresembs) [51.255.84.180]:43558: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.166.68.184
country_id: 2017370
description:
2025-02-06 16:11:50 dovecot_plain authenticator failed for (5x166x68x184.dynamic.barnaul.ertelecom.ru) [5.166.68.184]:52604: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.193.37.116
country_id: 1835841
description:
2025-02-06 16:11:54 dovecot_plain authenticator failed for ([211.193.37.116]) [211.193.37.116]:37088: 535 Incorrect authentication data (set_id=eng20b00167y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.69.115.74
country_id: 1814991
description:
Feb  6 16:11:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.69.115.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.247.88
country_id: 1814991
description:
Feb  6 16:12:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.247.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.31.47.232
country_id: 6252001
description:
2025-02-06 16:11:56 dovecot_plain authenticator failed for syn-065-031-047-232.res.spectrum.com [65.31.47.232]:40138: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.247.88
country_id: 1814991
description:
2025-02-06 16:12:10 dovecot_plain authenticator failed for ([183.220.247.88]) [183.220.247.88]:39116: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.127.16.197
country_id: 798544
description:
Feb  6 16:12:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.127.16.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
country_id: 3017382
description:
Feb  6 16:11:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.69.115.74
country_id: 1814991
description:
2025-02-06 16:11:43 dovecot_plain authenticator failed for ([218.69.115.74]) [218.69.115.74]:34483: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.193.37.116
country_id: 1835841
description:
Feb  6 16:11:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.193.37.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.145.27.1
country_id: 1643084
description:
2025-02-06 16:11:54 dovecot_plain authenticator failed for ([103.145.27.106]) [103.145.27.1]:45782: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.82.33
country_id: 290557
description:
2025-02-06 16:12:04 dovecot_plain authenticator failed for ([94.205.82.33]) [94.205.82.33]:37073: 535 Incorrect authentication data (set_id=eng20b00167y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.196.174.235
country_id: 1814991
description:
Feb  6 16:13:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.196.174.235 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-13.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.6.102.11
country_id: 1814991
description:
Feb  6 16:12:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.6.102.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.145.108.234
country_id: 6251999
description:
2025-02-06 16:12:43 dovecot_plain authenticator failed for ([216.145.108.234]) [216.145.108.234]:39495: 535 Incorrect authentication data (set_id=amadam)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.145.108.234
country_id: 6251999
description:
Feb  6 16:12:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.145.108.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.153.85.132
country_id: 102358
description:
Feb  6 16:12:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.153.85.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
country_id: 2661886
description:
Feb  6 16:13:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.66.41.130
country_id: 2510769
description:
Feb  6 16:13:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.66.41.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.66.41.130
country_id: 2510769
description:
2025-02-06 16:13:04 dovecot_login authenticator failed for 130.pool207-66-41.dynamic.orange.es [207.66.41.130]:49129: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.241.188
country_id: 298795
description:
2025-02-06 16:13:14 dovecot_login authenticator failed for ([85.105.241.188]) [85.105.241.188]:43810: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.105.241.188
country_id: 298795
description:
Feb  6 16:13:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.105.241.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.224.89.112
country_id: 690791
description:
2025-02-06 16:12:53 dovecot_login authenticator failed for (112.89.224.159.triolan.net) [159.224.89.112]:35017: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.86.6
country_id: 2017370
description:
2025-02-06 16:12:53 dovecot_plain authenticator failed for ([188.168.86.6]) [188.168.86.6]:60230: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.196.174.235
country_id: 1814991
description:
2025-02-06 16:13:06 dovecot_login authenticator failed for ([183.196.174.235]) [183.196.174.235]:20687: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
country_id: 2661886
description:
2025-02-06 16:13:02 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:44334: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.74.50.6
country_id: 933860
description:
[2025-02-06 16:12:46 +0100] info [webmaild] 41.74.50.6 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.153.85.132
country_id: 102358
description:
2025-02-06 16:12:35 dovecot_plain authenticator failed for ([46.153.85.132]) [46.153.85.132]:52584: 535 Incorrect authentication data (set_id=amadam@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.102.11
country_id: 1814991
description:
2025-02-06 16:12:45 dovecot_plain authenticator failed for ([183.6.102.11]) [183.6.102.11]:56912: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.86.6
country_id: 2017370
description:
Feb  6 16:12:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.86.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.224.89.112
country_id: 690791
description:
Feb  6 16:12:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.224.89.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 132.148.77.70
country_id: 6252001
description:
Feb  6 16:13:53 ait sshd[1276869]: pam_imunify(sshd:auth): [IM360_RBL] The IP 132.148.77.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.70.158.32
country_id: 1814991
description:
2025-02-06 16:13:56 dovecot_login authenticator failed for ([1.70.158.32]) [1.70.158.32]:47766: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.104.137.177
country_id: 2921044
description:
Feb  6 16:13:56 ait sshd[1276895]: pam_imunify(sshd:auth): [IM360_RBL] The IP 172.104.137.177 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 172.104.137.177
country_id: 2921044
description:
Feb  6 16:13:56 ait sshd[1276895]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.104.137.177  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.240.49.222
country_id: 6252001
description:
Feb  6 16:14:23 ait sshd[1276978]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.240.49.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.200.239
country_id: 6252001
description:
Feb  6 16:13:40 ait sshd[1276790]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.178.200.239 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.178.167.35
country_id: 6252001
description:
Feb  6 16:14:19 ait sshd[1276958]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.178.167.35  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.178.200.239
country_id: 6252001
description:
Feb  6 16:13:40 ait sshd[1276790]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.178.200.239  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 132.148.77.70
country_id: 6252001
description:
Feb  6 16:13:53 ait sshd[1276869]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.148.77.70  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
country_id: 6252001
description:
Feb  6 16:14:11 ait sshd[1276939]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.203.23.172
country_id: 6251999
description:
Feb  6 16:14:21 ait sshd[1276966]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.23.172  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
country_id: 6252001
description:
Feb  6 16:14:11 ait sshd[1276939]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.62.227.127
country_id: 2750405
description:
Feb  6 16:14:14 ait sshd[1276950]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.62.227.127  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.103.231
country_id: 6252001
description:
Feb  6 16:14:14 ait sshd[1276948]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.103.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.105.246.224
country_id: 2017370
description:
Feb  6 16:14:23 ait sshd[1276980]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.105.246.224 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.105.246.224
country_id: 2017370
description:
Feb  6 16:14:23 ait sshd[1276980]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.105.246.224  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.253.28.238
country_id: 1835841
description:
Feb  6 16:13:30 ait sshd[1276570]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.253.28.238 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.103.231
country_id: 6252001
description:
Feb  6 16:14:14 ait sshd[1276948]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.103.231  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.131.163.41
country_id: 6252001
description:
Feb  6 16:14:19 ait sshd[1276960]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.131.163.41 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.253.28.238
country_id: 1835841
description:
Feb  6 16:13:30 ait sshd[1276570]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.253.28.238  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.70.158.32
country_id: 1814991
description:
Feb  6 16:13:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.70.158.32 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 138.68.99.33
country_id: 2921044
description:
Feb  6 16:14:09 ait sshd[1276935]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.99.33  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.167.35
country_id: 6252001
description:
Feb  6 16:14:19 ait sshd[1276958]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.178.167.35 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.131.163.41
country_id: 6252001
description:
Feb  6 16:14:19 ait sshd[1276960]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.163.41  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.244.88
country_id: 2921044
description:
Feb  6 16:13:32 ait sshd[1276694]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.244.88 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.244.88
country_id: 2921044
description:
Feb  6 16:13:32 ait sshd[1276694]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.244.88  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.68.99.33
country_id: 2921044
description:
Feb  6 16:14:09 ait sshd[1276935]: pam_imunify(sshd:auth): [IM360_RBL] The IP 138.68.99.33 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.248.27.95
country_id: 2921044
description:
Feb  6 16:14:11 ait sshd[1276941]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.27.95  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.212.51.184
country_id: 630336
description:
[2025-02-06 16:13:39 +0100] info [webmaild] 37.212.51.184 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 206.123.153.249
country_id: 798549
description:
[2025-02-06 16:13:48 +0100] info [cpaneld] 206.123.153.249 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.248.27.95
country_id: 2921044
description:
Feb  6 16:14:11 ait sshd[1276941]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.248.27.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.62.227.127
country_id: 2750405
description:
Feb  6 16:14:14 ait sshd[1276950]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.62.227.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.23.172
country_id: 6251999
description:
Feb  6 16:14:21 ait sshd[1276966]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.203.23.172 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.240.49.222
country_id: 6252001
description:
Feb  6 16:14:23 ait sshd[1276978]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.240.49.222  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.22.214.214
country_id: 1269750
description:
Feb  6 16:14:24 ait sshd[1276986]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.214.214  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.189.47.166
country_id: 1880251
description:
Feb  6 16:14:38 ait sshd[1277182]: pam_imunify(sshd:auth): [IM360_RBL] The IP 206.189.47.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 206.189.47.166
country_id: 1880251
description:
Feb  6 16:14:38 ait sshd[1277182]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.47.166  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.97.219.60
country_id: 1269750
description:
Feb  6 16:14:39 ait sshd[1277188]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.97.219.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.138.27.5
country_id: 1880251
description:
Feb  6 16:15:10 ait sshd[1277497]: pam_imunify(sshd:auth): [IM360_RBL] The IP 174.138.27.5 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.171.21.192
country_id: 1562822
description:
Feb  6 16:15:16 ait sshd[1277552]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.171.21.192  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.46.239
country_id: 1269750
description:
2025-02-06 16:14:36 dovecot_login authenticator failed for (abts-north-static-239.46.176.122.airtelbroadband.in) [122.176.46.239]:38822: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.29.235.66
country_id: 1605651
description:
Feb  6 16:14:40 ait sshd[1277190]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.29.235.66  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.249.193
country_id: 1819730
description:
2025-02-06 16:14:57 dovecot_plain authenticator failed for ([210.177.249.193]) [210.177.249.193]:54787: 535 Incorrect authentication data (set_id=ads20b00288y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.242.170.10
country_id: 1036973
description:
Feb  6 16:15:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.242.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.153.68.238
country_id: 1562822
description:
Feb  6 16:15:09 ait sshd[1277493]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.153.68.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.171.21.192
country_id: 1562822
description:
Feb  6 16:15:16 ait sshd[1277552]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.171.21.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.176.46.239
country_id: 1269750
description:
Feb  6 16:14:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.176.46.239 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.65.0.30
country_id: 1880251
description:
Feb  6 16:14:48 ait sshd[1277239]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.0.30  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.216.119.13
country_id: 1835841
description:
Feb  6 16:14:48 ait sshd[1277235]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.216.119.13  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.240.121.228
country_id: 1819730
description:
Feb  6 16:14:35 ait sshd[1277173]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.240.121.228  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2025-02-06 16:15:06 dovecot_plain authenticator failed for ([197.242.170.10]) [197.242.170.10]:57390: 535 Incorrect authentication data (set_id=ads20b00288y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.189.72.148
country_id: 1819730
description:
Feb  6 16:15:21 ait sshd[1277566]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.189.72.148  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 16:15:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.177.249.193
country_id: 1819730
description:
Feb  6 16:14:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.177.249.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.237.178.130
country_id: 3996063
description:
Feb  6 16:14:55 ait sshd[1277283]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.237.178.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.212.235.151
country_id: 1562822
description:
Feb  6 16:15:23 ait sshd[1277576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.212.235.151  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.96.43.215
country_id: 1562822
description:
Feb  6 16:14:52 ait sshd[1277264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.43.215  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.97.219.60
country_id: 1269750
description:
Feb  6 16:14:39 ait sshd[1277188]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.97.219.60  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.217.229
country_id: 614540
description:
Feb  6 16:14:39 ait sshd[1277193]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.217.229  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.237.178.130
country_id: 3996063
description:
Feb  6 16:14:55 ait sshd[1277283]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.237.178.130  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.130.219.128
country_id: 1562822
description:
Feb  6 16:15:08 ait sshd[1277479]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.130.219.128  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.63.225
country_id: 1880251
description:
Feb  6 16:14:58 ait sshd[1277310]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.63.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.22.214.214
country_id: 1269750
description:
Feb  6 16:14:24 ait sshd[1276986]: pam_imunify(sshd:auth): [IM360_RBL] The IP 165.22.214.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.130.219.128
country_id: 1562822
description:
Feb  6 16:15:08 ait sshd[1277479]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.130.219.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.96.43.25
country_id: 1562822
description:
Feb  6 16:15:23 ait sshd[1277570]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.96.43.25 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.157.107.67
country_id: 2921044
description:
Feb  6 16:14:24 ait sshd[1276998]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.157.107.67  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.216.119.13
country_id: 1835841
description:
Feb  6 16:14:48 ait sshd[1277235]: pam_imunify(sshd:auth): [IM360_RBL] The IP 118.216.119.13 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.63.225
country_id: 1880251
description:
Feb  6 16:14:58 ait sshd[1277310]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.63.225  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.157.107.67
country_id: 2921044
description:
Feb  6 16:14:24 ait sshd[1276998]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.157.107.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.240.121.228
country_id: 1819730
description:
Feb  6 16:14:35 ait sshd[1277173]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.240.121.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.248.149.139
country_id: 1880251
description:
Feb  6 16:14:56 ait sshd[1277287]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.149.139  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.29.235.66
country_id: 1605651
description:
Feb  6 16:14:40 ait sshd[1277190]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.29.235.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.0.30
country_id: 1880251
description:
Feb  6 16:14:48 ait sshd[1277239]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.65.0.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.235.151
country_id: 1562822
description:
Feb  6 16:15:23 ait sshd[1277576]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.212.235.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.217.229
country_id: 614540
description:
Feb  6 16:14:39 ait sshd[1277193]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.217.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.144.60.123
country_id: 6252001
description:
Feb  6 16:15:01 ait sshd[1277323]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.144.60.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.96.43.215
country_id: 1562822
description:
Feb  6 16:14:52 ait sshd[1277264]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.96.43.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.144.60.123
country_id: 6252001
description:
Feb  6 16:15:01 ait sshd[1277323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.144.60.123  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 174.138.27.5
country_id: 1880251
description:
Feb  6 16:15:10 ait sshd[1277497]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.138.27.5  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.96.43.25
country_id: 1562822
description:
Feb  6 16:15:23 ait sshd[1277570]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.43.25  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.248.149.139
country_id: 1880251
description:
Feb  6 16:14:56 ait sshd[1277287]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.248.149.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.219.27.178
country_id: 953987
description:
[2025-02-06 16:15:04 +0100] info [webmaild] 102.219.27.178 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.153.68.238
country_id: 1562822
description:
Feb  6 16:15:09 ait sshd[1277493]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.153.68.238  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.189.72.148
country_id: 1819730
description:
Feb  6 16:15:21 ait sshd[1277566]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.189.72.148 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.127.67.83
country_id: 2077456
description:
Feb  6 16:15:52 ait sshd[1277962]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.67.83  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.160.45.26
country_id: 1814991
description:
Feb  6 16:16:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.160.45.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.160.45.26
country_id: 1814991
description:
2025-02-06 16:16:16 dovecot_plain authenticator failed for ([124.160.45.26]) [124.160.45.26]:40278: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 5.183.209.179
country_id: 2750405
description:
Feb  6 16:16:05 ait sshd[1278023]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.183.209.179


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
country_id: 1835841
description:
Feb  6 16:16:23 ait sshd[1278115]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 185.221.182.197
country_id: 3017382
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:wadminw||WPU:wadminw||RSV:6.65||T:APACHE||MV:16-16.185.221.182.197


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.127.68.180
country_id: 2077456
description:
Feb  6 16:16:00 ait sshd[1277998]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.127.68.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.104
country_id: 1835841
description:
Feb  6 16:16:14 ait sshd[1278061]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.104
country_id: 1835841
description:
Feb  6 16:16:14 ait sshd[1278061]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.104  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.127.67.83
country_id: 2077456
description:
Feb  6 16:15:52 ait sshd[1277962]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.127.67.83 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.127.68.180
country_id: 2077456
description:
Feb  6 16:16:00 ait sshd[1277998]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.68.180  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.148.197.119
country_id: 2750405
description:
Feb  6 16:15:27 ait sshd[1277611]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.148.197.119  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.183.167.41
country_id: 1605651
description:
Feb  6 16:15:42 ait sshd[1277808]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.183.167.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.183.209.179
country_id: 2750405
description:
Feb  6 16:16:05 ait sshd[1278023]: pam_imunify(sshd:auth): [IM360_RBL] The IP 5.183.209.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.148.197.119
country_id: 2750405
description:
Feb  6 16:15:27 ait sshd[1277611]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.148.197.119 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.183.167.41
country_id: 1605651
description:
Feb  6 16:15:42 ait sshd[1277808]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.183.167.41  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
country_id: 1835841
description:
Feb  6 16:16:23 ait sshd[1278115]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.40.152.24
country_id: 2017370
description:
[2025-02-06 16:15:53 +0100] info [webmaild] 31.40.152.24 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.72.12
country_id: 1814991
description:
2025-02-06 16:17:19 dovecot_plain authenticator failed for ([120.236.72.12]) [120.236.72.12]:54939: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.71.199.46
country_id: 1814991
description:
2025-02-06 16:16:37 dovecot_plain authenticator failed for ([120.71.199.46]) [120.71.199.46]:38581: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.247.181.220
country_id: 1269750
description:
Feb  6 16:17:17 ait sshd[1278659]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.247.181.220  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.112.141.230
country_id: 2750405
description:
Feb  6 16:16:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.112.141.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.112.141.230
country_id: 2750405
description:
2025-02-06 16:16:50 dovecot_plain authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:44288: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.72.12
country_id: 1814991
description:
Feb  6 16:17:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.72.12 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-17.194.163.182.227


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.97.17.101
country_id: 3625428
description:
[2025-02-06 16:16:47 +0100] info [webmaild] 191.97.17.101 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.181.220
country_id: 1269750
description:
Feb  6 16:17:17 ait sshd[1278659]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.247.181.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.71.199.46
country_id: 1814991
description:
Feb  6 16:16:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.71.199.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.85.4.21
country_id: 2017370
description:
[2025-02-06 16:17:40 +0100] info [webmaild] 78.85.4.21 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.39.191.14
country_id: 6251999
description:
Feb  6 16:18:15 ait sshd[1279148]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.191.14


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.39.191.14
country_id: 6251999
description:
Feb  6 16:18:15 ait sshd[1279148]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.39.191.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.193.45
country_id: 6252001
description:
2025-02-06 16:18:49 dovecot_plain authenticator failed for syn-208-105-193-045.biz.spectrum.com [208.105.193.45]:43345: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.222.190.70
country_id: 1522867
description:
Feb  6 16:19:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.222.190.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.222.190.70
country_id: 1522867
description:
2025-02-06 16:19:02 dovecot_plain authenticator failed for (client.fttb.2day.kz) [176.222.190.70]:35374: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 172.205.203.246
country_id: 2750405
description:
Feb  6 16:18:34 ait sshd[1279254]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.205.203.246


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.29.232.113
country_id: 1605651
description:
Feb  6 16:18:38 ait sshd[1279265]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.29.232.113 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.29.232.113
country_id: 1605651
description:
Feb  6 16:18:38 ait sshd[1279265]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.29.232.113  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.202.5.157
country_id: 3469034
description:
[2025-02-06 16:19:22 +0100] info [webmaild] 143.202.5.157 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.205.203.246
country_id: 2750405
description:
Feb  6 16:18:34 ait sshd[1279254]: pam_imunify(sshd:auth): [IM360_RBL] The IP 172.205.203.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.193.45
country_id: 6252001
description:
Feb  6 16:18:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.193.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.224.198
country_id: 99237
description:
Feb  6 16:20:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.224.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
country_id: 1831722
description:
Feb  6 16:20:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.175.11.47
country_id: 6252001
description:
Feb  6 16:19:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.175.11.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.124.120
country_id: 1835841
description:
Feb  6 16:19:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.124.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
country_id: 1835841
description:
Feb  6 16:19:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 193.32.126.220
country_id: 3017382
domain: gvu.titopen.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:gvu_admin||WPU:gvu_admin||RSV:6.65||T:APACHE||MV:16-20.193.32.126.220


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.153.146
country_id: 99237
description:
Feb  6 16:19:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.153.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.60.35
country_id: 1835841
description:
Feb  6 16:19:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.60.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.200.188.170
country_id: 290557
description:
Feb  6 16:19:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.200.188.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.222.166.212
country_id: 2077456
description:
Feb  6 16:20:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.222.166.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Feb  6 16:20:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.114.23.234
country_id: 1210997
description:
[2025-02-06 16:20:13 +0100] info [webmaild] 103.114.23.234 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-02-06 16:20:26 dovecot_plain authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:52926: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.82.102
country_id: 3017382
description:
Feb  6 16:20:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.82.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 16:20:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.73.5
country_id: 99237
description:
[2025-02-06 16:21:09 +0100] info [webmaild] 169.224.73.5 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
country_id: 1562822
description:
Feb  6 16:21:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.82.102
country_id: 3017382
description:
2025-02-06 16:20:34 dovecot_plain authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:35884: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.105.3.221
country_id: 1835841
description:
Feb  6 16:20:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.105.3.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.105.3.221
country_id: 1835841
description:
2025-02-06 16:20:40 dovecot_login authenticator failed for ([183.105.3.221]) [183.105.3.221]:42744: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.96.99.199
country_id: 3175395
description:
Feb  6 16:20:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.96.99.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.96.99.199
country_id: 3175395
description:
2025-02-06 16:20:55 dovecot_login authenticator failed for 89-96-99-199.ip11.fastwebnet.it [89.96.99.199]:65215: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.48.118.55
country_id: 1814991
description:
2025-02-06 16:22:07 dovecot_plain authenticator failed for ([42.48.118.55]) [42.48.118.55]:43163: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.187.66
country_id: 1814991
description:
Feb  6 16:22:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.187.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.191.122.40
country_id: 1168579
description:
[2025-02-06 16:22:05 +0100] info [webmaild] 103.191.122.40 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.84.11.180
country_id: 1861060
description:
Feb  6 16:21:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.84.11.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.10
country_id: 2077456
description:
2025-02-06 16:21:56 dovecot_plain authenticator failed for ([203.189.124.10]) [203.189.124.10]:59400: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
country_id: 1814991
description:
2025-02-06 16:22:16 dovecot_plain authenticator failed for ([218.22.187.67]) [218.22.187.66]:32909: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.10
country_id: 2077456
description:
Feb  6 16:21:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.48.118.55
country_id: 1814991
description:
Feb  6 16:22:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.48.118.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
country_id: 2017370
description:
Feb  6 16:22:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
country_id: 2017370
description:
2025-02-06 16:22:08 dovecot_plain authenticator failed for ([88.87.84.104]) [88.87.84.104]:59539: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.84.11.180
country_id: 1861060
description:
2025-02-06 16:21:52 dovecot_plain authenticator failed for ([59.84.11.180]) [59.84.11.180]:37962: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.2.110
country_id: 3469034
description:
Feb  6 16:22:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.2.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2025-02-06 16:23:02 dovecot_login authenticator failed for ([121.159.71.249]) [121.159.71.249]:45042: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.126.247
country_id: 1835841
description:
2025-02-06 16:23:03 dovecot_login authenticator failed for ([112.172.126.247]) [112.172.126.247]:50259: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.98.28.43
country_id: 1269750
description:
Feb  6 16:23:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.98.28.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.73
country_id: 6252001
description:
Feb  6 16:23:16 ait sshd[1281603]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.107.168.206
country_id: 1269750
description:
Feb  6 16:23:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.107.168.206 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-23.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.171.89.199
country_id: 1835841
description:
2025-02-06 16:22:30 dovecot_plain authenticator failed for ([223.171.89.199]) [223.171.89.199]:34410: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.178.165.251
country_id: 1835841
description:
Feb  6 16:22:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.178.165.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.165.251
country_id: 1835841
description:
2025-02-06 16:22:50 dovecot_plain authenticator failed for ([211.178.165.251]) [211.178.165.251]:47741: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.90.122.188
country_id: 3374766
description:
Feb  6 16:23:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.90.122.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.14.31.158
country_id: 3017382
description:
Feb  6 16:23:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.14.31.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.89.199
country_id: 1835841
description:
Feb  6 16:22:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.89.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.88.252.16
country_id: 1814991
description:
2025-02-06 16:23:13 dovecot_login authenticator failed for ([39.88.252.16]) [39.88.252.16]:40538: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.106.136.195
country_id: 298795
description:
[2025-02-06 16:23:16 +0100] info [webmaild] 85.106.136.195 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-02-06 16:23:19 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:55226: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.73
country_id: 6252001
description:
Feb  6 16:23:16 ait sshd[1281603]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.107.168.206
country_id: 1269750
description:
2025-02-06 16:23:19 dovecot_plain authenticator failed for ([27.107.168.206]) [27.107.168.206]:48844: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.2.110
country_id: 3469034
description:
2025-02-06 16:22:29 dovecot_plain authenticator failed for ([187.12.2.110]) [187.12.2.110]:56901: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.159.71.249
country_id: 1835841
description:
Feb  6 16:23:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.159.71.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.126.247
country_id: 1835841
description:
Feb  6 16:23:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.126.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.88.252.16
country_id: 1814991
description:
Feb  6 16:23:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.88.252.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.36.42
country_id: 1819730
description:
Feb  6 16:23:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.36.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
country_id: 3017382
description:
2025-02-06 16:23:26 dovecot_plain authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr (unsonin) [80.14.31.158]:56428: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2025-02-06 16:23:28 dovecot_plain authenticator failed for 042.36.246.220.static.netvigator.com [220.246.36.42]:55685: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.19.117
country_id: 1835841
description:
2025-02-06 16:23:47 dovecot_plain authenticator failed for ([222.116.19.117]) [222.116.19.117]:55501: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.99
country_id: 3865483
description:
2025-02-06 16:23:49 dovecot_login authenticator failed for (ADMIN) [146.70.38.99]:42446: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.116.19.117
country_id: 1835841
description:
Feb  6 16:23:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.116.19.117 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.99.184.218
country_id: 3865483
description:
[2025-02-06 16:24:08 +0100] info [webmaild] 138.99.184.218 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.221.130.246
country_id: 1835841
description:
2025-02-06 16:24:25 dovecot_plain authenticator failed for ([211.221.130.246]) [211.221.130.246]:35324: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 16:24:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.67.28
country_id: 6252001
description:
2025-02-06 16:24:15 dovecot_login authenticator failed for (ADMIN) [191.96.67.28]:53932: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.90.43
country_id: 1814991
description:
Feb  6 16:23:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.90.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.90.43
country_id: 1814991
description:
2025-02-06 16:23:30 dovecot_plain authenticator failed for ([39.174.90.43]) [39.174.90.43]:49587: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.221.130.246
country_id: 1835841
description:
Feb  6 16:24:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.221.130.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.177.106
country_id: 2275384
description:
2025-02-06 16:24:38 dovecot_plain authenticator failed for ([196.250.177.106]) [196.250.177.106]:46581: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.234
country_id: 1814991
description:
2025-02-06 16:24:42 dovecot_plain authenticator failed for ([116.114.84.234]) [116.114.84.234]:55613: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.128.78
country_id: 99237
description:
Feb  6 16:24:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.128.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.7
country_id: 1819730
description:
2025-02-06 16:24:53 dovecot_plain authenticator failed for 007.46.246.220.static.netvigator.com [220.246.46.7]:49850: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.112.159
country_id: 2661886
description:
2025-02-06 16:24:33 dovecot_plain authenticator failed for 46-162-112-159.cust.bredband2.com [46.162.112.159]:51516: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 16:24:39 ait sshd[1282010]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.3.72
country_id: 1668284
description:
Feb  6 16:25:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.3.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.3.72
country_id: 1668284
description:
2025-02-06 16:25:23 dovecot_plain authenticator failed for ([101.13.3.72]) [101.13.3.72]:54902: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.128.78
country_id: 99237
description:
2025-02-06 16:24:50 dovecot_plain authenticator failed for ([65.20.128.78]) [65.20.128.78]:60896: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 16:25:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 16:24:39 ait sshd[1282010]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.46.7
country_id: 1819730
description:
Feb  6 16:24:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.46.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.214.49.98
country_id: 2245662
description:
[2025-02-06 16:25:23 +0100] info [webmaild] 41.214.49.98 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.223.155
country_id: 1835841
description:
2025-02-06 16:25:08 dovecot_plain authenticator failed for ([222.114.223.155]) [222.114.223.155]:50113: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.28.77.206
country_id: 1814991
description:
Feb  6 16:25:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.28.77.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.112.159
country_id: 2661886
description:
Feb  6 16:24:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.112.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.177.106
country_id: 2275384
description:
Feb  6 16:24:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.177.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.234
country_id: 1814991
description:
Feb  6 16:24:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.77.206
country_id: 1814991
description:
2025-02-06 16:25:09 dovecot_plain authenticator failed for (pc0.zz.ha.cn) [218.28.77.206]:42133: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.176.7.54
country_id: 2464461
description:
[2025-02-06 16:26:16 +0100] info [webmaild] 196.176.7.54 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.227.2.181
country_id: 1814991
description:
Feb  6 16:25:34 ait sshd[1282616]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.227.2.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
country_id: 1269750
description:
2025-02-06 16:25:46 dovecot_plain authenticator failed for ([49.249.76.221]) [49.249.76.221]:50234: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.66.153.194
country_id: 2017370
description:
Feb  6 16:25:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.66.153.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.66.153.194
country_id: 2017370
description:
2025-02-06 16:25:55 dovecot_plain authenticator failed for ([95.66.153.194]) [95.66.153.194]:41741: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.0.126.91
country_id: 3865483
description:
2025-02-06 16:25:28 dovecot_plain authenticator failed for 190-0-126-91.sanluisctv.com.ar [190.0.126.91]:49136: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.227.2.181
country_id: 1814991
description:
Feb  6 16:25:34 ait sshd[1282616]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.227.2.181  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.249.76.221
country_id: 1269750
description:
Feb  6 16:25:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.249.76.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.176.57
country_id: 1814991
description:
Feb  6 16:27:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.176.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.176.57
country_id: 1814991
description:
2025-02-06 16:27:15 dovecot_plain authenticator failed for ([39.152.176.57]) [39.152.176.57]:51420: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.135.77.211
country_id: 1210997
description:
[2025-02-06 16:27:21 +0100] info [webmaild] 103.135.77.211 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.70.158
country_id: 3469034
description:
Feb  6 16:27:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.70.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.207.112.45
country_id: 1835841
description:
Feb  6 16:26:45 ait sshd[1282965]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.207.112.45 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.207.112.45
country_id: 1835841
description:
Feb  6 16:26:45 ait sshd[1282965]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.207.112.45


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.35
country_id: 1835841
description:
Feb  6 16:26:46 ait sshd[1282969]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.70.158
country_id: 3469034
description:
2025-02-06 16:27:13 dovecot_plain authenticator failed for ([200.151.70.158]) [200.151.70.158]:49646: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.35
country_id: 1835841
description:
Feb  6 16:26:46 ait sshd[1282969]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.35  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.17.90.246
country_id: 6252001
description:
Feb  6 16:27:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.17.90.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.17.90.246
country_id: 6252001
description:
2025-02-06 16:27:33 dovecot_plain authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:50214: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.165.222
country_id: 1814991
description:
Feb  6 16:27:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.165.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 16:27:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.165.222
country_id: 1814991
description:
2025-02-06 16:27:35 dovecot_plain authenticator failed for ([183.247.165.222]) [183.247.165.222]:53878: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
country_id: 6252001
description:
Feb  6 16:27:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
country_id: 6252001
description:
2025-02-06 16:27:47 dovecot_plain authenticator failed for ([96.79.174.131]) [96.79.174.131]:34376: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.227
country_id: 1819730
description:
Feb  6 16:27:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-02-06 16:27:29 dovecot_plain authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:49334: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.250.232.153
country_id: 3469034
description:
[2025-02-06 16:28:10 +0100] info [webmaild] 152.250.232.153 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.255.208
country_id: 2542007
description:
Feb  6 16:28:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.255.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
country_id: 2661886
description:
Feb  6 16:28:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-28.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.235.94
country_id: 1835841
description:
Feb  6 16:28:31 ait sshd[1283855]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.235.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.73.48.210
country_id: 1814991
description:
Feb  6 16:28:42 ait sshd[1283882]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.73.48.210 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.73.48.210
country_id: 1814991
description:
Feb  6 16:28:42 ait sshd[1283882]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.73.48.210  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-02-06 16:28:51 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (demian) [81.225.30.107]:56639: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.184.212.168
country_id: 6252001
description:
Feb  6 16:29:21 ait sshd[1284147]: pam_imunify(sshd:auth): [IM360_RBL] The IP 137.184.212.168 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
country_id: 1835841
description:
Feb  6 16:28:31 ait sshd[1283855]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-02-06 16:28:48 dovecot_plain authenticator failed for (tonthcria) [154.144.255.208]:56968: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 137.184.212.168
country_id: 6252001
description:
Feb  6 16:29:21 ait sshd[1284147]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.184.212.168


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-29.194.163.182.227


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.157.159
country_id: 6251999
description:
Feb  6 16:29:40 ait sshd[1284215]: pam_imunify(sshd:auth): [IM360_RBL] The IP 142.93.157.159 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 129.21.205.4
country_id: 6252001
description:
Feb  6 16:29:49 ait sshd[1284338]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.21.205.4


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.22.255.28
country_id: 1814991
description:
Feb  6 16:30:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.22.255.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.30.149.167
country_id: 2510769
description:
Feb  6 16:29:32 ait sshd[1284193]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.30.149.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.145.163.164
country_id: 1814991
description:
Feb  6 16:29:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.145.163.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.94.74.150
country_id: 1149361
description:
Feb  6 16:29:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.94.74.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.47
country_id: 1819730
description:
Feb  6 16:29:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.47 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.30.149.167
country_id: 2510769
description:
Feb  6 16:29:32 ait sshd[1284193]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.30.149.167


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.22.255.28
country_id: 1814991
description:
2025-02-06 16:30:11 dovecot_plain authenticator failed for ([58.22.255.28]) [58.22.255.28]:56724: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.21.205.4
country_id: 6252001
description:
Feb  6 16:29:49 ait sshd[1284338]: pam_imunify(sshd:auth): [IM360_RBL] The IP 129.21.205.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.6.102.11
country_id: 1814991
description:
Feb  6 16:30:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.6.102.11 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.254.136.116
country_id: 3017382
description:
Feb  6 16:30:12 ait sshd[1284667]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.136.116  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.183.180.108
country_id: 1814991
description:
2025-02-06 16:29:49 dovecot_plain authenticator failed for ([118.183.180.108]) [118.183.180.108]:25578: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 147.182.154.40
country_id: 6251999
description:
Feb  6 16:29:40 ait sshd[1284213]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.182.154.40


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.163.164
country_id: 1814991
description:
2025-02-06 16:29:49 dovecot_plain authenticator failed for ([61.145.163.164]) [61.145.163.164]:53724: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.93
country_id: 1819730
description:
Feb  6 16:30:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.29.196.170
country_id: 6252001
description:
Feb  6 16:30:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.29.196.170 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.231.203.199
country_id: 3469034
description:
[2025-02-06 16:29:30 +0100] info [webmaild] 45.231.203.199 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.29.196.170
country_id: 6252001
description:
2025-02-06 16:30:14 dovecot_plain authenticator failed for ([71.29.196.170]) [71.29.196.170]:33904: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 142.93.157.159
country_id: 6251999
description:
Feb  6 16:29:40 ait sshd[1284215]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.157.159


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.183.180.108
country_id: 1814991
description:
Feb  6 16:29:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.183.180.108 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 142.93.158.240
country_id: 6251999
description:
Feb  6 16:29:50 ait sshd[1284373]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.158.240


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.35.155.182
country_id: 2017370
description:
2025-02-06 16:29:57 dovecot_plain authenticator failed for (dsl-178-35-155-182.avtlg.ru) [178.35.155.182]:50534: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.124.10.62
country_id: 6252001
description:
2025-02-06 16:30:06 dovecot_plain authenticator failed for ool-457c0a3e.dyn.optonline.net [69.124.10.62]:49706: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.182.154.40
country_id: 6251999
description:
Feb  6 16:29:40 ait sshd[1284213]: pam_imunify(sshd:auth): [IM360_RBL] The IP 147.182.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.71.8
country_id: 1522867
description:
2025-02-06 16:29:45 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:43269: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.35.155.182
country_id: 2017370
description:
Feb  6 16:29:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.35.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.150
country_id: 1149361
description:
2025-02-06 16:30:00 dovecot_plain authenticator failed for ([180.94.74.150]) [180.94.74.150]:54568: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.151.71.8
country_id: 1522867
description:
Feb  6 16:29:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.151.71.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.43.35
country_id: 2395170
description:
2025-02-06 16:29:48 dovecot_plain authenticator failed for ([154.127.43.35]) [154.127.43.35]:36083: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.47
country_id: 1819730
description:
2025-02-06 16:29:48 dovecot_plain authenticator failed for (m121-202-155-47.smartone.com) [121.202.155.47]:23440: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.185.228.242
country_id: 1814991
description:
2025-02-06 16:30:04 dovecot_plain authenticator failed for ([39.185.228.242]) [39.185.228.242]:55452: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.114.61.50
country_id: 2750405
description:
Feb  6 16:29:26 ait sshd[1284153]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.114.61.50  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.102.11
country_id: 1814991
description:
2025-02-06 16:30:02 dovecot_plain authenticator failed for ([183.6.102.11]) [183.6.102.11]:40090: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.124.10.62
country_id: 6252001
description:
Feb  6 16:30:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.124.10.62 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 193.32.126.220
country_id: 3017382
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:RubyO||WPU:RubyO||RSV:6.65||T:APACHE||MV:16-29.193.32.126.220


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.43.35
country_id: 2395170
description:
Feb  6 16:29:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.43.35 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.163.200.249
country_id: 3469034
description:
[2025-02-06 16:30:23 +0100] info [webmaild] 45.163.200.249 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.158.240
country_id: 6251999
description:
Feb  6 16:29:50 ait sshd[1284373]: pam_imunify(sshd:auth): [IM360_RBL] The IP 142.93.158.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.185.228.242
country_id: 1814991
description:
Feb  6 16:30:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.185.228.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.93
country_id: 1819730
description:
2025-02-06 16:30:02 dovecot_plain authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:64338: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.114.61.50
country_id: 2750405
description:
Feb  6 16:29:26 ait sshd[1284153]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.114.61.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.129.195
country_id: 6251999
description:
Feb  6 16:31:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.129.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.154.90.47
country_id: 1835841
description:
Feb  6 16:31:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.154.90.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.190
country_id: 1269750
description:
Feb  6 16:31:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.234.245.7
country_id: 2017370
description:
2025-02-06 16:31:07 dovecot_plain authenticator failed for (net245.234.188-7.ertelecom.ru) [188.234.245.7]:57164: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.216.117
country_id: 1210997
description:
2025-02-06 16:31:14 dovecot_plain authenticator failed for ([103.148.216.98]) [103.148.216.117]:56536: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.124.94
country_id: 1880251
description:
2025-02-06 16:31:14 dovecot_plain authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:52335: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.152.249
country_id: 3469034
description:
Feb  6 16:31:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.152.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.127.16.197
country_id: 798544
description:
2025-02-06 16:31:19 dovecot_plain authenticator failed for ip-188-127-16-197.ennet.pl [188.127.16.197]:54750: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-02-06 16:31:08 dovecot_plain authenticator failed for ([50.188.204.213]) [50.188.204.213]:55542: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.27
country_id: 1814991
description:
Feb  6 16:31:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
country_id: 1835841
description:
2025-02-06 16:31:13 dovecot_plain authenticator failed for ([121.134.31.193]) [121.134.31.193]:44340: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.70.28
country_id: 1835841
description:
Feb  6 16:31:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.70.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.226.81
country_id: 1835841
description:
2025-02-06 16:31:13 dovecot_plain authenticator failed for ([121.189.226.81]) [121.189.226.81]:52576: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.47
country_id: 1835841
description:
2025-02-06 16:31:23 dovecot_plain authenticator failed for ([121.154.90.47]) [121.154.90.47]:56928: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.80.2
country_id: 1814991
description:
2025-02-06 16:31:18 dovecot_plain authenticator failed for ([1.28.80.2]) [1.28.80.2]:41790: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.120.67.149
country_id: 732800
description:
2025-02-06 16:31:19 dovecot_plain authenticator failed for ([87.120.67.149]) [87.120.67.149]:34077: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.131.46.146
country_id: 1814991
description:
Feb  6 16:31:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.131.46.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.79
country_id: 1819730
description:
2025-02-06 16:31:10 dovecot_plain authenticator failed for (m121-202-155-79.smartone.com) [121.202.155.79]:59246: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.131.46.146
country_id: 1814991
description:
2025-02-06 16:31:12 dovecot_plain authenticator failed for ([61.131.46.146]) [61.131.46.146]:41112: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.123.175.194
country_id: 1814991
description:
2025-02-06 16:31:12 dovecot_plain authenticator failed for ([183.56.179.201]) [119.123.175.194]:6096: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.199.58.173
country_id: 6251999
description:
Feb  6 16:31:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.199.58.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.231.102.189
country_id: 6252001
description:
Feb  6 16:31:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.231.102.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.28.26.250
country_id: 3469034
description:
2025-02-06 16:31:09 dovecot_plain authenticator failed for (201-28-26-250.customer.tdatabrasil.net.br) [201.28.26.250]:33172: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.226.81
country_id: 1835841
description:
Feb  6 16:31:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.226.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.152.119.174
country_id: 1835841
description:
2025-02-06 16:31:13 dovecot_plain authenticator failed for ([121.152.119.174]) [121.152.119.174]:49826: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.99.36.130
country_id: 6251999
description:
Feb  6 16:31:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.99.36.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
country_id: 1814991
description:
Feb  6 16:31:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.8.106
country_id: 1814991
description:
Feb  6 16:31:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.8.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.52.202.92
country_id: 1814991
description:
2025-02-06 16:31:22 dovecot_plain authenticator failed for ([123.52.202.92]) [123.52.202.92]:60606: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.188.204.213
country_id: 6252001
description:
Feb  6 16:31:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.188.204.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.21.102.172
country_id: 1668284
description:
2025-02-06 16:31:11 dovecot_plain authenticator failed for 211-21-102-172.hinet-ip.hinet.net [211.21.102.172]:45518: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
country_id: 1562822
description:
2025-02-06 16:31:12 dovecot_plain authenticator failed for ([171.244.40.228]) [171.244.40.236]:38164: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.234
country_id: 1814991
description:
2025-02-06 16:31:17 dovecot_plain authenticator failed for ([116.114.84.234]) [116.114.84.234]:60534: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
country_id: 2017370
description:
2025-02-06 16:31:21 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:52344: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.79.232.38
country_id: 1269750
description:
2025-02-06 16:31:23 dovecot_plain authenticator failed for ([142.79.232.38]) [142.79.232.38]:55315: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.139
country_id: 1835841
description:
Feb  6 16:30:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.220.33
country_id: 1269750
description:
Feb  6 16:31:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.220.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
country_id: 3895114
description:
2025-02-06 16:31:10 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:53777: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.129.195
country_id: 6251999
description:
2025-02-06 16:31:18 dovecot_plain authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:36536: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.6.43.236
country_id: 1814991
description:
Feb  6 16:31:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.6.43.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.192.94
country_id: 3469034
description:
2025-02-06 16:31:25 dovecot_plain authenticator failed for 186-247-192-94.user.veloxzone.com.br ([179.236.122.153]) [186.247.192.94]:39184: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.71.109
country_id: 1835841
description:
2025-02-06 16:31:11 dovecot_plain authenticator failed for ([112.168.71.109]) [112.168.71.109]:38878: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.73
country_id: 6252001
description:
Feb  6 16:31:11 ait sshd[1285220]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.134.126.162
country_id: 6252001
description:
2025-02-06 16:31:14 dovecot_plain authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:4212: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.97
country_id: 99237
description:
Feb  6 16:31:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.142.238
country_id: 1269750
description:
2025-02-06 16:31:10 dovecot_plain authenticator failed for ([114.143.224.97]) [182.156.142.238]:19975: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.148.216.117
country_id: 1210997
description:
Feb  6 16:31:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.148.216.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.235.126
country_id: 1814991
description:
2025-02-06 16:31:13 dovecot_plain authenticator failed for ([220.189.235.126]) [220.189.235.126]:48387: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.112.154.174
country_id: 1269750
description:
2025-02-06 16:31:25 dovecot_plain authenticator failed for ([203.112.154.174]) [203.112.154.174]:60696: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
country_id: 1269750
description:
2025-02-06 16:31:09 dovecot_plain authenticator failed for ([106.51.120.94]) [106.51.220.33]:28446: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.108.165
country_id: 1814991
description:
Feb  6 16:31:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.108.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.120.67.149
country_id: 732800
description:
Feb  6 16:31:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.120.67.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.231.102.189
country_id: 6252001
description:
2025-02-06 16:31:10 dovecot_plain authenticator failed for ([73.231.102.189]) [73.231.102.189]:59144: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.249
country_id: 3469034
description:
2025-02-06 16:31:16 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.152.249]:36339: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-02-06 16:31:22 dovecot_plain authenticator failed for ([195.222.57.190]) [195.222.57.190]:60516: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.194.38.121
country_id: 3175395
description:
2025-02-06 16:31:08 dovecot_plain authenticator failed for ([2.194.38.121]) [2.194.38.121]:53642: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
country_id: 1814991
description:
2025-02-06 16:31:09 dovecot_plain authenticator failed for ([218.98.160.117]) [218.98.160.117]:27124: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.134.31.193
country_id: 1835841
description:
Feb  6 16:31:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.134.31.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.52.202.92
country_id: 1814991
description:
Feb  6 16:31:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.52.202.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.103.74
country_id: 1668284
description:
2025-02-06 16:31:24 dovecot_plain authenticator failed for 110-25-103-74.adsl.fetnet.net [110.25.103.74]:47566: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.216.164
country_id: 1814991
description:
2025-02-06 16:30:44 dovecot_plain authenticator failed for ([183.237.216.164]) [183.237.216.164]:51329: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.179.85.98
country_id: 1269750
description:
Feb  6 16:31:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.179.85.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
country_id: 3277605
description:
Feb  6 16:31:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.123.175.194
country_id: 1814991
description:
Feb  6 16:31:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.123.175.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.162.227
country_id: 2017370
description:
2025-02-06 16:31:24 dovecot_plain authenticator failed for broadband-178-140-162-227.ip.moscow.rt.ru [178.140.162.227]:51878: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.80.2
country_id: 1814991
description:
Feb  6 16:31:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.80.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.99.36.130
country_id: 6251999
description:
2025-02-06 16:31:17 dovecot_plain authenticator failed for ([50.99.36.130]) [50.99.36.130]:33538: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.113.10
country_id: 1814991
description:
Feb  6 16:31:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.42.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
country_id: 1562822
description:
Feb  6 16:31:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.70.28
country_id: 1835841
description:
2025-02-06 16:31:12 dovecot_plain authenticator failed for ([110.34.70.28]) [110.34.70.28]:48663: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.135.250.242
country_id: 6252001
description:
2025-02-06 16:31:13 dovecot_login authenticator failed for syn-035-135-250-242.res.spectrum.com [35.135.250.242]:40638: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.159.57.4
country_id: 1814991
description:
Feb  6 16:31:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.159.57.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.133.50
country_id: 2413451
description:
2025-02-06 16:31:16 dovecot_plain authenticator failed for ([197.231.133.50]) [197.231.133.50]:48806: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.16.4
country_id: 298795
description:
2025-02-06 16:31:22 dovecot_plain authenticator failed for ([149.0.16.4]) [149.0.16.4]:60144: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.199.58.173
country_id: 6251999
description:
2025-02-06 16:31:25 dovecot_plain authenticator failed for ([192.199.58.173]) [192.199.58.173]:33389: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
country_id: 1814991
description:
Feb  6 16:31:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.91.178.253
country_id: 1835841
description:
2025-02-06 16:31:11 dovecot_plain authenticator failed for ([111.91.178.253]) [111.91.178.253]:60262: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.124.94
country_id: 1880251
description:
Feb  6 16:31:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.124.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.216.164
country_id: 1814991
description:
Feb  6 16:30:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.216.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.179.85.98
country_id: 1269750
description:
2025-02-06 16:31:21 dovecot_plain authenticator failed for ([202.179.85.98]) [202.179.85.98]:12994: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.8.106
country_id: 1814991
description:
2025-02-06 16:31:24 dovecot_plain authenticator failed for ([58.16.8.106]) [58.16.8.106]:49070: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.134.126.162
country_id: 6252001
description:
Feb  6 16:31:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.134.126.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.112.154.174
country_id: 1269750
description:
Feb  6 16:31:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.112.154.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.172.79.206
country_id: 1835841
description:
Feb  6 16:31:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.172.79.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.51.129.5
country_id: 6252001
description:
Feb  6 16:31:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.51.129.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.51.129.5
country_id: 6252001
description:
2025-02-06 16:31:10 dovecot_plain authenticator failed for 206-51-129-5.nktelco.net [206.51.129.5]:35482: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.231.133.50
country_id: 2413451
description:
Feb  6 16:31:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.231.133.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.28.26.250
country_id: 3469034
description:
Feb  6 16:31:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.28.26.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.27
country_id: 1814991
description:
2025-02-06 16:31:13 dovecot_plain authenticator failed for ([182.135.66.27]) [182.135.66.27]:36628: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.219.254
country_id: 1814991
description:
Feb  6 16:31:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.219.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
country_id: 99237
description:
2025-02-06 16:31:16 dovecot_plain authenticator failed for ([65.20.191.97]) [65.20.191.97]:42945: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.16.4
country_id: 298795
description:
Feb  6 16:31:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.16.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.167.55.230
country_id: 933860
description:
Feb  6 16:30:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.167.55.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.217.2.45
country_id: 597427
description:
Feb  6 16:31:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.217.2.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.59.2
country_id: 6252001
description:
Feb  6 16:31:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.59.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
country_id: 1814991
description:
Feb  6 16:31:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.59.2
country_id: 6252001
description:
2025-02-06 16:31:24 dovecot_plain authenticator failed for syn-074-062-059-002.biz.spectrum.com [74.62.59.2]:60067: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.194.38.121
country_id: 3175395
description:
Feb  6 16:31:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.194.38.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.43.236
country_id: 1814991
description:
2025-02-06 16:31:23 dovecot_plain authenticator failed for ([183.6.43.236]) [183.6.43.236]:55798: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.127.16.197
country_id: 798544
description:
Feb  6 16:31:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.127.16.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
country_id: 1269750
description:
2025-02-06 16:31:09 dovecot_plain authenticator failed for ([115.245.172.214]) [115.245.172.214]:39018: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.91.178.253
country_id: 1835841
description:
Feb  6 16:31:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.91.178.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.235.126
country_id: 1814991
description:
Feb  6 16:31:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.235.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.73
country_id: 6252001
description:
Feb  6 16:31:11 ait sshd[1285220]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-02-06 16:31:14 dovecot_plain authenticator failed for ([102.88.10.10]) [102.88.10.10]:52602: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
country_id: 933860
description:
2025-02-06 16:31:00 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:59036: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.168.71.109
country_id: 1835841
description:
Feb  6 16:31:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.168.71.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.135.250.242
country_id: 6252001
description:
Feb  6 16:31:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.135.250.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.245.172.214
country_id: 1269750
description:
Feb  6 16:31:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.245.172.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.152.119.174
country_id: 1835841
description:
Feb  6 16:31:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.152.119.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.57.4
country_id: 1814991
description:
2025-02-06 16:31:15 dovecot_plain authenticator failed for ([219.159.57.4]) [219.159.57.4]:38340: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.139
country_id: 1835841
description:
2025-02-06 16:30:30 dovecot_plain authenticator failed for ([61.108.83.254]) [61.108.83.139]:34761: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.88.10.10
country_id: 2328926
description:
Feb  6 16:31:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.88.10.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
country_id: 3895114
description:
Feb  6 16:31:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.21.102.172
country_id: 1668284
description:
Feb  6 16:31:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.21.102.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.190
country_id: 1269750
description:
2025-02-06 16:31:25 dovecot_plain authenticator failed for (nsg-corporate-190.227.187.122.airtel.in) [122.187.227.190]:55597: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.234.245.7
country_id: 2017370
description:
Feb  6 16:31:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.234.245.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.217.2.45
country_id: 597427
description:
2025-02-06 16:31:06 dovecot_plain authenticator failed for static-193-217-2-45.cust.tele2.lt [193.217.2.45]:41891: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.156.142.238
country_id: 1269750
description:
Feb  6 16:31:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.156.142.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.172.79.206
country_id: 1835841
description:
2025-02-06 16:31:18 dovecot_plain authenticator failed for ([211.172.79.206]) [211.172.79.206]:51426: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.103.74
country_id: 1668284
description:
Feb  6 16:31:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.192.94
country_id: 3469034
description:
Feb  6 16:31:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.192.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.108.165
country_id: 1814991
description:
2025-02-06 16:31:12 dovecot_plain authenticator failed for ([116.116.108.165]) [116.116.108.165]:36030: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.234
country_id: 1814991
description:
Feb  6 16:31:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.219.254
country_id: 1814991
description:
2025-02-06 16:31:16 dovecot_plain authenticator failed for ([124.115.219.254]) [124.115.219.254]:47452: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.142.39.13
country_id: 1835841
description:
Feb  6 16:31:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.142.39.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.79.232.38
country_id: 1269750
description:
Feb  6 16:31:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.79.232.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.162.227
country_id: 2017370
description:
Feb  6 16:31:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.162.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
country_id: 1814991
description:
2025-02-06 16:31:24 dovecot_plain authenticator failed for ([222.92.61.242]) [222.92.61.242]:44530: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.79
country_id: 1819730
description:
Feb  6 16:31:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
country_id: 2017370
description:
Feb  6 16:31:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.18.118
country_id: 1880251
description:
47.128.18.118 - - [06/Feb/2025:16:31:21 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13961101 HTTP/2.0" 302 0 mail.ait-edu.us "https://mail.ait-edu.us/prospective.php?mode=1&fees" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.18.118


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.76
country_id: 298795
description:
2025-02-06 16:32:24 dovecot_plain authenticator failed for ([95.0.252.76]) [95.0.252.76]:49382: 535 Incorrect authentication data (set_id=abs20a00063y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.236.111.18
country_id: 1819730
description:
2025-02-06 16:31:29 dovecot_plain authenticator failed for ([156.236.111.18]) [156.236.111.18]:59928: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.151.51.223
country_id: 798544
description:
2025-02-06 16:31:30 dovecot_plain authenticator failed for customer-ip-193-151-51-223.ipv.net.pl [193.151.51.223]:50702: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.88.252.16
country_id: 1814991
description:
Feb  6 16:31:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.88.252.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.16.156.103
country_id: 6252001
description:
Feb  6 16:31:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.16.156.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-02-06 16:31:27 dovecot_plain authenticator failed for ([216.194.174.103]) [216.194.174.27]:40041: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 16:31:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.151.51.223
country_id: 798544
description:
Feb  6 16:31:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.151.51.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.24.154.232
country_id: 2510769
description:
Feb  6 16:31:30 ait sshd[1285348]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.24.154.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.161.226.88
country_id: 3996063
description:
Feb  6 16:31:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.161.226.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.226.88
country_id: 3996063
description:
2025-02-06 16:31:29 dovecot_plain authenticator failed for (187.161.226.88-clientes-izzi.mx) [187.161.226.88]:40887: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-02-06 16:31:31 dovecot_plain authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:53558: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.78.179.108
country_id: 1835841
description:
2025-02-06 16:31:49 dovecot_plain authenticator failed for ([220.78.179.108]) [220.78.179.108]:42499: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.140.176.170
country_id: 1814991
description:
2025-02-06 16:31:28 dovecot_plain authenticator failed for ([219.140.176.170]) [219.140.176.170]:54101: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.158.248.248
country_id: 2921044
description:
2025-02-06 16:31:41 dovecot_plain authenticator failed for ([193.158.248.248]) [193.158.248.248]:47946: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.24
country_id: 1819730
description:
2025-02-06 16:31:35 dovecot_plain authenticator failed for ([121.202.152.24]) [121.202.152.24]:5739: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.145.142.243
country_id: 1269750
description:
Feb  6 16:31:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.145.142.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.95.114.242
country_id: 3469034
description:
Feb  6 16:31:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.95.114.242 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 204.10.194.42
country_id: 2921044
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads20b00359y||WPU:ads20b00359y||RSV:6.65||T:APACHE||MV:16-32.204.10.194.42


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.95.23.226
country_id: 1835841
description:
Feb  6 16:32:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.95.23.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.24
country_id: 1819730
description:
Feb  6 16:31:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.95.23.226
country_id: 1835841
description:
2025-02-06 16:32:24 dovecot_login authenticator failed for ([115.95.23.226]) [115.95.23.226]:39554: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
country_id: 6252001
description:
Feb  6 16:31:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.81.14.113
country_id: 3469034
description:
Feb  6 16:31:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.81.14.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.129.195
country_id: 6251999
description:
2025-02-06 16:31:29 dovecot_plain authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:37024: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.23.103
country_id: 1835841
description:
2025-02-06 16:31:30 dovecot_plain authenticator failed for ([115.23.23.103]) [115.23.23.103]:54082: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.12.170.68
country_id: 3895114
description:
[2025-02-06 16:32:25 +0100] info [webmaild] 190.12.170.68 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
country_id: 2017370
description:
2025-02-06 16:31:34 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:52346: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.78.179.108
country_id: 1835841
description:
Feb  6 16:31:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.78.179.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
country_id: 6252001
description:
2025-02-06 16:32:07 dovecot_plain authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:49863: 535 Incorrect authentication data (set_id=abs20a00063y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.233.24
country_id: 1835841
description:
2025-02-06 16:31:31 dovecot_plain authenticator failed for ([175.207.233.24]) [175.207.233.24]:37506: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.73
country_id: 1819730
description:
2025-02-06 16:31:38 dovecot_plain authenticator failed for (m121-202-155-73.smartone.com) [121.202.155.73]:22867: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.24.154.232
country_id: 2510769
description:
Feb  6 16:31:30 ait sshd[1285348]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.24.154.232  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.26.65.51
country_id: 1814991
description:
2025-02-06 16:31:30 dovecot_plain authenticator failed for ([112.26.65.51]) [112.26.65.51]:37349: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.35
country_id: 1814991
description:
Feb  6 16:31:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
country_id: 1814991
description:
2025-02-06 16:31:42 dovecot_plain authenticator failed for ([114.242.61.19]) [114.242.61.35]:41202: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.140.176.170
country_id: 1814991
description:
Feb  6 16:31:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.140.176.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.236.111.18
country_id: 1819730
description:
Feb  6 16:31:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.236.111.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.253.226
country_id: 1269750
description:
Feb  6 16:31:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.253.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.132.238.43
country_id: 6252001
description:
Feb  6 16:31:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.132.238.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.88.252.16
country_id: 1814991
description:
2025-02-06 16:31:41 dovecot_plain authenticator failed for ([39.88.252.16]) [39.88.252.16]:34852: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.76
country_id: 298795
description:
Feb  6 16:32:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.26.65.51
country_id: 1814991
description:
Feb  6 16:31:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.26.65.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.207.233.24
country_id: 1835841
description:
Feb  6 16:31:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.207.233.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.134.239.97
country_id: 1814991
description:
2025-02-06 16:31:32 dovecot_plain authenticator failed for ([182.134.239.97]) [182.134.239.97]:53564: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.248.211.38
country_id: 1814991
description:
2025-02-06 16:31:32 dovecot_plain authenticator failed for ([183.71.251.66]) [113.248.211.38]:46191: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.134.239.97
country_id: 1814991
description:
Feb  6 16:31:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.134.239.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
country_id: 1269750
description:
2025-02-06 16:31:38 dovecot_plain authenticator failed for ([203.145.142.243]) [203.145.142.243]:60302: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.35.66.243
country_id: 6252001
description:
Feb  6 16:31:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 4.35.66.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.35.66.243
country_id: 6252001
description:
2025-02-06 16:31:57 dovecot_plain authenticator failed for ([4.35.66.243]) [4.35.66.243]:42248: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2025-02-06 16:31:29 dovecot_plain authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:34818: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.81.14.113
country_id: 3469034
description:
2025-02-06 16:31:30 dovecot_plain authenticator failed for ([170.81.14.113]) [170.81.14.113]:36064: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.168.104.246
country_id: 617790
description:
[2025-02-06 16:31:32 +0100] info [webmaild] 178.168.104.246 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.114.242
country_id: 3469034
description:
2025-02-06 16:31:45 dovecot_plain authenticator failed for (242.114.95.187.static.liggatelecom.com.br) [187.95.114.242]:22202: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.54.49
country_id: 1668284
description:
2025-02-06 16:31:54 dovecot_plain authenticator failed for (58-115-54-49.twt1.com.tw) [58.115.54.49]:49652: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
country_id: 1814991
description:
2025-02-06 16:31:27 dovecot_plain authenticator failed for ([112.111.61.231]) [112.111.61.229]:60368: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.73
country_id: 1819730
description:
Feb  6 16:31:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.158.248.248
country_id: 2921044
description:
Feb  6 16:31:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.158.248.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.115.54.49
country_id: 1668284
description:
Feb  6 16:31:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.115.54.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2025-02-06 16:31:26 dovecot_plain authenticator failed for ([182.42.113.10]) [182.42.113.10]:60230: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.248.211.38
country_id: 1814991
description:
Feb  6 16:31:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.248.211.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.148.0.202
country_id: 6252001
description:
Feb  6 16:32:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.148.0.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.23.103
country_id: 1835841
description:
Feb  6 16:31:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.23.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.16.156.103
country_id: 6252001
description:
2025-02-06 16:31:34 dovecot_plain authenticator failed for (173-16-156-103.client.mchsi.com) [173.16.156.103]:53836: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.118.9
country_id: 1880251
description:
47.128.118.9 - - [06/Feb/2025:16:32:34 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=29998369 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C30%2C106&filter_course-language=121%2C99%2C183&filtering=1&instructor=1&price_type=paid&rating_filter=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.118.9


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.243.166.66
country_id: 3686110
description:
Feb  6 16:32:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.243.166.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-02-06 16:32:38 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.37.123
country_id: 1880251
description:
47.128.37.123 - - [06/Feb/2025:16:33:48 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19052406 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/open/index.php?Itemid=303&catid=2&func=viewcategory&option=com_joomgallery" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.37.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.231.159
country_id: 2921044
description:
Feb  6 16:34:12 ait sshd[1286961]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.205.231.159 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.231.159
country_id: 2921044
description:
Feb  6 16:34:12 ait sshd[1286961]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.231.159


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.235.94
country_id: 1835841
description:
Feb  6 16:34:14 ait sshd[1286966]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.235.94 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 217.15.161.58
country_id: 1880251
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:wwwadmin||WPU:wwwadmin||RSV:6.65||T:APACHE||MV:16-33.217.15.161.58


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.189.243.39
country_id: 1210997
description:
[2025-02-06 16:33:43 +0100] info [webmaild] 103.189.243.39 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
country_id: 1835841
description:
Feb  6 16:34:14 ait sshd[1286966]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.47.46.174
country_id: 1522867
description:
Feb  6 16:34:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.47.46.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.212.206
country_id: 1835841
description:
Feb  6 16:34:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
country_id: 3469034
description:
2025-02-06 16:35:12 dovecot_plain authenticator failed for (corporativo.static.gvt.net.br) [189.115.93.183]:56535: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
country_id: 1522867
description:
2025-02-06 16:34:26 dovecot_plain authenticator failed for ([92.47.46.174]) [92.47.46.174]:46294: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2025-02-06 16:34:47 dovecot_plain authenticator failed for ([183.99.89.74]) [183.99.89.74]:58330: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2025-02-06 16:34:56 dovecot_plain authenticator failed for ([182.76.71.82]) [182.76.71.82]:33664: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2025-02-06 16:34:57 dovecot_plain authenticator failed for ([211.53.58.1]) [211.169.212.206]:53677: 535 Incorrect authentication data (set_id=baah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.90.99.29
country_id: 6252001
description:
Feb  6 16:35:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.90.99.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
country_id: 6252001
description:
2025-02-06 16:35:05 dovecot_plain authenticator failed for (70-90-99-29-ma-ne.hfc.comcastbusiness.net) [70.90.99.29]:35653: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.152.119.134
country_id: 1643084
description:
Feb  6 16:35:16 ait sshd[1287614]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.152.119.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.216.2.74
country_id: 1814991
description:
2025-02-06 16:35:19 dovecot_plain authenticator failed for ([222.216.2.74]) [222.216.2.74]:59392: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.207.226.113
country_id: 290557
description:
Feb  6 16:34:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.207.226.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.106.57.36
country_id: 99237
description:
[2025-02-06 16:34:33 +0100] info [webmaild] 91.106.57.36 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.93.183
country_id: 3469034
description:
Feb  6 16:35:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.93.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2025-02-06 16:35:20 dovecot_plain authenticator failed for ([116.114.84.246]) [116.114.84.246]:60840: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.192.29.74
country_id: 1814991
description:
2025-02-06 16:34:48 dovecot_plain authenticator failed for ([120.192.29.74]) [120.192.29.74]:47735: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.79.232.38
country_id: 1269750
description:
Feb  6 16:34:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.79.232.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.2.62
country_id: 1814991
description:
Feb  6 16:34:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.2.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.71.82
country_id: 1269750
description:
Feb  6 16:34:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.71.82 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.152.119.134
country_id: 1643084
description:
Feb  6 16:35:16 ait sshd[1287614]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.152.119.134


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.226.113
country_id: 290557
description:
2025-02-06 16:34:30 dovecot_plain authenticator failed for ([94.207.226.113]) [94.207.226.113]:47921: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.99.89.74
country_id: 1835841
description:
Feb  6 16:34:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.99.89.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.63.46.34
country_id: 2077456
description:
2025-02-06 16:34:59 dovecot_plain authenticator failed for ([203.29.84.253]) [203.63.46.34]:27949: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.79.232.38
country_id: 1269750
description:
2025-02-06 16:34:59 dovecot_plain authenticator failed for ([142.79.232.38]) [142.79.232.38]:59715: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.216.2.74
country_id: 1814991
description:
Feb  6 16:35:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.216.2.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.19.47.79
country_id: 3469034
description:
Feb  6 16:34:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.19.47.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.221.58.77
country_id: 1814991
description:
Feb  6 16:34:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.221.58.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.58.77
country_id: 1814991
description:
2025-02-06 16:34:50 dovecot_plain authenticator failed for (77.58.221.60.adsl-pool.sx.cn) [60.221.58.77]:52975: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.192.29.74
country_id: 1814991
description:
Feb  6 16:34:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.192.29.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.2.62
country_id: 1814991
description:
2025-02-06 16:34:53 dovecot_plain authenticator failed for ([222.180.2.62]) [222.180.2.62]:55399: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.63.46.34
country_id: 2077456
description:
Feb  6 16:34:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.63.46.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.35.109.214
country_id: 1814991
description:
Feb  6 16:34:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.35.109.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.35.109.214
country_id: 1814991
description:
2025-02-06 16:34:37 dovecot_plain authenticator failed for ([125.35.109.214]) [125.35.109.214]:51332: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.19.47.79
country_id: 3469034
description:
2025-02-06 16:34:47 dovecot_plain authenticator failed for ([187.19.47.79]) [187.19.47.79]:3411: 535 Incorrect authentication data (set_id=baah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.246
country_id: 1814991
description:
Feb  6 16:35:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.246 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.116.173
country_id: 1880251
description:
47.128.116.173 - - [06/Feb/2025:16:35:20 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=8759302 HTTP/1.1" 302 0 mastersadmission.ait-edu.us "http://mastersadmission.ait-edu.us/open-university-postgraduate/masters-in-project-management/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.116.173


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.196.144.45
country_id: 1814991
description:
Feb  6 16:34:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.196.144.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.196.144.45
country_id: 1814991
description:
2025-02-06 16:34:33 dovecot_plain authenticator failed for ([183.196.144.45]) [183.196.144.45]:51853: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
country_id: 1269750
description:
Feb  6 16:36:18 ait sshd[1288103]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 16:35:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.163
country_id: 1269750
description:
Feb  6 16:36:07 ait sshd[1288025]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.163 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.163
country_id: 1269750
description:
Feb  6 16:36:07 ait sshd[1288025]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.163


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
country_id: 1269750
description:
Feb  6 16:36:18 ait sshd[1288103]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.255.40.207
country_id: 3469034
description:
[2025-02-06 16:36:22 +0100] info [webmaild] 187.255.40.207 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.170.117.78
country_id: 2363686
description:
[2025-02-06 16:35:35 +0100] info [webmaild] 196.170.117.78 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.217.137.126
country_id: 3469034
description:
Feb  6 16:37:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.217.137.126 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.226.83.38
country_id: 2921044
description:
Feb  6 16:37:21 ait sshd[1288675]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.226.83.38


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.199.71.30
country_id: 6252001
description:
Feb  6 16:37:03 ait sshd[1288572]: pam_imunify(sshd:auth): [IM360_RBL] The IP 198.199.71.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.41.206.128
country_id: 6252001
description:
2025-02-06 16:37:08 dovecot_login authenticator failed for (ADMIN) [181.41.206.128]:35224: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.217.137.126
country_id: 3469034
description:
2025-02-06 16:37:24 dovecot_plain authenticator failed for ([191.217.137.126]) [191.217.137.126]:58021: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.6.38
country_id: 1668284
description:
Feb  6 16:36:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.198.60
country_id: 1835841
description:
2025-02-06 16:37:02 dovecot_plain authenticator failed for ([121.189.198.60]) [121.189.198.60]:39802: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.252.38.24
country_id: 2215636
description:
Feb  6 16:37:08 ait sshd[1288609]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.252.38.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.206.128
country_id: 6252001
description:
Feb  6 16:37:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.206.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 198.199.71.30
country_id: 6252001
description:
Feb  6 16:37:03 ait sshd[1288572]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.199.71.30


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.79.195
country_id: 337996
description:
Feb  6 16:36:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.79.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
country_id: 1814991
description:
2025-02-06 16:36:33 dovecot_plain authenticator failed for ([222.92.61.242]) [222.92.61.242]:42449: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.193.121.147
country_id: 690791
description:
Feb  6 16:36:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.193.121.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.125.67.109
country_id: 1835841
description:
Feb  6 16:36:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.125.67.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.6.38
country_id: 1668284
description:
2025-02-06 16:36:52 dovecot_plain authenticator failed for 111-70-6-38.emome-ip.hinet.net [111.70.6.38]:44088: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.198.60
country_id: 1835841
description:
Feb  6 16:37:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.198.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.226.83.38
country_id: 2921044
description:
Feb  6 16:37:21 ait sshd[1288675]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.226.83.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.39.54
country_id: 6252001
description:
Feb  6 16:37:06 ait sshd[1288588]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.39.54


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.252.38.24
country_id: 2215636
description:
Feb  6 16:37:08 ait sshd[1288609]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.252.38.24


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
country_id: 1814991
description:
Feb  6 16:36:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2025-02-06 16:36:34 dovecot_plain authenticator failed for ([213.55.79.199]) [213.55.79.195]:44628: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.121.147
country_id: 690791
description:
2025-02-06 16:36:41 dovecot_plain authenticator failed for ([82.193.121.147]) [82.193.121.147]:50100: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.107.189
country_id: 3469034
description:
2025-02-06 16:36:49 dovecot_plain authenticator failed for (biophormula.static.gvt.net.br) [186.215.107.189]:53863: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.125.67.109
country_id: 1835841
description:
2025-02-06 16:36:31 dovecot_plain authenticator failed for ([39.125.67.109]) [39.125.67.109]:55894: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.215.107.189
country_id: 3469034
description:
Feb  6 16:36:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.215.107.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.109.39.54
country_id: 6252001
description:
Feb  6 16:37:06 ait sshd[1288588]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.109.39.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.118.248.19
country_id: 1861060
description:
Feb  6 16:37:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.118.248.19 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-37.194.163.182.227


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.59.230.163
country_id: 1527747
description:
[2025-02-06 16:37:59 +0100] info [webmaild] 5.59.230.163 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.55.39.59
country_id: 6252001
description:
Feb  6 16:37:33 ait sshd[1288903]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.55.39.59 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.55.39.59
country_id: 6252001
description:
Feb  6 16:37:33 ait sshd[1288903]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.39.59


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.123.220.10
country_id: 3996063
description:
Feb  6 16:37:54 ait sshd[1289100]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.123.220.10  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-02-06 16:38:14 dovecot_plain authenticator failed for ([185.134.179.106]) [185.101.16.250]:35185: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 209.38.248.55
country_id: 2921044
description:
Feb  6 16:37:30 ait sshd[1288882]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.248.55


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.87.187.71
country_id: 2017370
description:
Feb  6 16:37:39 ait sshd[1289021]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.87.187.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.237.199
country_id: 6252001
description:
Feb  6 16:37:44 ait sshd[1289035]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.89.237.199 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.89.237.199
country_id: 6252001
description:
Feb  6 16:37:44 ait sshd[1289035]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.237.199


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.118.248.19
country_id: 1861060
description:
2025-02-06 16:37:47 dovecot_plain authenticator failed for p173020-obmd01.osaka.ocn.ne.jp [61.118.248.19]:53367: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.123.220.10
country_id: 3996063
description:
Feb  6 16:37:54 ait sshd[1289100]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.123.220.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.101.16.250
country_id: 272103
description:
Feb  6 16:38:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.101.16.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.248.55
country_id: 2921044
description:
Feb  6 16:37:30 ait sshd[1288882]: pam_imunify(sshd:auth): [IM360_RBL] The IP 209.38.248.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.2.234.106
country_id: 2921044
description:
Feb  6 16:37:30 ait sshd[1288885]: pam_imunify(sshd:auth): [IM360_RBL] The IP 212.2.234.106 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 212.2.234.106
country_id: 2921044
description:
Feb  6 16:37:30 ait sshd[1288885]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.2.234.106


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.87.187.71
country_id: 2017370
description:
Feb  6 16:37:39 ait sshd[1289021]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.87.187.71


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.73
country_id: 6252001
description:
Feb  6 16:38:45 ait sshd[1289586]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.73 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.249.204.66
country_id: 3469034
description:
[2025-02-06 16:38:58 +0100] info [webmaild] 152.249.204.66 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.253.119
country_id: 298795
description:
Feb  6 16:39:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.253.119 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.21.209
country_id: 1814991
description:
Feb  6 16:39:12 ait sshd[1289853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.21.209  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
country_id: 1814991
description:
2025-02-06 16:39:16 dovecot_plain authenticator failed for ([111.50.70.34]) [111.50.70.34]:42017: 535 Incorrect authentication data (set_id=zabopiqu@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.253.119
country_id: 298795
description:
2025-02-06 16:39:24 dovecot_plain authenticator failed for ([31.141.253.119]) [31.141.253.119]:40274: 535 Incorrect authentication data (set_id=zabopiqu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
country_id: 1814991
description:
Feb  6 16:39:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.73
country_id: 6252001
description:
Feb  6 16:38:45 ait sshd[1289586]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.73


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.126.21.209
country_id: 1814991
description:
Feb  6 16:39:12 ait sshd[1289853]: pam_imunify(sshd:auth): [IM360_RBL] The IP 101.126.21.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.210.248.114
country_id: 1814991
description:
2025-02-06 16:39:59 dovecot_plain authenticator failed for ([221.210.248.114]) [221.210.248.114]:37278: 535 Incorrect authentication data (set_id=sarpong-nsiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.152.225.154
country_id: 6251999
description:
Feb  6 16:40:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.152.225.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2025-02-06 16:40:08 dovecot_plain authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:15036: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.212.153.73
country_id: 1880251
description:
Feb  6 16:39:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.212.153.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.153.73
country_id: 1880251
description:
2025-02-06 16:39:34 dovecot_plain authenticator failed for (73.153.212.218.starhub.net.sg) [218.212.153.73]:41386: 535 Incorrect authentication data (set_id=sarpong-nsiah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.152.55.149
country_id: 3469034
description:
[2025-02-06 16:39:40 +0100] info [webmaild] 177.152.55.149 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.210.248.114
country_id: 1814991
description:
Feb  6 16:39:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.210.248.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.14.83
country_id: 3996063
description:
2025-02-06 16:40:56 dovecot_plain authenticator failed for (187.161.14.83-clientes-izzi.mx) [187.161.14.83]:53958: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
country_id: 6252001
description:
Feb  6 16:40:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-02-06 16:41:01 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:33011: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
country_id: 1835841
description:
2025-02-06 16:41:09 dovecot_plain authenticator failed for ([218.147.6.84]) [218.147.6.84]:57572: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.11.160.60
country_id: 1814991
description:
Feb  6 16:41:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.11.160.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.145.46.38
country_id: 1562822
description:
Feb  6 16:40:50 ait sshd[1290609]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.145.46.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.210.228.228
country_id: 6252001
description:
Feb  6 16:40:51 ait sshd[1290617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.210.228.228


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
country_id: 1835841
description:
Feb  6 16:41:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.11.160.60
country_id: 1814991
description:
2025-02-06 16:41:13 dovecot_plain authenticator failed for ([121.11.160.60]) [121.11.160.60]:34771: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.138.196.194
country_id: 3469034
description:
2025-02-06 16:40:45 dovecot_plain authenticator failed for ([200.138.196.194]) [200.138.196.194]:37473: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.145.46.38
country_id: 1562822
description:
Feb  6 16:40:50 ait sshd[1290609]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.145.46.38  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.152.178.216
country_id: 3469034
description:
[2025-02-06 16:40:30 +0100] info [webmaild] 177.152.178.216 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.210.228.228
country_id: 6252001
description:
Feb  6 16:40:51 ait sshd[1290617]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.210.228.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.161.14.83
country_id: 3996063
description:
Feb  6 16:40:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.161.14.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.138.196.194
country_id: 3469034
description:
Feb  6 16:40:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.138.196.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.55.39.59
country_id: 6252001
description:
Feb  6 16:41:36 ait sshd[1291072]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.55.39.59 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.55.39.59
country_id: 6252001
description:
Feb  6 16:41:36 ait sshd[1291072]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.39.59


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.106.243
country_id: 1668284
description:
2025-02-06 16:42:12 dovecot_login authenticator failed for 110-25-106-243.adsl.fetnet.net [110.25.106.243]:41683: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.199.71.30
country_id: 6252001
description:
Feb  6 16:41:29 ait sshd[1291054]: pam_imunify(sshd:auth): [IM360_RBL] The IP 198.199.71.30 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 198.199.71.30
country_id: 6252001
description:
Feb  6 16:41:29 ait sshd[1291054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.199.71.30


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.98.28.43
country_id: 1269750
description:
Feb  6 16:41:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.98.28.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.106.243
country_id: 1668284
description:
Feb  6 16:42:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.106.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-02-06 16:41:57 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:35694: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.34.214.78
country_id: 3469034
description:
[2025-02-06 16:42:07 +0100] info [webmaild] 191.34.214.78 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.175.76.146
country_id: 6252001
description:
Feb  6 16:42:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.175.76.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
country_id: 6252001
description:
2025-02-06 16:42:22 dovecot_plain authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:48386: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.72.103.74
country_id: 1562822
description:
Feb  6 16:42:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.72.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.29.135.63
country_id: 294640
description:
Feb  6 16:43:12 ait sshd[1291956]: pam_imunify(sshd:auth): [IM360_RBL] The IP 5.29.135.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2025-02-06 16:43:18 dovecot_plain authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:52671: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.165.148.166
country_id: 3469034
description:
Feb  6 16:42:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.165.148.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.199.71.30
country_id: 6252001
description:
Feb  6 16:42:42 ait sshd[1291616]: pam_imunify(sshd:auth): [IM360_RBL] The IP 198.199.71.30 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.199.71.30
country_id: 6252001
description:
Feb  6 16:42:44 ait sshd[1291616]: Failed password for invalid user steam from 198.199.71.30 port 33454 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.55.39.59
country_id: 6252001
description:
Feb  6 16:42:46 ait sshd[1291701]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.55.39.59 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.55.39.59
country_id: 6252001
description:
Feb  6 16:42:46 ait sshd[1291701]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.39.59


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.44.54.255
country_id: 357994
description:
[2025-02-06 16:43:15 +0100] info [webmaild] 102.44.54.255 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.210.228.228
country_id: 6252001
description:
Feb  6 16:42:39 ait sshd[1291589]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.210.228.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.174.182.38
country_id: 2077456
description:
Feb  6 16:43:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.174.182.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
country_id: 3469034
description:
2025-02-06 16:42:33 dovecot_plain authenticator failed for ([200.165.163.121]) [200.165.148.166]:57778: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.103.74
country_id: 1562822
description:
2025-02-06 16:42:36 dovecot_plain authenticator failed for ([27.72.103.74]) [27.72.103.74]:50749: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.210.228.228
country_id: 6252001
description:
Feb  6 16:42:39 ait sshd[1291589]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.210.228.228


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 198.199.71.30
country_id: 6252001
description:
Feb  6 16:42:42 ait sshd[1291616]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.199.71.30


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 5.29.135.63
country_id: 294640
description:
Feb  6 16:43:12 ait sshd[1291956]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.29.135.63  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 16:43:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.210.228.228
country_id: 6252001
description:
Feb  6 16:43:58 ait sshd[1292171]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.210.228.228 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.236.231.194
country_id: 99237
description:
[2025-02-06 16:43:59 +0100] info [webmaild] 37.236.231.194 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2025-02-06 16:44:05 dovecot_plain authenticator failed for ([213.55.79.199]) [213.55.79.195]:56052: 535 Incorrect authentication data (set_id=vondee)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-43.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.150.37.249
country_id: 2017370
description:
2025-02-06 16:43:58 dovecot_plain authenticator failed for ([217.150.37.249]) [217.150.37.249]:57552: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.210.228.228
country_id: 6252001
description:
Feb  6 16:43:58 ait sshd[1292171]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.210.228.228


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.79.195
country_id: 337996
description:
Feb  6 16:44:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.79.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.150.37.249
country_id: 2017370
description:
Feb  6 16:43:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.150.37.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.63
country_id: 1819730
description:
Feb  6 16:44:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
country_id: 6252001
description:
Feb  6 16:45:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.47.63.37
country_id: 2017370
description:
Feb  6 16:45:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.47.63.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
country_id: 1835841
description:
Feb  6 16:45:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.245.207.104
country_id: 1835841
description:
Feb  6 16:45:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.245.207.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.182.227.240
country_id: 1835841
description:
Feb  6 16:45:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.182.227.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 16:44:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.222.84
country_id: 1814991
description:
2025-02-06 16:44:39 dovecot_plain authenticator failed for ([183.234.222.84]) [183.234.222.84]:50493: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
country_id: 2017370
description:
2025-02-06 16:44:56 dovecot_plain authenticator failed for ([77.51.214.170]) [77.51.214.170]:39272: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
country_id: 2017370
description:
Feb  6 16:44:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
country_id: 1835841
description:
2025-02-06 16:45:25 dovecot_plain authenticator failed for ([211.105.213.144]) [211.105.213.144]:54496: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
country_id: 6252001
description:
2025-02-06 16:45:11 dovecot_login authenticator failed for ([96.79.174.131]) [96.79.174.131]:41988: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.126.214
country_id: 1835841
description:
Feb  6 16:45:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.126.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.245.207.104
country_id: 1835841
description:
2025-02-06 16:45:25 dovecot_plain authenticator failed for ([1.245.207.104]) [1.245.207.104]:33102: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.196.184.120
country_id: 6252001
description:
Feb  6 16:45:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.196.184.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.255.45
country_id: 1210997
description:
Feb  6 16:44:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.255.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.255.45
country_id: 1210997
description:
2025-02-06 16:44:59 dovecot_plain authenticator failed for (27-123-255-45-mcnbd.com) [27.123.255.45]:45326: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.164.176.167
country_id: 390903
description:
Feb  6 16:45:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.164.176.167 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-45.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.230.98
country_id: 1814991
description:
Feb  6 16:45:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.230.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.31.242
country_id: 1814991
description:
Feb  6 16:45:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.31.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.182.227.240
country_id: 1835841
description:
2025-02-06 16:45:25 dovecot_plain authenticator failed for ([121.182.227.240]) [121.182.227.240]:52505: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.222.84
country_id: 1814991
description:
Feb  6 16:44:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.222.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.63
country_id: 1819730
description:
2025-02-06 16:44:59 dovecot_plain authenticator failed for (m121-202-201-63.smartone.com) [121.202.201.63]:10702: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.47.63.37
country_id: 2017370
description:
2025-02-06 16:45:10 dovecot_plain authenticator failed for ([95.47.63.37]) [95.47.63.37]:52270: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.177.220.50
country_id: 1210997
description:
[2025-02-06 16:44:46 +0100] info [webmaild] 103.177.220.50 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.248.243.64
country_id: 2017370
description:
Feb  6 16:45:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.248.243.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.164.176.167
country_id: 390903
description:
2025-02-06 16:45:18 dovecot_plain authenticator failed for ([95.164.176.167]) [95.164.176.167]:33224: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.212.136.240
country_id: 6252001
description:
Feb  6 16:45:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.212.136.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.118.123.44
country_id: 6252001
description:
Feb  6 16:45:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.118.123.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.118.123.44
country_id: 6252001
description:
2025-02-06 16:45:25 dovecot_plain authenticator failed for syn-172-118-123-044.res.spectrum.com [172.118.123.44]:42156: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.31.242
country_id: 1814991
description:
2025-02-06 16:45:24 dovecot_plain authenticator failed for ([61.169.31.242]) [61.169.31.242]:15825: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.248.243.64
country_id: 2017370
description:
2025-02-06 16:45:09 dovecot_plain authenticator failed for ([87.248.243.64]) [87.248.243.64]:54186: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.230.98
country_id: 1814991
description:
2025-02-06 16:45:23 dovecot_plain authenticator failed for ([1.180.230.112]) [1.180.230.98]:55156: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.212.136.240
country_id: 6252001
description:
2025-02-06 16:45:23 dovecot_plain authenticator failed for 240.sub-97-212-136.myvzw.com [97.212.136.240]:46538: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.92.25.206
country_id: 1835841
description:
2025-02-06 16:45:32 dovecot_plain authenticator failed for ([220.92.25.206]) [220.92.25.206]:52718: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.166
country_id: 1668284
description:
Feb  6 16:45:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.180.84
country_id: 1814991
description:
Feb  6 16:45:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.180.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.149.10
country_id: 1269750
description:
2025-02-06 16:45:27 dovecot_plain authenticator failed for (abts-north-dynamic-010.149.176.122.airtelbroadband.in) [122.176.149.10]:57240: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.34
country_id: 617790
description:
2025-02-06 16:45:36 dovecot_plain authenticator failed for ([185.167.56.34]) [185.167.56.34]:34410: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.129.78
country_id: 1814991
description:
Feb  6 16:45:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.129.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.165.83
country_id: 99237
description:
Feb  6 16:45:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.165.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-02-06 16:45:42 dovecot_plain authenticator failed for ([65.20.205.197]) [65.20.205.197]:48962: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.145.46.38
country_id: 1562822
description:
Feb  6 16:46:04 ait sshd[1293323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.145.46.38  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.91.173.203
country_id: 953987
description:
Feb  6 16:45:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.91.173.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.73
country_id: 1819730
description:
Feb  6 16:45:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.246.49.99
country_id: 1269750
description:
Feb  6 16:45:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.246.49.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.120
country_id: 6252001
description:
2025-02-06 16:45:26 dovecot_plain authenticator failed for ([74.196.184.120]) [74.196.184.120]:45182: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
country_id: 99237
description:
Feb  6 16:45:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.22.116.38
country_id: 6252001
description:
2025-02-06 16:46:20 dovecot_plain authenticator failed for ([134.22.116.38]) [134.22.116.38]:41570: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
country_id: 1831722
description:
Feb  6 16:45:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.52.89.218
country_id: 2017370
description:
2025-02-06 16:45:30 dovecot_plain authenticator failed for ([84.52.89.218]) [84.52.89.218]:38661: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.190
country_id: 1269750
description:
Feb  6 16:45:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.223.203
country_id: 1835841
description:
2025-02-06 16:46:01 dovecot_plain authenticator failed for ([210.99.223.203]) [210.99.223.203]:56722: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
country_id: 3469034
description:
Feb  6 16:45:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
country_id: 1835841
description:
Feb  6 16:46:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.82.131.211
country_id: 3469034
description:
[2025-02-06 16:46:21 +0100] info [webmaild] 201.82.131.211 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.80.68
country_id: 1835841
description:
2025-02-06 16:45:43 dovecot_plain authenticator failed for ([211.44.80.68]) [211.44.80.68]:42470: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.155.105
country_id: 1814991
description:
2025-02-06 16:45:45 dovecot_plain authenticator failed for ([222.68.155.105]) [222.68.155.105]:52813: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.246.49.99
country_id: 1269750
description:
2025-02-06 16:45:51 dovecot_plain authenticator failed for (abts-mp-static-185.120.168.122.airtelbroadband.in) [115.246.49.99]:43512: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.145.46.38
country_id: 1562822
description:
Feb  6 16:46:04 ait sshd[1293323]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.145.46.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.176.149.10
country_id: 1269750
description:
Feb  6 16:45:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.176.149.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.7.100
country_id: 2264397
description:
2025-02-06 16:45:38 dovecot_plain authenticator failed for 100.7.61.94.rev.vodafone.pt [94.61.7.100]:53960: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.93.37.178
country_id: 1269750
description:
Feb  6 16:45:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.93.37.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.234.106.218
country_id: 3865483
description:
Feb  6 16:45:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.234.106.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
country_id: 1269750
description:
2025-02-06 16:45:42 dovecot_plain authenticator failed for ([103.93.37.178]) [103.93.37.178]:35678: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-02-06 16:45:27 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:40382: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.245.31.174
country_id: 1814991
description:
Feb  6 16:45:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.245.31.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.61.7.100
country_id: 2264397
description:
Feb  6 16:45:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.61.7.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.172.79.206
country_id: 1835841
description:
Feb  6 16:45:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.172.79.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.93
country_id: 1819730
description:
2025-02-06 16:46:01 dovecot_login authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:54653: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.102
country_id: 1819730
description:
2025-02-06 16:45:27 dovecot_plain authenticator failed for ([118.26.153.102]) [118.26.153.102]:45274: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.92.25.206
country_id: 1835841
description:
Feb  6 16:45:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.92.25.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.245.31.174
country_id: 1814991
description:
2025-02-06 16:45:38 dovecot_plain authenticator failed for ([183.245.31.174]) [183.245.31.174]:45713: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.172.79.206
country_id: 1835841
description:
2025-02-06 16:45:43 dovecot_plain authenticator failed for ([211.172.79.206]) [211.172.79.206]:39258: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.34
country_id: 617790
description:
Feb  6 16:45:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.73
country_id: 1819730
description:
2025-02-06 16:45:40 dovecot_plain authenticator failed for (m121-202-155-73.smartone.com) [121.202.155.73]:43994: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.33.218.186
country_id: 298795
description:
Feb  6 16:45:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.33.218.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
country_id: 1835841
description:
2025-02-06 16:46:16 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:41908: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.80.68
country_id: 1835841
description:
Feb  6 16:45:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.80.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
country_id: 3469034
description:
2025-02-06 16:45:54 dovecot_plain authenticator failed for (189-56-79-105.customer.tdatabrasil.net.br) [186.200.249.162]:33543: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.223.203
country_id: 1835841
description:
Feb  6 16:45:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.223.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.74.21
country_id: 1814991
description:
2025-02-06 16:46:15 dovecot_plain authenticator failed for ([183.238.74.21]) [183.238.74.21]:59077: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.7.86.144
country_id: 1814991
description:
Feb  6 16:45:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.7.86.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.155.105
country_id: 1814991
description:
Feb  6 16:45:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.155.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.217.105
country_id: 1861060
description:
Feb  6 16:45:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.217.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.33.218.186
country_id: 298795
description:
2025-02-06 16:45:46 dovecot_plain authenticator failed for (bey-a5-12-asy29.bey-ro-03.superonline.com) [195.33.218.186]:62406: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.93
country_id: 1819730
description:
Feb  6 16:45:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.29.135.63
country_id: 294640
description:
Feb  6 16:46:01 ait sshd[1293309]: pam_imunify(sshd:auth): [IM360_RBL] The IP 5.29.135.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.26.153.102
country_id: 1819730
description:
Feb  6 16:45:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.26.153.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.164.165
country_id: 298795
description:
Feb  6 16:45:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.164.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.165.83
country_id: 99237
description:
2025-02-06 16:45:40 dovecot_plain authenticator failed for ([65.20.165.83]) [65.20.165.83]:51666: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.217.105
country_id: 1861060
description:
2025-02-06 16:45:45 dovecot_plain authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:56336: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.166
country_id: 1668284
description:
2025-02-06 16:45:41 dovecot_plain authenticator failed for 111-70-32-166.emome-ip.hinet.net [111.70.32.166]:43420: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.190
country_id: 1269750
description:
2025-02-06 16:45:48 dovecot_plain authenticator failed for (nsg-corporate-190.227.187.122.airtel.in) [122.187.227.190]:53074: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.74.21
country_id: 1814991
description:
Feb  6 16:46:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.74.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.7.86.144
country_id: 1814991
description:
2025-02-06 16:45:27 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [123.7.86.144]:43226: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.164.165
country_id: 298795
description:
2025-02-06 16:45:36 dovecot_plain authenticator failed for ([5.11.164.165]) [5.11.164.165]:55528: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.91.173.203
country_id: 953987
description:
2025-02-06 16:45:37 dovecot_plain authenticator failed for (197-91-173-203.dyn.mweb.co.za) [197.91.173.203]:42008: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.129.78
country_id: 1814991
description:
2025-02-06 16:45:40 dovecot_plain authenticator failed for ([112.27.129.78]) [112.27.129.78]:50015: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.180.84
country_id: 1814991
description:
2025-02-06 16:45:58 dovecot_plain authenticator failed for ([120.238.180.84]) [120.238.180.84]:36262: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 5.29.135.63
country_id: 294640
description:
Feb  6 16:46:01 ait sshd[1293309]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.29.135.63  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.22.116.38
country_id: 6252001
description:
Feb  6 16:46:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.22.116.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.126.214
country_id: 1835841
description:
2025-02-06 16:45:26 dovecot_plain authenticator failed for ([175.205.126.214]) [175.205.126.214]:54568: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.52.89.218
country_id: 2017370
description:
Feb  6 16:45:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.52.89.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.87.167
country_id: 1861060
description:
2025-02-06 16:45:44 dovecot_login authenticator failed for (ADMIN) [149.22.87.167]:37768: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.218
country_id: 3865483
description:
2025-02-06 16:45:44 dovecot_plain authenticator failed for (201-234-106-218.static.impsat.net.ar) [201.234.106.218]:35395: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.90.72.114
country_id: 1814991
description:
Feb  6 16:46:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.90.72.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.90.72.114
country_id: 1814991
description:
2025-02-06 16:46:35 dovecot_plain authenticator failed for ([125.90.72.114]) [125.90.72.114]:38886: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.156.142.238
country_id: 1269750
description:
Feb  6 16:47:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.156.142.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.211.246.121
country_id: 1814991
description:
Feb  6 16:47:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.211.246.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.29.135.63
country_id: 294640
description:
Feb  6 16:47:20 ait sshd[1293865]: pam_imunify(sshd:auth): [IM360_RBL] The IP 5.29.135.63 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 5.29.135.63
country_id: 294640
description:
Feb  6 16:47:20 ait sshd[1293865]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.29.135.63  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.164.202.218
country_id: 1814991
description:
Feb  6 16:46:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.164.202.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.164.202.218
country_id: 1814991
description:
2025-02-06 16:46:31 dovecot_plain authenticator failed for ([61.164.202.219]) [61.164.202.218]:12925: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.142.238
country_id: 1269750
description:
2025-02-06 16:47:12 dovecot_plain authenticator failed for ([114.143.224.97]) [182.156.142.238]:40877: 535 Incorrect authentication data (set_id=ads09a99049y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.24.174.233
country_id: 3469034
description:
[2025-02-06 16:47:17 +0100] info [webmaild] 201.24.174.233 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.211.246.121
country_id: 1814991
description:
2025-02-06 16:47:18 dovecot_login authenticator failed for ([221.211.246.121]) [221.211.246.121]:33332: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.161.242.146
country_id: 1814991
description:
2025-02-06 16:47:33 dovecot_plain authenticator failed for (146.242.161.222.adsl-pool.jlccptt.net.cn) [222.161.242.146]:13715: 535 Incorrect authentication data (set_id=ads09a99049y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.134.78.162
country_id: 1814991
description:
Feb  6 16:48:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.134.78.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.216.37.11
country_id: 1814991
description:
Feb  6 16:47:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.216.37.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.216.37.11
country_id: 1814991
description:
2025-02-06 16:47:30 dovecot_plain authenticator failed for ([60.216.37.11]) [60.216.37.11]:43556: 535 Incorrect authentication data (set_id=ads20b00294y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.175.12.33
country_id: 1269750
description:
Feb  6 16:47:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.175.12.33 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.255.218.184
country_id: 3469034
description:
[2025-02-06 16:48:00 +0100] info [webmaild] 138.255.218.184 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.162
country_id: 1814991
description:
2025-02-06 16:48:07 dovecot_plain authenticator failed for ([36.134.78.162]) [36.134.78.162]:45145: 535 Incorrect authentication data (set_id=ads20b00294y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.42.226.215
country_id: 1814991
description:
2025-02-06 16:47:28 dovecot_plain authenticator failed for ([58.42.226.215]) [58.42.226.215]:42779: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.145.46.38
country_id: 1562822
description:
Feb  6 16:47:39 ait sshd[1294194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.145.46.38  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 16:47:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.12.33
country_id: 1269750
description:
2025-02-06 16:47:35 dovecot_login authenticator failed for ([122.175.12.33]) [122.175.12.33]:37378: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.145.46.38
country_id: 1562822
description:
Feb  6 16:47:39 ait sshd[1294194]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.145.46.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.48.98.125
country_id: 1814991
description:
Feb  6 16:47:53 ait sshd[1294262]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.48.98.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.42.226.215
country_id: 1814991
description:
Feb  6 16:47:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.42.226.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.161.242.146
country_id: 1814991
description:
Feb  6 16:47:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.161.242.146 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.98.125
country_id: 1814991
description:
Feb  6 16:47:53 ait sshd[1294262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.98.125  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.20
country_id: 3175395
description:
2025-02-06 16:49:04 dovecot_login authenticator failed for (ADMIN) [156.146.41.20]:37358: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.120.176.224
country_id: 1269750
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:yanz@123457||WPU:yanz@123457||RSV:6.65||T:APACHE||MV:16-48.103.120.176.224


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.239.28.18
country_id: 99237
description:
[2025-02-06 16:48:50 +0100] info [webmaild] 37.239.28.18 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.232.117.127
country_id: 1668284
description:
Feb  6 16:50:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.232.117.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.232.117.127
country_id: 1668284
description:
2025-02-06 16:50:04 dovecot_login authenticator failed for 118-232-117-127.dynamic.kbronet.com.tw [118.232.117.127]:59807: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.207.129.246
country_id: 614540
description:
Feb  6 16:50:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.207.129.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.207.129.246
country_id: 614540
description:
2025-02-06 16:50:14 dovecot_login authenticator failed for ([185.207.129.246]) [185.207.129.246]:57638: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.181.50.143
country_id: 298795
description:
[2025-02-06 16:50:23 +0100] info [webmaild] 78.181.50.143 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.170.189.164
country_id: 1220409
description:
Feb  6 16:51:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.170.189.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.170.189.164
country_id: 1220409
description:
2025-02-06 16:51:13 dovecot_plain authenticator failed for (prege) [79.170.189.164]:54425: 535 Incorrect authentication data (set_id=abs65b11556y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.151.46.183
country_id: 1168579
description:
[2025-02-06 16:51:21 +0100] info [webmaild] 103.151.46.183 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.69.178.104
country_id: 3017382
description:
Feb  6 16:50:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.69.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 16:50:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
country_id: 3017382
description:
2025-02-06 16:50:44 dovecot_login authenticator failed for 104.178.69.85.rev.sfr.net (1L5sjJfAS) [85.69.178.104]:34488: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 204.10.194.36
country_id: 2921044
domain: www.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:charlesaboagye76||WPU:charlesaboagye76||RSV:6.65||T:APACHE||MV:16-51.204.10.194.36


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.50.150
country_id: 1814991
description:
Feb  6 16:51:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.50.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
country_id: 1814991
description:
2025-02-06 16:51:46 dovecot_plain authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.50.150]:38978: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.34.165.114
country_id: 6252001
description:
Feb  6 16:51:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.34.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.25.152.252
country_id: 3439705
description:
[2025-02-06 16:51:58 +0100] info [webmaild] 179.25.152.252 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.165.114
country_id: 6252001
description:
2025-02-06 16:51:58 dovecot_login authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:45894: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.30.180.58
country_id: 1835841
description:
Feb  6 16:51:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.30.180.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.180.58
country_id: 1835841
description:
2025-02-06 16:51:35 dovecot_plain authenticator failed for ([114.30.180.58]) [114.30.180.58]:41045: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.70.28
country_id: 1835841
description:
2025-02-06 16:52:10 dovecot_login authenticator failed for ([110.34.70.28]) [110.34.70.28]:54282: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.70.28
country_id: 1835841
description:
Feb  6 16:52:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.70.28 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-52.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.22.116.38
country_id: 6252001
description:
2025-02-06 16:52:51 dovecot_login authenticator failed for ([134.22.116.38]) [134.22.116.38]:55350: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.224.221
country_id: 1168579
description:
Feb  6 16:52:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.224.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.224.221
country_id: 1168579
description:
2025-02-06 16:53:00 dovecot_login authenticator failed for ([103.57.224.221]) [103.57.224.221]:43300: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.84.154.106
country_id: 6252001
description:
Feb  6 16:52:32 ait sshd[1296377]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.84.154.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.22.116.38
country_id: 6252001
description:
Feb  6 16:52:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.22.116.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 16:53:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
country_id: 2921044
description:
Feb  6 16:53:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
country_id: 2921044
description:
2025-02-06 16:53:21 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (pecied) [91.56.31.167]:62278: 535 Incorrect authentication data (set_id=eng19b00195y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.84.154.106
country_id: 6252001
description:
Feb  6 16:52:32 ait sshd[1296377]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.84.154.106


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.216.133.131
country_id: 690791
description:
[2025-02-06 16:52:48 +0100] info [webmaild] 91.216.133.131 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 16:53:54 ait sshd[1296843]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 16:53:54 ait sshd[1296843]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.167.114.221
country_id: 390903
description:
Feb  6 16:53:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.167.114.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.167.114.221
country_id: 390903
description:
2025-02-06 16:53:53 dovecot_plain authenticator failed for ohgtex.static.otenet.gr (tomatch) [195.167.114.221]:47854: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 16:53:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.244.56.97
country_id: 3996063
description:
[2025-02-06 16:54:19 +0100] info [webmaild] 187.244.56.97 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.118
country_id: 1819730
description:
Feb  6 16:55:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
country_id: 1814991
description:
Feb  6 16:55:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.217.255.171
country_id: 6252001
description:
Feb  6 16:55:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.217.255.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.214.65.244
country_id: 1835841
description:
2025-02-06 16:55:14 dovecot_plain authenticator failed for ([123.214.65.244]) [123.214.65.244]:38792: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.238.249.53
country_id: 3469034
description:
[2025-02-06 16:55:15 +0100] info [webmaild] 170.238.249.53 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.210.98
country_id: 1835841
description:
Feb  6 16:55:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-02-06 16:55:16 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:38810: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.118
country_id: 1819730
description:
2025-02-06 16:55:12 dovecot_login authenticator failed for (m121-202-155-118.smartone.com) [121.202.155.118]:3141: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.156.80.226
country_id: 1814991
description:
2025-02-06 16:54:50 dovecot_login authenticator failed for ([117.156.80.226]) [117.156.80.226]:50633: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.214.65.244
country_id: 1835841
description:
Feb  6 16:55:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.214.65.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
country_id: 1814991
description:
2025-02-06 16:55:13 dovecot_plain authenticator failed for ([27.223.100.92]) [27.223.100.90]:60102: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.156.80.226
country_id: 1814991
description:
Feb  6 16:54:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.156.80.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.80.241.73
country_id: 1835841
description:
Feb  6 16:55:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.80.241.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.80.241.73
country_id: 1835841
description:
2025-02-06 16:55:32 dovecot_plain authenticator failed for ([61.80.241.73]) [61.80.241.73]:58414: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.176.231
country_id: 1814991
description:
Feb  6 16:55:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.176.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 16:55:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.104.103.146
country_id: 1814991
description:
Feb  6 16:56:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.104.103.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.241.150
country_id: 1814991
description:
2025-02-06 16:56:22 dovecot_plain authenticator failed for ([61.143.241.150]) [61.143.241.150]:49881: 535 Incorrect authentication data (set_id=ads21a00042y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.210.98
country_id: 1835841
description:
2025-02-06 16:55:26 dovecot_plain authenticator failed for ([121.168.210.98]) [121.168.210.98]:59701: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.176.231
country_id: 1814991
description:
2025-02-06 16:55:48 dovecot_plain authenticator failed for ([61.184.176.231]) [61.184.176.231]:45502: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.147.105.76
country_id: 2542007
description:
[2025-02-06 16:55:57 +0100] info [webmaild] 197.147.105.76 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.104.103.146
country_id: 1814991
description:
2025-02-06 16:56:03 dovecot_login authenticator failed for ([180.104.103.146]) [180.104.103.146]:42174: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.241.150
country_id: 1814991
description:
Feb  6 16:56:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.241.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.120
country_id: 6252001
description:
2025-02-06 16:57:09 dovecot_login authenticator failed for ([74.196.184.120]) [74.196.184.120]:44780: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.72.14.152
country_id: 6252001
description:
Feb  6 16:57:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.72.14.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 16:57:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.196.184.120
country_id: 6252001
description:
Feb  6 16:57:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.196.184.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.105.113
country_id: 3469034
description:
2025-02-06 16:57:06 dovecot_plain authenticator failed for (177-174-105-113.user.vivozap.com.br) [177.174.105.113]:35425: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
country_id: 1880251
description:
Feb  6 16:56:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
country_id: 294640
description:
Feb  6 16:56:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.242.51.190
country_id: 3469034
description:
[2025-02-06 16:56:48 +0100] info [webmaild] 191.242.51.190 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.72.14.152
country_id: 6252001
description:
2025-02-06 16:57:17 dovecot_plain authenticator failed for ([76.72.14.152]) [76.72.14.152]:61318: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
country_id: 294640
description:
2025-02-06 16:56:32 dovecot_plain authenticator failed for (nophinsult) [147.235.97.158]:20683: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
country_id: 1880251
description:
2025-02-06 16:56:54 dovecot_plain authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:51572: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.105.113
country_id: 3469034
description:
Feb  6 16:57:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.105.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-02-06 16:58:05 dovecot_plain authenticator failed for ([50.188.204.213]) [50.188.204.213]:59858: 535 Incorrect authentication data (set_id=eng19b00228y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.237.145.18
country_id: 3469034
description:
Feb  6 16:57:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.237.145.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.129.201.81
country_id: 1210997
description:
2025-02-06 16:57:41 dovecot_plain authenticator failed for ([103.129.201.82]) [103.129.201.81]:37544: 535 Incorrect authentication data (set_id=eng19b00228y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
country_id: 1835841
description:
2025-02-06 16:57:50 dovecot_plain authenticator failed for ([14.88.228.202]) [14.88.228.202]:50912: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.44.217.237
country_id: 2077456
description:
2025-02-06 16:57:58 dovecot_plain authenticator failed for ([121.44.217.237]) [121.44.217.237]:41122: 535 Incorrect authentication data (set_id=dagyarko)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.202
country_id: 1819730
description:
2025-02-06 16:58:15 dovecot_plain authenticator failed for (m121-202-206-202.smartone.com) [121.202.206.202]:63803: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.115.173.11
country_id: 1269750
description:
Feb  6 16:58:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.115.173.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.200.14.2
country_id: 1814991
description:
2025-02-06 16:57:46 dovecot_plain authenticator failed for ([202.200.14.2]) [202.200.14.2]:56583: 535 Incorrect authentication data (set_id=dagyarko@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
country_id: 1835841
description:
Feb  6 16:57:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-58.194.163.182.227


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 16:57:35 ait sshd[1298737]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.194.214
country_id: 1819730
description:
2025-02-06 16:58:05 dovecot_plain authenticator failed for (m121-202-194-214.smartone.com) [121.202.194.214]:58742: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.194.214
country_id: 1819730
description:
Feb  6 16:58:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.194.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2025-02-06 16:57:56 dovecot_plain authenticator failed for ([121.128.76.109]) [61.72.59.106]:51045: 535 Incorrect authentication data (set_id=eng19b00228y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.199.59.150
country_id: 3658394
description:
[2025-02-06 16:58:16 +0100] info [webmaild] 181.199.59.150 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.44.217.237
country_id: 2077456
description:
Feb  6 16:57:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.44.217.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.129.201.81
country_id: 1210997
description:
Feb  6 16:57:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.129.201.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.200.14.2
country_id: 1814991
description:
Feb  6 16:57:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.200.14.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.237.145.18
country_id: 3469034
description:
2025-02-06 16:57:54 dovecot_plain authenticator failed for ([186.237.145.18]) [186.237.145.18]:7807: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
country_id: 1269750
description:
2025-02-06 16:58:18 dovecot_plain authenticator failed for ([45.115.173.11]) [45.115.173.11]:42216: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.38.21
country_id: 6252001
description:
Feb  6 16:57:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.38.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.38.21
country_id: 6252001
description:
2025-02-06 16:57:42 dovecot_login authenticator failed for ([158.140.38.21]) [158.140.38.21]:46052: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
country_id: 1835841
description:
Feb  6 16:57:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.188.204.213
country_id: 6252001
description:
Feb  6 16:58:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.188.204.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.206.202
country_id: 1819730
description:
Feb  6 16:58:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.206.202 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-58.80.76.51.123


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 16:57:35 ait sshd[1298737]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 159.223.206.253
country_id: 6252001
domain: tit-edu.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/titlemas/public_html/tit-edu.net/wp-admin


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 159.223.206.253
country_id: 6252001
domain: tit-edu.net
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:16-58.159.223.206.253||RSV:6.65||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 198.163.194.38
country_id: 1512440
description:
[2025-02-06 16:59:10 +0100] info [webmaild] 198.163.194.38 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.170.228.150
country_id: 1814991
description:
Feb  6 16:59:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.170.228.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.170.228.150
country_id: 1814991
description:
2025-02-06 16:59:31 dovecot_login authenticator failed for ([222.170.228.150]) [222.170.228.150]:57784: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.151.45.136
country_id: 1814991
description:
Feb  6 16:59:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.151.45.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.151.45.136
country_id: 1814991
description:
2025-02-06 16:59:48 dovecot_login authenticator failed for ([182.151.45.136]) [182.151.45.136]:44842: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.42.140.200
country_id: 3469034
description:
[2025-02-06 16:59:58 +0100] info [webmaild] 179.42.140.200 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.154.170.18
country_id: 286963
description:
[2025-02-06 17:00:48 +0100] info [webmaild] 85.154.170.18 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.125.174.202
country_id: 1880251
description:
Feb  6 17:00:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.125.174.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.125.174.202
country_id: 1880251
description:
2025-02-06 17:00:51 dovecot_plain authenticator failed for ([27.125.174.202]) [27.125.174.202]:48099: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.167.114.221
country_id: 390903
description:
Feb  6 17:01:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.167.114.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-02-06 17:01:01 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (chrotichy) [81.225.30.107]:48539: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.44.246.82
country_id: 6252001
description:
2025-02-06 17:01:11 dovecot_login authenticator failed for ([12.44.246.82]) [12.44.246.82]:46256: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.170.189.164
country_id: 1220409
description:
2025-02-06 17:01:20 dovecot_login authenticator failed for ([79.170.189.164]) [79.170.189.164]:33702: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.20.253.109
country_id: 6252001
description:
Feb  6 17:00:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.20.253.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.124.120
country_id: 1835841
description:
Feb  6 17:00:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.124.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.167.217.147
country_id: 1835841
description:
Feb  6 17:00:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.167.217.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.167.217.147
country_id: 1835841
description:
2025-02-06 17:00:59 dovecot_plain authenticator failed for ([121.167.217.147]) [121.167.217.147]:56940: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.167.114.221
country_id: 390903
description:
2025-02-06 17:01:03 dovecot_plain authenticator failed for ohgtex.static.otenet.gr (clegophy) [195.167.114.221]:60904: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.44.246.82
country_id: 6252001
description:
Feb  6 17:01:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.44.246.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
country_id: 3895114
description:
Feb  6 17:00:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
country_id: 3895114
description:
2025-02-06 17:00:39 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:37921: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.20.253.109
country_id: 6252001
description:
2025-02-06 17:00:44 dovecot_plain authenticator failed for (173-20-253-109.client.mchsi.com) [173.20.253.109]:37732: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 17:00:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2025-02-06 17:00:58 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:42700: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.170.189.164
country_id: 1220409
description:
Feb  6 17:01:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.170.189.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 17:01:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.40.16.26
country_id: 3175395
description:
2025-02-06 17:02:05 dovecot_login authenticator failed for net-2-40-16-26.cust.vodafonedsl.it [2.40.16.26]:59342: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.46.45.121
country_id: 290557
description:
Feb  6 17:01:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.46.45.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.193.163.2
country_id: 1814991
description:
Feb  6 17:01:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.193.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.40.16.26
country_id: 3175395
description:
Feb  6 17:02:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.40.16.26 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.4.25.130
country_id: 3469034
description:
[2025-02-06 17:02:22 +0100] info [webmaild] 45.4.25.130 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2025-02-06 17:01:32 dovecot_login authenticator failed for ([20.46.45.121]) [20.46.45.121]:51128: 535 Incorrect authentication data (set_id=oudoc)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 212.32.238.6
country_id: 2750405
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:loggershell443@gmail.com||WPU:loggershell443@gmail.com||RSV:6.65||T:APACHE||MV:17-01.212.32.238.6


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.193.163.2
country_id: 1814991
description:
2025-02-06 17:01:53 dovecot_login authenticator failed for ([1.193.163.2]) [1.193.163.2]:50436: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.1.60
country_id: 1835841
description:
Feb  6 17:02:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.1.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.1.60
country_id: 1835841
description:
2025-02-06 17:02:47 dovecot_plain authenticator failed for ([175.206.1.60]) [175.206.1.60]:49936: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.33.204.130
country_id: 2017370
description:
Feb  6 17:02:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.33.204.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2025-02-06 17:03:00 dovecot_plain authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:55938: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.34
country_id: 1819730
description:
Feb  6 17:02:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.34
country_id: 1819730
description:
2025-02-06 17:02:32 dovecot_login authenticator failed for (m121-202-152-34.smartone.com) [121.202.152.34]:9483: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.40.90.226
country_id: 286963
description:
[2025-02-06 17:03:17 +0100] info [webmaild] 37.40.90.226 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 17:03:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.151.38.224
country_id: 1269750
description:
Feb  6 17:02:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.151.38.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.151.38.224
country_id: 1269750
description:
2025-02-06 17:02:44 dovecot_login authenticator failed for (undefined.hostname.localhost) [103.151.38.224]:52483: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 17:04:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:17-04.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.202.11
country_id: 1880251
description:
2025-02-06 17:03:32 dovecot_plain authenticator failed for (381859.cloudwaysapps.com) [128.199.202.11]:42172: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.182.165.187
country_id: 3469034
description:
[2025-02-06 17:03:57 +0100] info [webmaild] 201.182.165.187 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 17:04:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.202.11
country_id: 1880251
description:
Feb  6 17:03:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.199.202.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.162.227
country_id: 2017370
description:
Feb  6 17:04:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.162.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.162.227
country_id: 2017370
description:
2025-02-06 17:04:52 dovecot_plain authenticator failed for broadband-178-140-162-227.ip.moscow.rt.ru [178.140.162.227]:57040: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.250.225.23
country_id: 6252001
description:
2025-02-06 17:05:00 dovecot_login authenticator failed for syn-172-250-225-023.res.spectrum.com [172.250.225.23]:51142: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.78.1.149
country_id: 1562822
description:
Feb  6 17:05:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.78.1.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.7.225.113
country_id: 3508796
description:
Feb  6 17:04:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.7.225.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.58.130.22
country_id: 1814991
description:
2025-02-06 17:05:13 dovecot_plain authenticator failed for ([58.58.130.22]) [58.58.130.22]:46073: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.7.225.113
country_id: 3508796
description:
2025-02-06 17:04:32 dovecot_plain authenticator failed for (113.225.7.186.f.dyn.claro.net.do) [186.7.225.113]:24233: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.26.63.158
country_id: 1814991
description:
Feb  6 17:04:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.26.63.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.142.56.236
country_id: 1814991
description:
Feb  6 17:05:00 ait sshd[1301855]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.142.56.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.117.173.81
country_id: 1814991
description:
Feb  6 17:05:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.117.173.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.117.173.81
country_id: 1814991
description:
2025-02-06 17:05:10 dovecot_plain authenticator failed for ([183.237.61.147]) [113.117.173.81]:48915: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.58.130.22
country_id: 1814991
description:
Feb  6 17:05:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.58.130.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.78.1.149
country_id: 1562822
description:
2025-02-06 17:05:22 dovecot_login authenticator failed for ([112.78.1.149]) [112.78.1.149]:43050: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.177.137.33
country_id: 3469034
description:
[2025-02-06 17:04:47 +0100] info [webmaild] 191.177.137.33 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2025-02-06 17:04:47 dovecot_plain authenticator failed for ([110.77.137.236]) [110.77.137.236]:39042: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.250.225.23
country_id: 6252001
description:
Feb  6 17:04:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.250.225.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.26.63.158
country_id: 1814991
description:
2025-02-06 17:04:58 dovecot_plain authenticator failed for ([36.26.63.158]) [36.26.63.158]:40373: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.142.56.236
country_id: 1814991
description:
Feb  6 17:05:00 ait sshd[1301855]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.142.56.236


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.77.137.236
country_id: 1605651
description:
Feb  6 17:04:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.77.137.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.27.171.154
country_id: 1814991
description:
Feb  6 17:06:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.27.171.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.80.222
country_id: 1814991
description:
2025-02-06 17:05:59 dovecot_plain authenticator failed for ([1.31.80.222]) [1.31.80.222]:46498: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.253
country_id: 1819730
description:
2025-02-06 17:06:09 dovecot_plain authenticator failed for (m121-202-152-253.smartone.com) [121.202.152.253]:14286: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.110.10.192
country_id: 2623032
description:
Feb  6 17:05:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.110.10.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.200.80.226
country_id: 290557
description:
Feb  6 17:05:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.200.80.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
country_id: 1835841
description:
Feb  6 17:06:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
country_id: 1835841
description:
2025-02-06 17:06:26 dovecot_login authenticator failed for ([61.81.151.97]) [61.81.151.97]:51346: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2025-02-06 17:06:17 dovecot_plain authenticator failed for ([118.45.101.159]) [118.45.101.159]:54647: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.233.251.193
country_id: 2017370
description:
[2025-02-06 17:06:24 +0100] info [webmaild] 94.233.251.193 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.253
country_id: 1819730
description:
Feb  6 17:06:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.45.101.159
country_id: 1835841
description:
Feb  6 17:06:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.45.101.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.23.77.27
country_id: 1814991
description:
2025-02-06 17:06:04 dovecot_plain authenticator failed for ([14.23.77.27]) [14.23.77.27]:60936: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.131.55
country_id: 1269750
description:
2025-02-06 17:06:11 dovecot_login authenticator failed for (abts-mum-static-055.131.179.122.airtelbroadband.in) [122.179.131.55]:44060: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.110.10.192
country_id: 2623032
description:
2025-02-06 17:05:33 dovecot_login authenticator failed for ([2.110.10.192]) [2.110.10.192]:49052: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.27.171.154
country_id: 1814991
description:
2025-02-06 17:06:02 dovecot_login authenticator failed for ([1.27.171.154]) [1.27.171.154]:36920: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.31.80.222
country_id: 1814991
description:
Feb  6 17:05:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.31.80.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.225.236
country_id: 732800
description:
2025-02-06 17:06:19 dovecot_login authenticator failed for 95-87-225-236.ip.btc-net.bg [95.87.225.236]:52258: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.80.226
country_id: 290557
description:
2025-02-06 17:05:44 dovecot_login authenticator failed for ([94.200.80.226]) [94.200.80.226]:52177: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.23.77.27
country_id: 1814991
description:
Feb  6 17:06:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.23.77.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.179.131.55
country_id: 1269750
description:
Feb  6 17:06:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.179.131.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.206.153
country_id: 6252001
description:
Feb  6 17:05:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.206.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.206.153
country_id: 6252001
description:
2025-02-06 17:05:50 dovecot_login authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:57632: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.225.236
country_id: 732800
description:
Feb  6 17:06:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.225.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
country_id: 3351879
description:
2025-02-06 17:07:03 dovecot_plain authenticator failed for ([41.63.165.61]) [41.63.165.61]:6709: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.217.22
country_id: 3017382
description:
2025-02-06 17:07:17 dovecot_login authenticator failed for (ADMIN) [191.101.217.22]:50184: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.144.239.225
country_id: 6252001
description:
Feb  6 17:06:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.144.239.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.144.239.225
country_id: 6252001
description:
2025-02-06 17:06:33 dovecot_login authenticator failed for 225.sub-166-144-239.myvzw.com [166.144.239.225]:35520: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.14.180.33
country_id: 1814991
description:
2025-02-06 17:06:53 dovecot_plain authenticator failed for ([218.14.180.33]) [218.14.180.33]:33067: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.124.137.108
country_id: 3469034
description:
[2025-02-06 17:07:18 +0100] info [webmaild] 179.124.137.108 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.14.180.33
country_id: 1814991
description:
Feb  6 17:06:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.14.180.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.165.61
country_id: 3351879
description:
Feb  6 17:07:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.165.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 17:07:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.101.217.22
country_id: 3017382
description:
Feb  6 17:07:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.101.217.22 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.127.82
country_id: 1814991
description:
Feb  6 17:08:02 ait sshd[1303528]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.127.82


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.26.98
country_id: 1814991
description:
2025-02-06 17:08:09 dovecot_login authenticator failed for ([59.46.26.98]) [59.46.26.98]:32815: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.223.154.170
country_id: 2403846
description:
Feb  6 17:07:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.223.154.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.100
country_id: 1819730
description:
2025-02-06 17:07:30 dovecot_plain authenticator failed for (m121-202-154-100.smartone.com) [121.202.154.100]:27554: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.104.103
country_id: 1668284
description:
Feb  6 17:07:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.104.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.104.103
country_id: 1668284
description:
2025-02-06 17:07:44 dovecot_plain authenticator failed for 110-25-104-103.adsl.fetnet.net [110.25.104.103]:34930: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2025-02-06 17:07:45 dovecot_plain authenticator failed for ([183.99.89.74]) [183.99.89.74]:41452: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.100
country_id: 1819730
description:
Feb  6 17:07:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.150.112.242
country_id: 1880251
description:
Feb  6 17:07:35 ait sshd[1303254]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.150.112.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.253
country_id: 1819730
description:
2025-02-06 17:08:24 dovecot_plain authenticator failed for (m121-202-152-253.smartone.com) [121.202.152.253]:57262: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.46.26.98
country_id: 1814991
description:
Feb  6 17:08:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.46.26.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
country_id: 2542007
description:
Feb  6 17:08:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-02-06 17:08:19 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:58700: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.253
country_id: 1819730
description:
Feb  6 17:08:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.223.154.170
country_id: 2403846
description:
2025-02-06 17:07:31 dovecot_plain authenticator failed for ([102.223.154.170]) [102.223.154.170]:57696: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.150.112.242
country_id: 1880251
description:
Feb  6 17:07:35 ait sshd[1303254]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.150.112.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.99.89.74
country_id: 1835841
description:
Feb  6 17:07:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.99.89.74 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 36.50.72.243
country_id: 1168579
description:
[2025-02-06 17:08:13 +0100] info [webmaild] 36.50.72.243 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2025-02-06 17:09:10 dovecot_plain authenticator failed for ([122.186.174.35]) [122.186.174.35]:49126: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.126.228
country_id: 1835841
description:
2025-02-06 17:08:52 dovecot_login authenticator failed for ([114.108.126.228]) [114.108.126.228]:51812: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.111.109.240
country_id: 3469034
description:
[2025-02-06 17:08:57 +0100] info [webmaild] 179.111.109.240 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2025-02-06 17:09:02 dovecot_login authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:55367: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.247.88
country_id: 1814991
description:
Feb  6 17:09:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.247.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.112.141.230
country_id: 2750405
description:
2025-02-06 17:09:12 dovecot_plain authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:54686: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.176.149.10
country_id: 1269750
description:
Feb  6 17:09:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.176.149.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.126.228
country_id: 1835841
description:
Feb  6 17:08:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.126.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.186.174.35
country_id: 1269750
description:
Feb  6 17:09:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.186.174.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.115.164
country_id: 1814991
description:
Feb  6 17:09:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.115.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.18.252.107
country_id: 1814991
description:
2025-02-06 17:09:00 dovecot_plain authenticator failed for ([14.18.252.107]) [14.18.252.107]:11317: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.112.141.230
country_id: 2750405
description:
Feb  6 17:09:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.112.141.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.149.10
country_id: 1269750
description:
2025-02-06 17:09:19 dovecot_plain authenticator failed for (abts-north-dynamic-010.149.176.122.airtelbroadband.in) [122.176.149.10]:57998: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.0.131
country_id: 1835841
description:
Feb  6 17:08:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.0.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.0.131
country_id: 1835841
description:
2025-02-06 17:08:38 dovecot_plain authenticator failed for ([123.212.0.131]) [123.212.0.131]:43270: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.43.202.110
country_id: 2017370
description:
2025-02-06 17:08:46 dovecot_plain authenticator failed for ([31.43.202.110]) [31.43.202.110]:38732: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.18.252.107
country_id: 1814991
description:
Feb  6 17:08:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.18.252.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.43.202.110
country_id: 2017370
description:
Feb  6 17:08:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.43.202.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.152
country_id: 1269750
description:
Feb  6 17:09:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.247.88
country_id: 1814991
description:
2025-02-06 17:09:06 dovecot_plain authenticator failed for ([183.220.247.88]) [183.220.247.88]:59824: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.115.164
country_id: 1814991
description:
2025-02-06 17:09:12 dovecot_plain authenticator failed for ([218.94.115.164]) [218.94.115.164]:43078: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.0.8.92
country_id: 798544
description:
Feb  6 17:09:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.0.8.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.240.2.38
country_id: 1814991
description:
2025-02-06 17:09:47 dovecot_plain authenticator failed for ([58.240.2.38]) [58.240.2.38]:52745: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.228.225.21
country_id: 1814991
description:
Feb  6 17:09:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.228.225.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.21
country_id: 1814991
description:
2025-02-06 17:09:44 dovecot_plain authenticator failed for ([122.228.225.21]) [122.228.225.21]:59108: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.57.78.222
country_id: 1835841
description:
2025-02-06 17:09:27 dovecot_plain authenticator failed for ([211.57.78.222]) [211.57.78.222]:59622: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.0.8.92
country_id: 798544
description:
2025-02-06 17:09:27 dovecot_plain authenticator failed for (apn-31-0-8-92.static.gprs.plus.pl) [31.0.8.92]:55572: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.240.2.38
country_id: 1814991
description:
Feb  6 17:09:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.240.2.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.78.222
country_id: 1835841
description:
Feb  6 17:09:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.78.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.34.168.162
country_id: 1814991
description:
Feb  6 17:09:41 ait sshd[1304240]: pam_imunify(sshd:auth): [IM360_RBL] The IP 58.34.168.162 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 58.34.168.162
country_id: 1814991
description:
Feb  6 17:09:41 ait sshd[1304240]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.34.168.162  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 69.163.243.80
country_id: 6252001
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:17-09.69.163.243.80


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.142.56.236
country_id: 1814991
description:
Feb  6 17:10:31 ait sshd[1304792]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.142.56.236 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.158.132.226
country_id: 2400553
description:
[2025-02-06 17:11:23 +0100] info [webmaild] 41.158.132.226 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:17-10.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.202.11
country_id: 1880251
description:
Feb  6 17:10:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.199.202.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.56.151.234
country_id: 1814991
description:
Feb  6 17:11:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.56.151.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 17:10:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.150.112.242
country_id: 1880251
description:
Feb  6 17:10:38 ait sshd[1304808]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.150.112.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.202.11
country_id: 1880251
description:
2025-02-06 17:10:49 dovecot_plain authenticator failed for (381859.cloudwaysapps.com) [128.199.202.11]:30686: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.56.151.234
country_id: 1814991
description:
2025-02-06 17:11:13 dovecot_plain authenticator failed for ([58.56.151.234]) [58.56.151.234]:38752: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.48.104.200
country_id: 1814991
description:
2025-02-06 17:11:15 dovecot_plain authenticator failed for ([112.48.104.200]) [112.48.104.200]:53080: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.142.56.236
country_id: 1814991
description:
Feb  6 17:10:31 ait sshd[1304792]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.142.56.236


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.150.112.242
country_id: 1880251
description:
Feb  6 17:10:38 ait sshd[1304808]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.150.112.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.48.104.200
country_id: 1814991
description:
Feb  6 17:11:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.48.104.200 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.114.99.2
country_id: 1210997
description:
[2025-02-06 17:10:29 +0100] info [webmaild] 103.114.99.2 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.169
country_id: 1835841
description:
2025-02-06 17:11:26 dovecot_plain authenticator failed for ([220.77.182.169]) [220.77.182.169]:34077: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.186.110.194
country_id: 298795
description:
Feb  6 17:11:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.186.110.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.110.194
country_id: 298795
description:
2025-02-06 17:11:56 dovecot_plain authenticator failed for (quipseurt) [78.186.110.194]:46398: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.142.56.236
country_id: 1814991
description:
Feb  6 17:12:11 ait sshd[1305339]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.142.56.236


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.112.242
country_id: 1880251
description:
Feb  6 17:12:12 ait sshd[1305341]: Failed password for invalid user newftpuser from 107.150.112.242 port 60132 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.145.132.156
country_id: 1210997
description:
[2025-02-06 17:12:20 +0100] info [webmaild] 103.145.132.156 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.182.169
country_id: 1835841
description:
Feb  6 17:11:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.182.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.150.112.242
country_id: 1880251
description:
Feb  6 17:12:09 ait sshd[1305341]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.150.112.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.150.112.242
country_id: 1880251
description:
Feb  6 17:12:09 ait sshd[1305341]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.150.112.242


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.142.56.236
country_id: 1814991
description:
Feb  6 17:12:11 ait sshd[1305339]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.142.56.236 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.197.236.232
country_id: 3469034
description:
[2025-02-06 17:13:05 +0100] info [webmaild] 168.197.236.232 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.110.120.96
country_id: 3469034
description:
Feb  6 17:13:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.110.120.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.110.120.96
country_id: 3469034
description:
2025-02-06 17:13:23 dovecot_plain authenticator failed for ([189.110.120.96]) [189.110.120.96]:43692: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.218.181.19
country_id: 3625428
description:
Feb  6 17:12:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.218.181.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.238.213
country_id: 3017382
description:
Feb  6 17:13:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.238.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.36.238.213
country_id: 3017382
description:
2025-02-06 17:13:40 dovecot_plain authenticator failed for ip213.ip-54-36-238.eu [54.36.238.213]:48692: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.196.230
country_id: 1814991
description:
2025-02-06 17:14:03 dovecot_plain authenticator failed for ([118.122.196.230]) [118.122.196.230]:57460: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.42.116.198
country_id: 2750405
description:
Feb  6 17:14:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.42.116.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
country_id: 1835841
description:
Feb  6 17:13:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.13.138.138
country_id: 1814991
description:
Feb  6 17:13:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.13.138.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.13.138.138
country_id: 1814991
description:
2025-02-06 17:13:47 dovecot_plain authenticator failed for (hn.kd.smx.adsl) [221.13.138.138]:46864: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:17-14.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2025-02-06 17:13:34 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:45966: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.57.221
country_id: 2017370
description:
2025-02-06 17:13:30 dovecot_plain authenticator failed for (95x79x57x221.static-business.nn.ertelecom.ru) [95.79.57.221]:57020: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
country_id: 2017370
description:
Feb  6 17:14:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.57.221
country_id: 2017370
description:
Feb  6 17:13:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.57.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
country_id: 2017370
description:
2025-02-06 17:14:02 dovecot_plain authenticator failed for (13-78-123-185.host.cirex.ru) [185.123.78.13]:10099: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.243.43.58
country_id: 1835841
description:
Feb  6 17:14:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.243.43.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.243.43.58
country_id: 1835841
description:
2025-02-06 17:14:20 dovecot_plain authenticator failed for ([211.243.43.58]) [211.243.43.58]:54436: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.196.230
country_id: 1814991
description:
Feb  6 17:14:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.196.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 17:14:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.253.152
country_id: 99237
description:
2025-02-06 17:14:48 dovecot_plain authenticator failed for (refulacess) [65.20.253.152]:60415: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.224.198
country_id: 99237
description:
Feb  6 17:14:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.224.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.224.198
country_id: 99237
description:
2025-02-06 17:14:45 dovecot_plain authenticator failed for (arriate) [65.20.224.198]:54539: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.253.152
country_id: 99237
description:
Feb  6 17:14:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.253.152 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.74.31.222
country_id: 3703430
description:
[2025-02-06 17:14:54 +0100] info [webmaild] 186.74.31.222 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.70.166.51
country_id: 298795
description:
Feb  6 17:16:11 ait sshd[1307120]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.70.166.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.70.166.51
country_id: 298795
description:
Feb  6 17:16:11 ait sshd[1307120]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.70.166.51


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.235.48.227
country_id: 3469034
description:
[2025-02-06 17:15:51 +0100] info [webmaild] 186.235.48.227 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.35
country_id: 1819730
description:
2025-02-06 17:15:54 dovecot_login authenticator failed for (m121-202-152-35.smartone.com) [121.202.152.35]:24766: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.188.117
country_id: 294640
description:
2025-02-06 17:16:10 dovecot_plain authenticator failed for ([82.102.188.117]) [82.102.188.117]:41476: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.85.69.22
country_id: 2017370
description:
Feb  6 17:15:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.85.69.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.35
country_id: 1819730
description:
Feb  6 17:15:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.170.102
country_id: 1814991
description:
Feb  6 17:15:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.170.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.192.168
country_id: 1835841
description:
Feb  6 17:16:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.192.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.192.168
country_id: 1835841
description:
2025-02-06 17:16:12 dovecot_login authenticator failed for ([220.80.192.168]) [220.80.192.168]:33854: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.85.69.22
country_id: 2017370
description:
2025-02-06 17:15:45 dovecot_plain authenticator failed for ([194.85.69.22]) [194.85.69.22]:53792: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.170.102
country_id: 1814991
description:
2025-02-06 17:15:58 dovecot_plain authenticator failed for ([183.234.170.102]) [183.234.170.102]:29150: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.102.188.117
country_id: 294640
description:
Feb  6 17:16:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.102.188.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.20.131
country_id: 1835841
description:
2025-02-06 17:17:22 dovecot_login authenticator failed for ([123.212.20.131]) [123.212.20.131]:59280: 535 Incorrect authentication data (set_id=info)


