# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.218.10.21
description:
2025-02-05 21:29:53 dovecot_plain authenticator failed for ([118.218.10.21]) [118.218.10.21]:46247: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.139.150.2
description:
2025-02-05 21:29:04 dovecot_plain authenticator failed for 2.sub-166-139-150.myvzw.com [166.139.150.2]:54720: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.72
description:
2025-02-05 21:29:15 dovecot_plain authenticator failed for (72.20.167.124.adsl-pool.sx.cn) [124.167.20.72]:52930: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.101.16.250
description:
Feb  5 21:28:59 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.101.16.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.35
description:
Feb  5 21:29:01 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.204.158.2
description:
2025-02-05 21:29:02 dovecot_plain authenticator failed for 2.189-204-158.bestelclientes.com.mx [189.204.158.2]:46567: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.245.16
description:
2025-02-05 21:29:09 dovecot_plain authenticator failed for ([220.80.245.16]) [220.80.245.16]:46621: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.63.46.34
description:
Feb  5 21:29:17 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.63.46.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.225.194.121
description:
Feb  5 21:29:19 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.225.194.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.45.225.98
description:
2025-02-05 21:29:29 dovecot_plain authenticator failed for ([69.45.225.98]) [69.45.225.98]:60262: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.142.41.167
description:
2025-02-05 21:28:59 dovecot_plain authenticator failed for ([78.142.41.167]) [78.142.41.167]:60614: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.245.16
description:
Feb  5 21:29:07 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.245.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.93.113.138
description:
Feb  5 21:29:08 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.93.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.156.14
description:
2025-02-05 21:29:04 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.156.14]:52605: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.3.133.47
description:
Feb  5 21:29:22 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.3.133.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.190.181
description:
Feb  5 21:29:25 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.190.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.184.218.49
description:
Feb  5 21:29:00 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.184.218.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-02-05 21:29:02 dovecot_plain authenticator failed for ([216.194.174.103]) [216.194.174.27]:1938: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.111.65
description:
2025-02-05 21:29:03 dovecot_plain authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:42558: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.31.219
description:
2025-02-05 21:29:18 dovecot_plain authenticator failed for ([103.115.31.219]) [103.115.31.219]:55112: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.175.76.146
description:
Feb  5 21:29:42 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.175.76.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.233.177
description:
2025-02-05 21:29:50 dovecot_plain authenticator failed for (nsg-corporate-177.233.187.122.airtel.in) [122.187.233.177]:53266: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.156.14
description:
Feb  5 21:29:02 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.156.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
description:
2025-02-05 21:29:08 dovecot_plain authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:49457: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.173.10.75
description:
Feb  5 21:29:10 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.173.10.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.238.237.254
description:
2025-02-05 21:29:04 dovecot_plain authenticator failed for ([211.238.237.254]) [211.238.237.254]:51849: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.7.10
description:
2025-02-05 21:29:18 dovecot_plain authenticator failed for ([120.194.7.10]) [120.194.7.10]:34481: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.213.49.15
description:
Feb  5 21:29:26 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.213.49.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.91.144
description:
2025-02-05 21:29:46 dovecot_plain authenticator failed for ([58.16.91.144]) [58.16.91.144]:51903: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.44.76.103
description:
Feb  5 21:28:57 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.44.76.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
description:
2025-02-05 21:29:02 dovecot_plain authenticator failed for (imparhoteis.static.gvt.net.br) [179.184.218.49]:34037: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
description:
2025-02-05 21:29:04 dovecot_plain authenticator failed for ([90.161.217.228]) [90.161.217.228]:35557: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.253.10.61
description:
Feb  5 21:29:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.253.10.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.103.248.120
description:
2025-02-05 21:28:58 dovecot_plain authenticator failed for ([91.103.248.120]) [91.103.248.120]:39689: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.253
description:
Feb  5 21:29:15 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.65
description:
Feb  5 21:29:20 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.15.163.18
description:
2025-02-05 21:29:20 dovecot_plain authenticator failed for wsip-68-15-163-18.no.no.cox.net [68.15.163.18]:53691: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.225.194.121
description:
2025-02-05 21:29:21 dovecot_plain authenticator failed for (45-225-194-121.ibiunet.com.br) [45.225.194.121]:47334: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
description:
2025-02-05 21:29:25 dovecot_plain authenticator failed for ([37.224.119.19]) [37.224.119.19]:58820: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.85.68.71
description:
2025-02-05 21:29:06 dovecot_plain authenticator failed for ([220.85.68.71]) [220.85.68.71]:19493: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.111.113
description:
2025-02-05 21:29:13 dovecot_plain authenticator failed for ([221.0.111.113]) [221.0.111.113]:43762: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.146.121.12
description:
2025-02-05 21:29:15 dovecot_plain authenticator failed for ([61.146.121.12]) [61.146.121.12]:53018: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.7.10
description:
Feb  5 21:29:16 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.7.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.34.165.114
description:
Feb  5 21:29:17 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.34.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.63.46.34
description:
2025-02-05 21:29:19 dovecot_plain authenticator failed for ([203.29.84.253]) [203.63.46.34]:2519: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-02-05 21:29:26 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (60-242-84-9.static.tpgi.com.au) [110.175.220.250]:51353: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Feb  5 21:28:57 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.44.76.103
description:
2025-02-05 21:28:59 dovecot_plain authenticator failed for 207.44.76.103.res-cmts.hol.ptd.net [207.44.76.103]:55954: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.24.194.207
description:
Feb  5 21:29:09 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.24.194.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.185.89.241
description:
2025-02-05 21:29:24 dovecot_plain authenticator failed for ([39.185.89.241]) [39.185.89.241]:39405: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.3.133.47
description:
2025-02-05 21:29:24 dovecot_plain authenticator failed for ([183.3.133.47]) [183.3.133.47]:43118: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.41.137
description:
Feb  5 21:28:58 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.41.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.111.65
description:
Feb  5 21:29:01 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.111.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.134.109.253
description:
2025-02-05 21:29:03 dovecot_plain authenticator failed for ([124.134.109.253]) [124.134.109.253]:58918: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
description:
2025-02-05 21:29:44 dovecot_plain authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:43492: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.62
description:
Feb  5 21:29:01 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.161.217.228
description:
Feb  5 21:29:02 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.161.217.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
description:
2025-02-05 21:29:03 dovecot_plain authenticator failed for ([114.242.61.19]) [114.242.61.35]:33764: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.24.194.207
description:
2025-02-05 21:29:11 dovecot_plain authenticator failed for ([59.24.194.207]) [59.24.194.207]:46723: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.49.60.24
description:
Feb  5 21:29:14 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.49.60.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.125.34
description:
2025-02-05 21:29:34 dovecot_plain authenticator failed for ([182.176.125.34]) [182.176.125.34]:43149: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.20.146
description:
Feb  5 21:29:01 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.20.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.238.237.254
description:
Feb  5 21:29:02 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.238.237.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.29
description:
Feb  5 21:29:08 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
description:
2025-02-05 21:29:16 dovecot_plain authenticator failed for ([112.194.142.167]) [112.194.142.167]:43018: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.121.147
description:
2025-02-05 21:28:57 dovecot_plain authenticator failed for ([82.193.121.147]) [82.193.121.147]:47353: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.146.121.12
description:
Feb  5 21:29:13 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.146.121.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.152.225.58
description:
Feb  5 21:29:15 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.152.225.58 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 102.218.215.240
description:
Feb  5 21:29:31 ait sshd[801735]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.218.215.240


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-02-05 21:29:31 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:60583: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
description:
2025-02-05 21:29:39 dovecot_plain authenticator failed for ([125.139.124.120]) [125.139.124.120]:33334: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.201.37
description:
Feb  5 21:29:43 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.201.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.204.158.2
description:
Feb  5 21:29:00 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.204.158.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.220.16.46
description:
2025-02-05 21:29:03 dovecot_plain authenticator failed for ([119.220.16.46]) [119.220.16.46]:59770: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.111
description:
2025-02-05 21:29:17 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.111]:52178: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.22.68.213
description:
Feb  5 21:29:21 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.22.68.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
description:
Feb  5 21:29:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
description:
2025-02-05 21:29:32 dovecot_plain authenticator failed for ([220.161.52.149]) [220.161.52.149]:45467: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.16.21
description:
2025-02-05 21:29:43 dovecot_plain authenticator failed for (201.173.16.21-clientes-izzi.mx) [201.173.16.21]:53877: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Feb  5 21:28:58 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.16.4
description:
Feb  5 21:29:09 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.16.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.49.60.24
description:
2025-02-05 21:29:16 dovecot_plain authenticator failed for (l49-60-24.novotelecom.ru) [178.49.60.24]:54130: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.69.156
description:
Feb  5 21:29:15 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.69.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.97.198
description:
2025-02-05 21:29:16 dovecot_plain authenticator failed for ([197.156.97.198]) [197.156.97.198]:38020: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.31.219
description:
Feb  5 21:29:16 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.31.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.253
description:
2025-02-05 21:29:17 dovecot_plain authenticator failed for (m121-202-152-253.smartone.com) [121.202.152.253]:62308: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.220.235
description:
2025-02-05 21:29:17 dovecot_plain authenticator failed for ([118.122.220.235]) [118.122.220.235]:59668: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.90.114
description:
2025-02-05 21:29:01 dovecot_plain authenticator failed for ([58.18.90.114]) [58.18.90.114]:36168: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.92.192.154
description:
Feb  5 21:29:03 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.92.192.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.99.228.131
description:
Feb  5 21:29:12 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.99.228.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.152.225.58
description:
2025-02-05 21:29:17 dovecot_plain authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:52477: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
description:
2025-02-05 21:29:22 dovecot_plain authenticator failed for ([121.202.138.181]) [121.202.138.181]:53172: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.218.215.240
description:
Feb  5 21:29:31 ait sshd[801735]: pam_imunify(sshd:auth): [IM360_RBL] The IP 102.218.215.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.11.145.81
description:
2025-02-05 21:29:07 dovecot_plain authenticator failed for ([121.11.145.81]) [121.11.145.81]:46827: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.228.131
description:
2025-02-05 21:29:14 dovecot_plain authenticator failed for ([183.99.228.131]) [183.99.228.131]:36920: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.253.10.61
description:
2025-02-05 21:29:25 dovecot_plain authenticator failed for ([211.253.10.61]) [211.253.10.61]:56951: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.93.113.138
description:
2025-02-05 21:29:10 dovecot_plain authenticator failed for ([41.93.113.138]) [41.93.113.138]:37054: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.111
description:
Feb  5 21:29:15 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
description:
2025-02-05 21:29:15 dovecot_plain authenticator failed for ([27.223.100.91]) [27.223.100.90]:43058: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.155.40.158
description:
2025-02-05 21:29:22 dovecot_plain authenticator failed for ([218.155.40.158]) [218.155.40.158]:45767: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Feb  5 21:29:29 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.134.109.253
description:
Feb  5 21:29:01 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.134.109.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.11.145.81
description:
Feb  5 21:29:05 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.11.145.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.247
description:
Feb  5 21:29:06 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.173.16.21
description:
Feb  5 21:29:41 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.173.16.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.233.177
description:
Feb  5 21:29:48 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.233.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.198.201
description:
Feb  5 21:29:01 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.198.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.106
description:
2025-02-05 21:29:03 dovecot_plain authenticator failed for 111-70-49-106.emome-ip.hinet.net [111.70.49.106]:35219: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.209.169.77
description:
Feb  5 21:29:29 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.209.169.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.148.186.186
description:
Feb  5 21:29:08 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.148.186.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.148.186.186
description:
2025-02-05 21:29:10 dovecot_plain authenticator failed for ([116.148.186.186]) [116.148.186.186]:48528: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
description:
2025-02-05 21:29:12 dovecot_plain authenticator failed for ([209.173.10.75]) [209.173.10.75]:51104: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.133.10.204
description:
Feb  5 21:29:01 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.133.10.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.20.146
description:
2025-02-05 21:29:03 dovecot_plain authenticator failed for ([31.173.20.146]) [31.173.20.146]:50054: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.92.192.154
description:
2025-02-05 21:29:05 dovecot_plain authenticator failed for ([186.200.143.68]) [187.92.192.154]:36966: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.165.114
description:
2025-02-05 21:29:19 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:41075: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.155.40.158
description:
Feb  5 21:29:20 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.155.40.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
description:
2025-02-05 21:29:01 dovecot_plain authenticator failed for ([185.134.179.106]) [185.101.16.250]:54225: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.191.253.130
description:
Feb  5 21:29:04 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.191.253.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.244.155.242
description:
[2025-02-05 21:29:12 +0100] info [webmaild] 185.244.155.242 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.124.120
description:
Feb  5 21:29:37 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.124.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.91.144
description:
Feb  5 21:29:44 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.91.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.193.121.147
description:
Feb  5 21:28:55 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.193.121.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.137.140
description:
Feb  5 21:29:04 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.137.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.22.68.213
description:
2025-02-05 21:29:23 dovecot_plain authenticator failed for ([59.22.68.213]) [59.22.68.213]:50188: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.138.181
description:
Feb  5 21:29:20 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.138.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.161.52.149
description:
Feb  5 21:29:30 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.161.52.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.142.41.167
description:
Feb  5 21:28:57 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.142.41.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.252.98.159
description:
Feb  5 21:29:00 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.252.98.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.220.16.46
description:
Feb  5 21:29:01 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.220.16.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.207.134
description:
Feb  5 21:29:11 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.207.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.213.49.15
description:
2025-02-05 21:29:28 dovecot_plain authenticator failed for 15.49.213.185.dynamic.electronicamartinez.es [185.213.49.15]:40213: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.90.114
description:
Feb  5 21:28:59 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.90.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.139.150.2
description:
Feb  5 21:29:02 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.139.150.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
description:
2025-02-05 21:29:05 dovecot_plain authenticator failed for 51.174.157.77.rev.sfr.net [77.157.174.51]:41578: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.227.194
description:
2025-02-05 21:29:00 dovecot_plain authenticator failed for ([196.200.227.78]) [196.200.227.194]:52734: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.201
description:
2025-02-05 21:29:03 dovecot_plain authenticator failed for (m121-202-198-201.smartone.com) [121.202.198.201]:14819: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.26.153.102
description:
Feb  5 21:29:07 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.26.153.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
description:
2025-02-05 21:29:12 dovecot_plain authenticator failed for wsip-64-207-225-55.tu.ok.cox.net (wsip-64-207-241-177.tu.ok.cox.net) [64.207.225.55]:56053: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.65
description:
2025-02-05 21:29:22 dovecot_plain authenticator failed for (m121-202-154-65.smartone.com) [121.202.154.65]:12261: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.106
description:
Feb  5 21:29:01 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.133.10.204
description:
2025-02-05 21:29:03 dovecot_plain authenticator failed for ([61.133.10.205]) [61.133.10.204]:37582: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.191.253.130
description:
2025-02-05 21:29:06 dovecot_plain authenticator failed for syn-068-191-253-130.biz.spectrum.com ([68.191.253.131]) [68.191.253.130]:53090: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.200.227.194
description:
Feb  5 21:28:58 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.200.227.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.220.235
description:
Feb  5 21:29:15 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.220.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 21:30:08 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.196.12.3
description:
[2025-02-05 21:30:10 +0100] info [webmaild] 181.196.12.3 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.37.212.85
description:
Feb  5 21:30:35 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.37.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
description:
2025-02-05 21:30:37 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (myocose) [176.37.212.85]:36194: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.187.163.149
description:
[2025-02-05 21:30:39 +0100] info [webmaild] 45.187.163.149 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.233.156.7
description:
[2025-02-05 21:31:10 +0100] info [webmaild] 181.233.156.7 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
description:
2025-02-05 21:31:28 dovecot_plain authenticator failed for 195-159-217-71.customer.powertech.no (eless) [195.159.217.71]:60842: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.164.245.110
description:
Feb  5 21:31:31 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.164.245.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 21:31:34 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.227.100.245
description:
[2025-02-05 21:31:44 +0100] info [webmaild] 45.227.100.245 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.57.111.99
description:
2025-02-05 21:31:10 dovecot_plain authenticator failed for ([211.57.111.99]) [211.57.111.99]:50662: 535 Incorrect authentication data (set_id=sarpong-nsiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.111.99
description:
Feb  5 21:31:08 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.111.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.159.217.71
description:
Feb  5 21:31:26 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.159.217.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.245.110
description:
2025-02-05 21:31:33 dovecot_plain authenticator failed for ([112.164.245.110]) [112.164.245.110]:56840: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.204.41.78
description:
Feb  5 21:30:54 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.204.41.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.95.150.16
description:
Feb  5 21:31:41 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.95.150.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 21:31:33 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.95.150.16
description:
2025-02-05 21:31:43 dovecot_plain authenticator failed for syn-070-095-150-016.res.spectrum.com [70.95.150.16]:59536: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.204.41.78
description:
2025-02-05 21:30:56 dovecot_plain authenticator failed for ([183.204.41.78]) [183.204.41.78]:54875: 535 Incorrect authentication data (set_id=sarpong-nsiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.151.19
description:
Feb  5 21:32:33 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.151.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.102.199.89
description:
Feb  5 21:32:41 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.102.199.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.52.204.227
description:
Feb  5 21:32:44 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.52.204.227 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.71.220.42
description:
[2025-02-05 21:32:46 +0100] info [webmaild] 188.71.220.42 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.47.190
description:
Feb  5 21:32:52 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.47.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.48.98.125
description:
Feb  5 21:32:30 ait sshd[803145]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.48.98.125 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.98.125
description:
Feb  5 21:32:30 ait sshd[803145]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.98.125  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.151.19
description:
2025-02-05 21:32:35 dovecot_plain authenticator failed for ([95.165.151.19]) [95.165.151.19]:51444: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.52.204.227
description:
2025-02-05 21:32:46 dovecot_plain authenticator failed for ([46.52.204.227]) [46.52.204.227]:41162: 535 Incorrect authentication data (set_id=assdas1)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:21-32.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.199.89
description:
2025-02-05 21:32:43 dovecot_plain authenticator failed for ([112.102.199.89]) [112.102.199.89]:55248: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
description:
2025-02-05 21:32:54 dovecot_plain authenticator failed for ([185.255.47.190]) [185.255.47.190]:59564: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.35.155.182
description:
2025-02-05 21:33:09 dovecot_plain authenticator failed for (dsl-178-35-155-182.avtlg.ru) [178.35.155.182]:44829: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.202.91.52
description:
2025-02-05 21:33:13 dovecot_plain authenticator failed for (host-196.202.91.52-static.tedata.net) [196.202.91.52]:54625: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.234
description:
2025-02-05 21:33:18 dovecot_plain authenticator failed for ([61.185.226.234]) [61.185.226.234]:54732: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.145.54.48
description:
Feb  5 21:32:55 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.145.54.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.166.78
description:
2025-02-05 21:33:00 dovecot_plain authenticator failed for (223-197-166-78.static.imsbiz.com) [223.197.166.78]:51054: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.177.247.242
description:
Feb  5 21:33:01 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.177.247.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.177.247.242
description:
2025-02-05 21:33:03 dovecot_plain authenticator failed for (host-247342.fivenetwork.com) [202.177.247.242]:37318: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.77.209.140
description:
2025-02-05 21:33:05 dovecot_plain authenticator failed for (host-140.209.77.5.ucom.am) [5.77.209.140]:41117: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.35.155.182
description:
Feb  5 21:33:07 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.35.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.226.234
description:
Feb  5 21:33:16 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.226.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 21:33:51 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.188.103.179
description:
2025-02-05 21:32:56 dovecot_plain authenticator failed for (tagsdev.click) [199.188.103.179]:52132: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.145.54.48
description:
2025-02-05 21:32:57 dovecot_plain authenticator failed for ([103.145.54.48]) [103.145.54.48]:46843: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.166.78
description:
Feb  5 21:32:58 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.166.78 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.42.238.221
description:
[2025-02-05 21:33:16 +0100] info [webmaild] 177.42.238.221 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.188.103.179
description:
Feb  5 21:32:54 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.188.103.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.77.209.140
description:
Feb  5 21:33:03 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.77.209.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.202.91.52
description:
Feb  5 21:33:11 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.202.91.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.118.123.44
description:
2025-02-05 21:34:54 dovecot_plain authenticator failed for syn-172-118-123-044.res.spectrum.com [172.118.123.44]:46353: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 154.161.30.8
domain: iric.us
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:6.65||T:APACHE||MV:/wp-json/wp/v2/users/me?_fields=capabilities&context=edit&_locale=user||


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.168.165.250
description:
Feb  5 21:34:24 ait sshd[803781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.168.165.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.51.34.118
description:
[2025-02-05 21:34:30 +0100] info [webmaild] 181.51.34.118 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.93.183
description:
Feb  5 21:34:51 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.93.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.118.123.44
description:
Feb  5 21:34:52 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.118.123.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.168.165.250
description:
Feb  5 21:34:24 ait sshd[803781]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.168.165.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.170
description:
2025-02-05 21:34:52 dovecot_plain authenticator failed for ([220.77.182.170]) [220.77.182.170]:48801: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
description:
2025-02-05 21:34:53 dovecot_plain authenticator failed for (corporativo.static.gvt.net.br) [189.115.93.183]:56895: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.16.159.24
description:
[2025-02-05 21:33:58 +0100] info [webmaild] 187.16.159.24 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 21:34:38 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.182.170
description:
Feb  5 21:34:50 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.182.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.29.135.230
description:
Feb  5 21:35:03 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.29.135.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.137.159
description:
Feb  5 21:35:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.137.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.207.24
description:
2025-02-05 21:35:37 dovecot_plain authenticator failed for syn-076-176-207-024.res.spectrum.com [76.176.207.24]:53176: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.140.18
description:
[2025-02-05 21:35:51 +0100] info [webmaild] 179.125.140.18 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.129.200.113
description:
2025-02-05 21:35:08 dovecot_plain authenticator failed for (115-129-200-113.tpgi.com.au) [115.129.200.113]:40174: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.129.200.113
description:
Feb  5 21:35:06 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.129.200.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.124.190.135
description:
[2025-02-05 21:35:22 +0100] info [webmaild] 190.124.190.135 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.137.159
description:
2025-02-05 21:35:25 dovecot_plain authenticator failed for (abts-tn-static-159.137.165.122.airtelbroadband.in) [122.165.137.159]:42338: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.29.135.230
description:
2025-02-05 21:35:05 dovecot_plain authenticator failed for 50.29.135.230.res-cmts.mtp2.ptd.net [50.29.135.230]:41762: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.250
description:
Feb  5 21:35:10 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.250
description:
2025-02-05 21:35:12 dovecot_plain authenticator failed for ([103.69.9.250]) [103.69.9.250]:40095: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.207.24
description:
Feb  5 21:35:35 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.207.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.163.156.165
description:
[2025-02-05 21:36:35 +0100] info [webmaild] 105.163.156.165 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 21:36:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.104
description:
Feb  5 21:37:05 ait sshd[804981]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.104
description:
Feb  5 21:37:05 ait sshd[804981]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.104  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.79.232.38
description:
2025-02-05 21:37:38 dovecot_plain authenticator failed for ([142.79.232.38]) [142.79.232.38]:62812: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.20.66
description:
2025-02-05 21:37:38 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:43680: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 21:37:41 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.47.49
description:
47.128.47.49 - - [05/Feb/2025:21:36:57 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=25184615 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=99%2C118%2C79&filtering=1&instructor=2&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.47.49


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.105.247.135
description:
[2025-02-05 21:37:06 +0100] info [webmaild] 177.105.247.135 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.10.27.190
description:
2025-02-05 21:37:24 dovecot_login authenticator failed for ([218.10.27.190]) [218.10.27.190]:43144: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.58.77
description:
2025-02-05 21:37:27 dovecot_login authenticator failed for (77.58.221.60.adsl-pool.sx.cn) [60.221.58.77]:41173: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.200.20.66
description:
Feb  5 21:37:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.200.20.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.79.232.38
description:
Feb  5 21:37:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.79.232.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.10.27.190
description:
Feb  5 21:37:22 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.10.27.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.224.55.22
description:
Feb  5 21:37:39 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.224.55.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.224.55.22
description:
2025-02-05 21:37:41 dovecot_login authenticator failed for ([58.224.55.22]) [58.224.55.22]:55702: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.221.58.77
description:
Feb  5 21:37:25 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.221.58.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 21:37:47 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.14.157.25
description:
Feb  5 21:37:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.14.157.25 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 142.4.1.40
description:
Feb  5 21:37:55 ait sshd[805250]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.4.1.40  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.232.179.140
description:
[2025-02-05 21:38:15 +0100] info [webmaild] 181.232.179.140 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.95.161.26
description:
Feb  5 21:38:32 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.95.161.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
description:
Feb  5 21:38:42 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.1.109.72
description:
[2025-02-05 21:38:43 +0100] info [webmaild] 5.1.109.72 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.227.200.201
description:
Feb  5 21:38:20 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.227.200.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.227.200.201
description:
2025-02-05 21:38:22 dovecot_plain authenticator failed for ([171.227.200.201]) [171.227.200.201]:11722: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.4.1.40
description:
Feb  5 21:37:55 ait sshd[805250]: pam_imunify(sshd:auth): [IM360_RBL] The IP 142.4.1.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.14.157.25
description:
2025-02-05 21:37:55 dovecot_plain authenticator failed for ([218.14.157.25]) [218.14.157.25]:36437: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
description:
Feb  5 21:38:28 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
description:
2025-02-05 21:38:30 dovecot_login authenticator failed for ([222.114.200.160]) [222.114.200.160]:58168: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.123.199
description:
47.128.123.199 - - [05/Feb/2025:21:37:55 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=24974858 HTTP/2.0" 302 0 tutor.aitedu.us "https://tutor.aitedu.us/courses/cs102/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.123.199


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.95.161.26
description:
2025-02-05 21:38:34 dovecot_plain authenticator failed for ([223.95.161.26]) [223.95.161.26]:38412: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
description:
2025-02-05 21:38:44 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:40714: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.184.213.162
description:
[2025-02-05 21:39:15 +0100] info [webmaild] 177.184.213.162 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.253.40.245
description:
[2025-02-05 21:39:48 +0100] info [webmaild] 191.253.40.245 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.106.178.240
description:
[2025-02-05 21:40:43 +0100] info [webmaild] 179.106.178.240 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Feb  5 21:40:24 ait sshd[806544]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Feb  5 21:40:24 ait sshd[806544]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.174.229.206
description:
Feb  5 21:41:04 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.174.229.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.174.229.206
description:
2025-02-05 21:41:06 dovecot_plain authenticator failed for ([93.174.229.206]) [93.174.229.206]:41157: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.75.233
description:
Feb  5 21:41:16 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.75.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
description:
2025-02-05 21:41:17 dovecot_plain authenticator failed for ([196.28.226.125]) [196.28.226.125]:34746: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.75.233
description:
2025-02-05 21:41:18 dovecot_plain authenticator failed for 42-200-75-233.static.imsbiz.com [42.200.75.233]:34270: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.36.49.171
description:
[2025-02-05 21:41:49 +0100] info [webmaild] 138.36.49.171 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.212.206
description:
Feb  5 21:41:03 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.195.94.218
description:
[2025-02-05 21:41:11 +0100] info [webmaild] 186.195.94.218 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.125
description:
Feb  5 21:41:15 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
description:
2025-02-05 21:41:05 dovecot_plain authenticator failed for ([211.53.58.1]) [211.169.212.206]:61877: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.225.239.115
description:
Feb  5 21:42:33 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.225.239.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.218
description:
Feb  5 21:42:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
description:
2025-02-05 21:42:13 dovecot_login authenticator failed for ([183.99.89.74]) [183.99.89.74]:52532: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.65.156.26
description:
[2025-02-05 21:42:23 +0100] info [webmaild] 45.65.156.26 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
description:
2025-02-05 21:42:29 dovecot_plain authenticator failed for ([185.101.16.250]) [185.101.16.250]:40789: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.225.239.115
description:
2025-02-05 21:42:35 dovecot_login authenticator failed for ([58.225.239.115]) [58.225.239.115]:53012: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
description:
2025-02-05 21:42:38 dovecot_plain authenticator failed for ([196.189.124.218]) [196.189.124.218]:34406: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.99.89.74
description:
Feb  5 21:42:11 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.99.89.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.101.16.250
description:
Feb  5 21:42:27 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.101.16.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.218.58
description:
2025-02-05 21:43:53 dovecot_plain authenticator failed for ([14.35.218.58]) [14.35.218.58]:36841: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 89.237.201.11
description:
[2025-02-05 21:43:09 +0100] info [webmaild] 89.237.201.11 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.255.178.175
description:
Feb  5 21:43:32 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.255.178.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.137.159
description:
Feb  5 21:43:49 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.137.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.178.175
description:
2025-02-05 21:43:34 dovecot_plain authenticator failed for 94-255-178-175.cust.bredband2.com [94.255.178.175]:42760: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 212.2.234.106
description:
Feb  5 21:43:35 ait sshd[807701]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.2.234.106


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.54.14
description:
Feb  5 21:43:40 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.54.14
description:
2025-02-05 21:43:42 dovecot_plain authenticator failed for ([200.149.54.14]) [200.149.54.14]:58264: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.11.126
description:
Feb  5 21:43:52 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.11.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.218.58
description:
Feb  5 21:43:51 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.187.34.214
description:
[2025-02-05 21:43:39 +0100] info [webmaild] 45.187.34.214 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.11.126
description:
2025-02-05 21:43:54 dovecot_plain authenticator failed for ([220.182.11.126]) [220.182.11.126]:58883: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.240.73.64
description:
Feb  5 21:43:07 ait sshd[807496]: pam_imunify(sshd:auth): [IM360_RBL] The IP 4.240.73.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.2.234.106
description:
Feb  5 21:43:35 ait sshd[807701]: pam_imunify(sshd:auth): [IM360_RBL] The IP 212.2.234.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.192.94
description:
Feb  5 21:43:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.192.94 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 4.240.73.64
description:
Feb  5 21:43:07 ait sshd[807496]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=4.240.73.64  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.137.159
description:
2025-02-05 21:43:51 dovecot_plain authenticator failed for ([103.109.44.163]) [122.165.137.159]:39548: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.202.71.21
description:
2025-02-05 21:44:07 dovecot_plain authenticator failed for ([211.202.71.21]) [211.202.71.21]:43379: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.180.240.96
description:
Feb  5 21:44:28 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.180.240.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.146.121.14
description:
2025-02-05 21:44:28 dovecot_plain authenticator failed for ([61.146.121.14]) [61.146.121.14]:50341: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.160.139.163
description:
Feb  5 21:44:44 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.160.139.163 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 72.255.58.201
description:
[2025-02-05 21:44:51 +0100] info [webmaild] 72.255.58.201 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
description:
2025-02-05 21:44:30 dovecot_plain authenticator failed for ([182.76.71.82]) [182.76.71.82]:51326: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
description:
2025-02-05 21:44:06 dovecot_plain authenticator failed for (089-101-036159.ntlworld.ie) [89.101.36.159]:33054: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.100
description:
Feb  5 21:44:09 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.44.165
description:
Feb  5 21:44:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.44.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.234.104.42
description:
Feb  5 21:44:24 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.234.104.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.176
description:
2025-02-05 21:44:25 dovecot_plain authenticator failed for (nsg-corporate-176.229.187.122.airtel.in) [122.187.229.176]:46204: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.71.82
description:
Feb  5 21:44:28 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.71.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.90.115.227
description:
2025-02-05 21:44:34 dovecot_plain authenticator failed for ([165.90.115.227]) [165.90.115.227]:48311: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.13.67.132
description:
Feb  5 21:44:35 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.13.67.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 21:44:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.67.123.202
description:
Feb  5 21:44:37 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.67.123.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.44.165
description:
2025-02-05 21:44:25 dovecot_plain authenticator failed for ([49.245.44.165]) [49.245.44.165]:57356: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.146.121.14
description:
Feb  5 21:44:26 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.146.121.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.155.27.128
description:
Feb  5 21:44:28 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.155.27.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.171.226
description:
2025-02-05 21:44:38 dovecot_plain authenticator failed for ([83.239.171.226]) [83.239.171.226]:39448: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.48.217
description:
2025-02-05 21:44:40 dovecot_plain authenticator failed for ([112.102.48.217]) [112.102.48.217]:45090: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
description:
2025-02-05 21:44:49 dovecot_plain authenticator failed for ([154.127.90.34]) [154.127.90.34]:59684: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.196.13.252
description:
[2025-02-05 21:44:18 +0100] info [webmaild] 181.196.13.252 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.171.64.170
description:
Feb  5 21:44:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.171.64.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.97
description:
2025-02-05 21:44:43 dovecot_plain authenticator failed for ([179.185.1.97]) [179.185.1.97]:55175: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.10.125.106
description:
2025-02-05 21:44:44 dovecot_plain authenticator failed for (106.host.advance.com.ar) [200.10.125.106]:56295: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.51.222.234
description:
2025-02-05 21:44:22 dovecot_plain authenticator failed for a109-51-222-234.cpe.netcabo.pt [109.51.222.234]:53379: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.121.39
description:
2025-02-05 21:44:26 dovecot_plain authenticator failed for ([112.168.121.39]) [112.168.121.39]:41762: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.205.218
description:
2025-02-05 21:44:27 dovecot_plain authenticator failed for ([122.169.205.218]) [122.169.205.218]:59200: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.192.94
description:
2025-02-05 21:43:55 dovecot_plain authenticator failed for 186-247-192-94.user.veloxzone.com.br ([179.236.122.153]) [186.247.192.94]:37740: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.78.184.161
description:
2025-02-05 21:44:25 dovecot_login authenticator failed for (ait.edu.gh) [217.78.184.161]:57652: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.166
description:
2025-02-05 21:44:26 dovecot_plain authenticator failed for 111-70-32-166.emome-ip.hinet.net [111.70.32.166]:42398: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.90.34
description:
Feb  5 21:44:47 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.90.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
description:
2025-02-05 21:44:53 dovecot_plain authenticator failed for 51.174.157.77.rev.sfr.net [77.157.174.51]:46484: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.102.48.217
description:
Feb  5 21:44:38 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.102.48.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.67.123.202
description:
2025-02-05 21:44:39 dovecot_plain authenticator failed for ([218.67.123.202]) [218.67.123.202]:51546: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.226.81
description:
2025-02-05 21:44:40 dovecot_plain authenticator failed for ([121.189.226.81]) [121.189.226.81]:41546: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.161.217.228
description:
Feb  5 21:44:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.161.217.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.99
description:
Feb  5 21:44:41 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.96.91.71
description:
2025-02-05 21:44:42 dovecot_plain authenticator failed for ([27.96.91.71]) [27.96.91.71]:38972: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.176
description:
Feb  5 21:44:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.37.17
description:
2025-02-05 21:44:25 dovecot_plain authenticator failed for ([49.245.37.17]) [49.245.37.17]:45254: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.130
description:
2025-02-05 21:44:28 dovecot_plain authenticator failed for ([119.198.191.130]) [119.198.191.130]:38955: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.239.171.226
description:
Feb  5 21:44:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.239.171.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.96.91.71
description:
Feb  5 21:44:40 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.96.91.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.82
description:
2025-02-05 21:44:43 dovecot_plain authenticator failed for (nsg-corporate-82.227.187.122.airtel.in) [122.187.227.82]:50657: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.100
description:
2025-02-05 21:44:11 dovecot_plain authenticator failed for (m121-202-153-100.smartone.com) [121.202.153.100]:16400: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.208.66
description:
2025-02-05 21:44:14 dovecot_plain authenticator failed for ([115.244.25.186]) [103.156.208.66]:52556: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.37.17
description:
Feb  5 21:44:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.37.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.168.121.39
description:
Feb  5 21:44:24 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.168.121.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.205.218
description:
Feb  5 21:44:25 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.205.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-02-05 21:44:36 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-168.static.tpgi.com.au) [110.175.220.250]:42598: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.82
description:
Feb  5 21:44:41 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
description:
Feb  5 21:44:47 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
description:
2025-02-05 21:44:49 dovecot_plain authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:37600: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
description:
Feb  5 21:44:51 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.198.191.130
description:
Feb  5 21:44:26 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.198.191.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.234.104.42
description:
2025-02-05 21:44:26 dovecot_plain authenticator failed for ([218.234.104.42]) [218.234.104.42]:44512: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 21:44:37 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
description:
2025-02-05 21:44:43 dovecot_plain authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:49039: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.115
description:
Feb  5 21:44:45 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.156.208.66
description:
Feb  5 21:44:12 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.156.208.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.180.240.96
description:
2025-02-05 21:44:30 dovecot_plain authenticator failed for ([103.180.240.96]) [103.180.240.96]:38342: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
description:
2025-02-05 21:44:30 dovecot_plain authenticator failed for 128.27.155.104.bc.googleusercontent.com [104.155.27.128]:58877: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.175.122
description:
Feb  5 21:44:47 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.175.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.175.122
description:
2025-02-05 21:44:49 dovecot_plain authenticator failed for ([120.236.175.122]) [120.236.175.122]:38252: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.101.36.159
description:
Feb  5 21:44:04 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.101.36.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.18.126.17
description:
Feb  5 21:44:28 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.18.126.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.90.115.227
description:
Feb  5 21:44:32 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.90.115.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.50.39
description:
2025-02-05 21:44:36 dovecot_plain authenticator failed for ([120.194.50.39]) [120.194.50.39]:26052: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.13.67.132
description:
2025-02-05 21:44:37 dovecot_plain authenticator failed for ([221.13.67.132]) [221.13.67.132]:56074: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.10.125.106
description:
Feb  5 21:44:42 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.10.125.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.202.71.21
description:
Feb  5 21:44:05 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.202.71.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Feb  5 21:44:34 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.1.97
description:
Feb  5 21:44:41 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.1.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
description:
2025-02-05 21:44:44 dovecot_plain authenticator failed for ([14.99.61.248]) [14.99.61.248]:47232: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.51.222.234
description:
Feb  5 21:44:20 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.51.222.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.64.170
description:
2025-02-05 21:44:25 dovecot_plain authenticator failed for ([50.171.64.170]) [50.171.64.170]:57652: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
description:
2025-02-05 21:44:25 dovecot_plain authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:41949: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.18.126.17
description:
2025-02-05 21:44:30 dovecot_plain authenticator failed for 17.red-88-18-126.staticip.rima-tde.net [88.18.126.17]:56670: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.99.61.248
description:
Feb  5 21:44:42 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.99.61.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.166
description:
Feb  5 21:44:24 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.50.39
description:
Feb  5 21:44:34 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.50.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.226.81
description:
Feb  5 21:44:38 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.226.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
description:
2025-02-05 21:44:46 dovecot_plain authenticator failed for ([90.160.139.163]) [90.160.139.163]:49647: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.115
description:
2025-02-05 21:44:47 dovecot_plain authenticator failed for (static.as64098.net) [103.79.175.115]:48218: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.221.59
description:
Feb  5 21:45:27 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.221.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.221.59
description:
2025-02-05 21:45:29 dovecot_plain authenticator failed for (abts-north-static-059.221.160.122.airtelbroadband.in) [122.160.221.59]:36510: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.164.67.34
description:
[2025-02-05 21:45:34 +0100] info [webmaild] 45.164.67.34 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.160.166.237
description:
Feb  5 21:45:03 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.160.166.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
description:
2025-02-05 21:45:05 dovecot_plain authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:48132: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.102
description:
2025-02-05 21:45:07 dovecot_plain authenticator failed for ([111.48.214.102]) [111.48.214.102]:16092: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.234.245.7
description:
2025-02-05 21:45:19 dovecot_plain authenticator failed for (net245.234.188-7.ertelecom.ru) [188.234.245.7]:51990: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.102
description:
Feb  5 21:45:05 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.234.245.7
description:
Feb  5 21:45:17 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.234.245.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 130.0.26.110
description:
[2025-02-05 21:46:03 +0100] info [webmaild] 130.0.26.110 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 54.238.102.131
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:21-46.54.238.102.131


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 89.149.88.89
description:
[2025-02-05 21:46:52 +0100] info [webmaild] 89.149.88.89 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 21:47:09 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.203.126
description:
2025-02-05 21:47:10 dovecot_login authenticator failed for 126-203-29-85.dyn.estpak.ee [85.29.203.126]:56465: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.27.114
description:
2025-02-05 21:47:33 dovecot_login authenticator failed for (114.27.33.36.adsl-pool.ah.cnuninet.net) [36.33.27.114]:43154: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.132.167.35
description:
[2025-02-05 21:46:55 +0100] info [webmaild] 188.132.167.35 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.9.222
description:
Feb  5 21:46:57 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.9.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.29.203.126
description:
Feb  5 21:47:08 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.29.203.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.89.73
description:
2025-02-05 21:47:22 dovecot_login authenticator failed for ([106.246.89.73]) [106.246.89.73]:55501: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.59.211.214
description:
2025-02-05 21:47:01 dovecot_login authenticator failed for ([201.59.211.214]) [201.59.211.214]:49789: 535 Incorrect authentication data (set_id=mail@aitlemass.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.250
description:
2025-02-05 21:47:06 dovecot_login authenticator failed for ([121.202.154.250]) [121.202.154.250]:56719: 535 Incorrect authentication data (set_id=mail@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.5.76.239
description:
Feb  5 21:47:19 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.5.76.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.5.76.239
description:
2025-02-05 21:47:21 dovecot_plain authenticator failed for ([112.5.76.239]) [112.5.76.239]:44980: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.250
description:
Feb  5 21:47:04 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.142.67
description:
Feb  5 21:47:09 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.142.67 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:21-47.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.80.34.96
description:
[2025-02-05 21:47:27 +0100] info [webmaild] 190.80.34.96 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.59.211.214
description:
Feb  5 21:46:59 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.59.211.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.9.222
description:
2025-02-05 21:46:59 dovecot_plain authenticator failed for (nonize) [31.173.9.222]:55388: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
description:
2025-02-05 21:47:11 dovecot_plain authenticator failed for ([196.191.142.67]) [196.191.142.67]:34350: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.27.114
description:
Feb  5 21:47:31 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.27.114 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Feb  5 21:48:32 ait sshd[810078]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Feb  5 21:48:32 ait sshd[810078]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.33.70.57
description:
[2025-02-05 21:48:38 +0100] info [webmaild] 186.33.70.57 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.161.5.79
description:
[2025-02-05 21:48:08 +0100] info [webmaild] 45.161.5.79 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.113.87
description:
2025-02-05 21:48:57 dovecot_plain authenticator failed for (niently) [151.237.113.87]:47148: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.151.19
description:
Feb  5 21:49:13 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.151.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.151.19
description:
2025-02-05 21:49:15 dovecot_plain authenticator failed for ([95.165.151.19]) [95.165.151.19]:40578: 535 Incorrect authentication data (set_id=nyarko)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.63.241.43
description:
[2025-02-05 21:49:31 +0100] info [webmaild] 46.63.241.43 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.237.113.87
description:
Feb  5 21:48:55 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.237.113.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.251.121.70
description:
Feb  5 21:49:05 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.251.121.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
description:
2025-02-05 21:49:07 dovecot_plain authenticator failed for works.ssc-gr.info [160.251.121.70]:38682: 535 Incorrect authentication data (set_id=nyarko@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.171.91.10
description:
Feb  5 21:49:57 ait sshd[810703]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.171.91.10


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.0.88.87
description:
[2025-02-05 21:50:07 +0100] info [webmaild] 131.0.88.87 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.213.12.201
description:
[2025-02-05 21:50:35 +0100] info [webmaild] 102.213.12.201 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.91.10
description:
Feb  5 21:49:57 ait sshd[810703]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.171.91.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.108.27
description:
Feb  5 21:51:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.108.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.124
description:
Feb  5 21:51:32 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
description:
2025-02-05 21:51:34 dovecot_plain authenticator failed for ([196.28.226.124]) [196.28.226.124]:53567: 535 Incorrect authentication data (set_id=jessica1234@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.65.1.179
description:
Feb  5 21:51:44 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.65.1.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.65.1.179
description:
2025-02-05 21:51:46 dovecot_plain authenticator failed for ([49.65.1.179]) [49.65.1.179]:29899: 535 Incorrect authentication data (set_id=jessica1234@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.26.249.33
description:
[2025-02-05 21:51:06 +0100] info [webmaild] 197.26.249.33 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.139.233.11
description:
[2025-02-05 21:52:39 +0100] info [webmaild] 5.139.233.11 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 21:52:45 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.108.27
description:
2025-02-05 21:51:55 dovecot_plain authenticator failed for net-93-64-108-27.cust.vodafonedsl.it [93.64.108.27]:46861: 535 Incorrect authentication data (set_id=jessica1234)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.40.156.8
description:
[2025-02-05 21:52:06 +0100] info [webmaild] 103.40.156.8 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.247.184.12
description:
2025-02-05 21:53:12 dovecot_login authenticator failed for ([194.247.184.12]) [194.247.184.12]:58616: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 21:53:12 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 21:53:19 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.81.140.83
description:
Feb  5 21:53:22 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.81.140.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 21:53:24 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.91.10
description:
Feb  5 21:53:42 ait sshd[812533]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.171.91.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.171.91.10
description:
Feb  5 21:53:42 ait sshd[812533]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.171.91.10


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.247.184.12
description:
Feb  5 21:53:10 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.247.184.12 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.120.24.79
description:
[2025-02-05 21:53:41 +0100] info [webmaild] 187.120.24.79 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.67.81.202
description:
[2025-02-05 21:53:12 +0100] info [webmaild] 179.67.81.202 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.91.172.21
description:
Feb  5 21:53:47 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.91.172.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.91.172.21
description:
2025-02-05 21:53:49 dovecot_plain authenticator failed for ([219.91.172.21]) [219.91.172.21]:42560: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.81.140.83
description:
2025-02-05 21:53:24 dovecot_login authenticator failed for ([42.81.140.83]) [42.81.140.83]:50221: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.164.176.167
description:
Feb  5 21:53:55 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.164.176.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.164.176.167
description:
2025-02-05 21:53:57 dovecot_plain authenticator failed for ([95.164.176.167]) [95.164.176.167]:33302: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.79.152.78
description:
[2025-02-05 21:54:41 +0100] info [webmaild] 170.79.152.78 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.202.148.110
description:
Feb  5 21:55:04 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.202.148.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.202.148.110
description:
2025-02-05 21:55:06 dovecot_plain authenticator failed for ([94.202.148.110]) [94.202.148.110]:34144: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.91.10
description:
Feb  5 21:55:24 ait sshd[813251]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.171.91.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.99.61.133
description:
[2025-02-05 21:55:14 +0100] info [webmaild] 46.99.61.133 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
description:
Feb  5 21:55:16 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
description:
2025-02-05 21:55:18 dovecot_plain authenticator failed for ([61.81.151.97]) [61.81.151.97]:44624: 535 Incorrect authentication data (set_id=efreeman)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.171.91.10
description:
Feb  5 21:55:24 ait sshd[813251]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.171.91.10


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.91.10
description:
Feb  5 21:55:26 ait sshd[813251]: Failed password for invalid user user from 103.171.91.10 port 60076 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.114.158.7
description:
[2025-02-05 21:55:39 +0100] info [webmaild] 200.114.158.7 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.37.212.85
description:
Feb  5 21:56:47 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.37.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
description:
2025-02-05 21:56:49 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (agness) [176.37.212.85]:45777: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.157.21.55
description:
2025-02-05 21:55:55 dovecot_login authenticator failed for (31094-49731.bacloud.info.) [175.157.21.55]:45268: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 195.46.143.60
description:
[2025-02-05 21:56:09 +0100] info [webmaild] 195.46.143.60 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.142.86.221
description:
Feb  5 21:56:12 ait sshd[813690]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.142.86.221 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.142.86.221
description:
Feb  5 21:56:12 ait sshd[813690]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.142.86.221  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.161
description:
Feb  5 21:57:33 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.171.89.199
description:
2025-02-05 21:57:36 dovecot_plain authenticator failed for ([223.171.89.199]) [223.171.89.199]:57058: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.226.104
description:
Feb  5 21:56:54 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.226.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.52.109
description:
Feb  5 21:56:59 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.12.201.7
description:
Feb  5 21:57:14 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.12.201.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.246.82
description:
Feb  5 21:57:21 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.246.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.128.90.252
description:
Feb  5 21:57:25 ait sshd[814011]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.128.90.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.89.199
description:
Feb  5 21:57:34 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.89.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.137
description:
Feb  5 21:57:40 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.226.104
description:
2025-02-05 21:56:56 dovecot_login authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:47341: 535 Incorrect authentication data (set_id=mail@ait-open.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
description:
2025-02-05 21:57:01 dovecot_plain authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:47222: 535 Incorrect authentication data (set_id=ads20b00288y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.144
description:
2025-02-05 21:57:20 dovecot_login authenticator failed for (nsg-corporate-144.230.187.122.airtel.in) [122.187.230.144]:45089: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.246.82
description:
2025-02-05 21:57:23 dovecot_plain authenticator failed for p59082-obmd01.osaka.ocn.ne.jp [153.141.246.82]:60932: 535 Incorrect authentication data (set_id=ads20b00288y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
description:
2025-02-05 21:57:13 dovecot_login authenticator failed for ([41.224.62.206]) [41.224.62.206]:59083: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.144
description:
Feb  5 21:57:18 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.112.71.128
description:
2025-02-05 21:57:28 dovecot_plain authenticator failed for syn-070-112-071-128.res.spectrum.com [70.112.71.128]:41852: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.161
description:
2025-02-05 21:57:35 dovecot_login authenticator failed for ([121.202.154.161]) [121.202.154.161]:20899: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.137
description:
2025-02-05 21:57:42 dovecot_plain authenticator failed for ([178.178.194.137]) [178.178.194.137]:34830: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.15.216.115
description:
[2025-02-05 21:57:48 +0100] info [webmaild] 201.15.216.115 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.224.62.206
description:
Feb  5 21:57:11 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.224.62.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.110.208.161
description:
[2025-02-05 21:57:15 +0100] info [webmaild] 187.110.208.161 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.201.7
description:
2025-02-05 21:57:16 dovecot_plain authenticator failed for ([59.12.201.7]) [59.12.201.7]:53073: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.128.90.252
description:
Feb  5 21:57:25 ait sshd[814011]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.90.252


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.112.71.128
description:
Feb  5 21:57:26 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.112.71.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.137.30
description:
2025-02-05 21:58:48 dovecot_login authenticator failed for ([1.237.137.30]) [1.237.137.30]:49839: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.225.185.154
description:
Feb  5 21:58:51 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.225.185.154 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.43.144.63
description:
Feb  5 21:57:58 ait sshd[814231]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.43.144.63  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.119.126.81
description:
2025-02-05 21:58:32 dovecot_login authenticator failed for ([220.119.126.81]) [220.119.126.81]:45207: 535 Incorrect authentication data (set_id=mail@aitvarsity.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 86.97.167.216
description:
[2025-02-05 21:58:39 +0100] info [webmaild] 86.97.167.216 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Feb  5 21:58:45 ait sshd[814295]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
description:
2025-02-05 21:58:48 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:38253: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.194.8
description:
Feb  5 21:58:29 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.194.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.119.126.81
description:
Feb  5 21:58:30 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.119.126.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.194.8
description:
2025-02-05 21:58:31 dovecot_plain authenticator failed for ([183.247.194.8]) [183.247.194.8]:40943: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 65.109.35.14
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:21-58.65.109.35.14


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.21.141.54
description:
Feb  5 21:58:35 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.21.141.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.43.144.63
description:
Feb  5 21:57:57 ait sshd[814231]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.43.144.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.21.141.54
description:
2025-02-05 21:58:37 dovecot_login authenticator failed for ([125.21.141.54]) [125.21.141.54]:64177: 535 Incorrect authentication data (set_id=mail@worldwide-university.com)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Feb  5 21:58:45 ait sshd[814295]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.225.185.154
description:
2025-02-05 21:58:53 dovecot_plain authenticator failed for ([124.225.185.154]) [124.225.185.154]:33740: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.237.137.30
description:
Feb  5 21:58:46 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.237.137.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.97.253.246
description:
Feb  5 21:58:46 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.97.253.246 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.140.176.244
description:
[2025-02-05 21:58:55 +0100] info [webmaild] 103.140.176.244 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.238.146.188
description:
[2025-02-05 21:59:48 +0100] info [webmaild] 160.238.146.188 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.97.114.149
description:
Feb  5 22:00:10 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.97.114.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.97.114.149
description:
2025-02-05 22:00:12 dovecot_login authenticator failed for c-73-97-114-149.hsd1.wa.comcast.net [73.97.114.149]:37887: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.199.59.63
description:
[2025-02-05 22:00:21 +0100] info [webmaild] 181.199.59.63 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.41.81.24
description:
Feb  5 22:00:00 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.41.81.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.81.24
description:
2025-02-05 22:00:02 dovecot_login authenticator failed for (24.81.41.31.ip4.feromedia.eu) [31.41.81.24]:52145: 535 Incorrect authentication data (set_id=mail@lemsas.net)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 204.10.194.42
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:olanrewajutolu35@gmail.com||WPU:olanrewajutolu35@gmail.com||RSV:6.65||T:APACHE||MV:22-00.204.10.194.42


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.240.121.228
description:
Feb  5 22:01:51 ait sshd[816012]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.240.121.228  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
description:
Feb  5 22:01:43 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
description:
2025-02-05 22:01:45 dovecot_plain authenticator failed for ([211.105.213.144]) [211.105.213.144]:37658: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.75.236.95
description:
[2025-02-05 22:01:00 +0100] info [webmaild] 196.75.236.95 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.100.151
description:
Feb  5 22:01:19 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.38.100.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.38.100.151
description:
2025-02-05 22:01:21 dovecot_plain authenticator failed for ([209.38.100.151]) [209.38.100.151]:36218: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.46.164.191
description:
[2025-02-05 22:01:29 +0100] info [webmaild] 181.46.164.191 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-01.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.240.121.228
description:
Feb  5 22:01:51 ait sshd[816012]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.240.121.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.123.219.82
description:
Feb  5 22:02:50 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.123.219.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
description:
2025-02-05 22:02:52 dovecot_plain authenticator failed for ool-457bdb52.dyn.optonline.net (kution) [69.123.219.82]:45600: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.139.88.148
description:
Feb  5 22:02:04 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.139.88.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.88.148
description:
2025-02-05 22:02:06 dovecot_plain authenticator failed for 148.red-2-139-88.dynamicip.rima-tde.net (adize) [2.139.88.148]:58550: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.181.112.74
description:
[2025-02-05 22:02:23 +0100] info [webmaild] 45.181.112.74 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.83.170.247
description:
[2025-02-05 22:02:56 +0100] info [webmaild] 170.83.170.247 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.168.165.250
description:
Feb  5 22:03:06 ait sshd[816788]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.168.165.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Feb  5 22:03:24 ait sshd[816802]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Feb  5 22:03:24 ait sshd[816802]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 151.0.51.229
description:
[2025-02-05 22:03:29 +0100] info [webmaild] 151.0.51.229 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.168.165.250
description:
Feb  5 22:03:06 ait sshd[816788]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.168.165.250  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.111.65
description:
2025-02-05 22:04:16 dovecot_plain authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:42646: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.54.115.46
description:
Feb  5 22:04:26 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.54.115.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
description:
2025-02-05 22:04:28 dovecot_plain authenticator failed for ([84.54.115.46]) [84.54.115.46]:58860: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.6.103.149
description:
[2025-02-05 22:04:00 +0100] info [webmaild] 179.6.103.149 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.111.65
description:
Feb  5 22:04:14 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.111.65 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.37.24.143
description:
[2025-02-05 22:04:58 +0100] info [webmaild] 191.37.24.143 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Feb  5 22:05:28 ait sshd[817845]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.71.37.202
description:
2025-02-05 22:05:33 dovecot_plain authenticator failed for ([47.98.191.121]) [101.71.37.202]:24355: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.228.105.192
description:
Feb  5 22:05:46 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.228.105.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.216.120.234
description:
2025-02-05 22:05:52 dovecot_plain authenticator failed for 76-216-120-234.lightspeed.tukrga.sbcglobal.net [76.216.120.234]:38936: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Feb  5 22:05:28 ait sshd[817845]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.228.105.192
description:
2025-02-05 22:05:48 dovecot_plain authenticator failed for ([58.228.105.192]) [58.228.105.192]:56172: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.183.11.30
description:
2025-02-05 22:05:30 dovecot_plain authenticator failed for ([103.183.11.30]) [103.183.11.30]:52224: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.71.37.202
description:
Feb  5 22:05:31 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.71.37.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.116.128.108
description:
[2025-02-05 22:05:34 +0100] info [webmaild] 181.116.128.108 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.20.111.164
description:
Feb  5 22:05:18 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.20.111.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.111.164
description:
2025-02-05 22:05:20 dovecot_plain authenticator failed for ([38.20.111.164]) [38.20.111.164]:52137: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.183.11.30
description:
Feb  5 22:05:28 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.183.11.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.216.120.234
description:
Feb  5 22:05:50 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.216.120.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.161.226.88
description:
Feb  5 22:06:05 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.161.226.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.226.88
description:
2025-02-05 22:06:07 dovecot_login authenticator failed for (187.161.226.88-clientes-izzi.mx) [187.161.226.88]:36425: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.125
description:
Feb  5 22:06:26 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.96.43.215
description:
Feb  5 22:06:29 ait sshd[818219]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.96.43.215 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.106.38.142
description:
[2025-02-05 22:06:30 +0100] info [webmaild] 187.106.38.142 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.134.126.162
description:
Feb  5 22:06:35 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.134.126.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.11.126
description:
2025-02-05 22:05:56 dovecot_login authenticator failed for ([220.182.11.126]) [220.182.11.126]:53449: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.55.157.200
description:
[2025-02-05 22:06:01 +0100] info [webmaild] 177.55.157.200 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.125
description:
2025-02-05 22:06:28 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.125]:45634: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.96.43.215
description:
Feb  5 22:06:29 ait sshd[818219]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.43.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.134.126.162
description:
2025-02-05 22:06:37 dovecot_plain authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:2830: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.11.126
description:
Feb  5 22:05:54 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.11.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.41.5.137
description:
[2025-02-05 22:07:32 +0100] info [webmaild] 38.41.5.137 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 22:07:06 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.166.71.92
description:
[2025-02-05 22:08:07 +0100] info [webmaild] 45.166.71.92 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.123.81
description:
47.128.123.81 - - [05/Feb/2025:22:08:35 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21234531 HTTP/1.1" 302 0 aitopen.us "http://aitopen.us/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.123.81


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.155.105
description:
Feb  5 22:08:51 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.155.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.178.251.33
description:
Feb  5 22:08:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.178.251.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 22:08:48 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.2.123.19
description:
Feb  5 22:08:51 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.2.123.19 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 149.255.251.169
description:
[2025-02-05 22:08:27 +0100] info [webmaild] 149.255.251.169 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.155.105
description:
2025-02-05 22:08:53 dovecot_plain authenticator failed for ([222.68.155.105]) [222.68.155.105]:45416: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.123.19
description:
2025-02-05 22:08:53 dovecot_plain authenticator failed for (dynamic-ip-adsl.viettel.vn) [117.2.123.19]:38954: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.107.200.113
description:
[2025-02-05 22:08:58 +0100] info [webmaild] 191.107.200.113 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.178.251.33
description:
2025-02-05 22:08:38 dovecot_plain authenticator failed for ([210.178.251.33]) [210.178.251.33]:47760: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.110.200.43
description:
Feb  5 22:09:45 ait sshd[819600]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.110.200.43  user=root


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.59.58
description:
47.128.59.58 - - [05/Feb/2025:22:09:47 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17181245 HTTP/1.1" 302 0 aitopen.us "http://aitopen.us/?C=M;O=A" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.59.58


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.69.76.148
description:
Feb  5 22:09:08 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.69.76.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.69.76.148
description:
2025-02-05 22:09:10 dovecot_plain authenticator failed for ([125.69.76.148]) [125.69.76.148]:60374: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.110.200.43
description:
Feb  5 22:09:45 ait sshd[819600]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.110.200.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.242
description:
Feb  5 22:10:54 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.161.16.240
description:
2025-02-05 22:10:07 dovecot_plain authenticator failed for ([221.161.16.240]) [221.161.16.240]:55790: 535 Incorrect authentication data (set_id=mail@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.157.169.242
description:
Feb  5 22:10:22 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.157.169.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.67.123.202
description:
Feb  5 22:10:26 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.67.123.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.34.254
description:
Feb  5 22:10:37 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.34.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.242
description:
2025-02-05 22:10:56 dovecot_plain authenticator failed for ([116.114.84.242]) [116.114.84.242]:37156: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.137.192.36
description:
[2025-02-05 22:10:01 +0100] info [webmaild] 179.137.192.36 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.157.169.242
description:
2025-02-05 22:10:24 dovecot_plain authenticator failed for (abts-north-dynamic-161.133.176.122.airtelbroadband.in) [103.157.169.242]:36690: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.89.171.185
description:
[2025-02-05 22:10:37 +0100] info [webmaild] 189.89.171.185 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.42.79.74
description:
Feb  5 22:10:51 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.42.79.74 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.32.252
description:
47.128.32.252 - - [05/Feb/2025:22:10:11 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=25601102 HTTP/1.1" 302 0 aitopen.us "http://aitopen.us/?C=D;O=D" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.32.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.67.123.202
description:
2025-02-05 22:10:28 dovecot_plain authenticator failed for ([218.67.123.202]) [218.67.123.202]:60428: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.34.254
description:
2025-02-05 22:10:39 dovecot_plain authenticator failed for broadband-5-228-34-254.ip.moscow.rt.ru [5.228.34.254]:55950: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
description:
Feb  5 22:10:56 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
description:
2025-02-05 22:10:58 dovecot_plain authenticator failed for (18776174254.telemar.net.br) [187.76.174.254]:35782: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.42.79.74
description:
2025-02-05 22:10:53 dovecot_plain authenticator failed for ([206.42.79.74]) [206.42.79.74]:55863: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.95.168.74
description:
[2025-02-05 22:11:00 +0100] info [webmaild] 187.95.168.74 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.161.16.240
description:
Feb  5 22:10:05 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.161.16.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.132.7.7
description:
Feb  5 22:10:41 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.132.7.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.132.7.7
description:
2025-02-05 22:10:43 dovecot_plain authenticator failed for (customer-PUE-MCA-7-7.megared.net.mx) [201.132.7.7]:32812: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.199.99
description:
2025-02-05 22:11:58 dovecot_login authenticator failed for (ppp99-lumwana.zamnet.zm) [196.46.199.99]:47010: 535 Incorrect authentication data (set_id=mail@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.179
description:
Feb  5 22:11:10 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.199.99
description:
Feb  5 22:11:56 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.199.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.179
description:
2025-02-05 22:11:12 dovecot_plain authenticator failed for ([182.135.66.179]) [182.135.66.179]:50622: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 89.22.52.92
description:
[2025-02-05 22:11:32 +0100] info [webmaild] 89.22.52.92 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.159.117.51
description:
2025-02-05 22:12:32 dovecot_plain authenticator failed for (pool.sevtele.com) [178.159.117.51]:58990: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.40.228.1
description:
[2025-02-05 22:12:39 +0100] info [webmaild] 37.40.228.1 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.59.53
description:
Feb  5 22:12:42 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.59.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.59.53
description:
2025-02-05 22:12:44 dovecot_plain authenticator failed for ([185.167.59.53]) [185.167.59.53]:41054: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.206.139.50
description:
Feb  5 22:12:08 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.206.139.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.206.139.50
description:
2025-02-05 22:12:10 dovecot_login authenticator failed for ([218.206.139.50]) [218.206.139.50]:37982: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.189.49
description:
Feb  5 22:12:20 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.189.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.159.117.51
description:
Feb  5 22:12:30 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.159.117.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.189.49
description:
2025-02-05 22:12:22 dovecot_plain authenticator failed for ([180.7.189.49]) [180.7.189.49]:57250: 535 Incorrect authentication data (set_id=admin@elma-hk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.217.85.115
description:
[2025-02-05 22:13:12 +0100] info [webmaild] 189.217.85.115 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.11.145.133
description:
Feb  5 22:13:16 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.11.145.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.11.145.133
description:
2025-02-05 22:13:18 dovecot_plain authenticator failed for ([121.11.145.133]) [121.11.145.133]:51306: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.129.75.142
description:
[2025-02-05 22:13:37 +0100] info [webmaild] 102.129.75.142 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 22:14:04 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.190.118.227
description:
[2025-02-05 22:14:07 +0100] info [webmaild] 45.190.118.227 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.43.74
description:
47.128.43.74 - - [05/Feb/2025:22:14:10 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16528662 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/view.php?id=580" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.43.74


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.13.25.186
description:
Feb  5 22:15:47 ait sshd[822246]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.13.25.186


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 22:15:06 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.155.105
description:
Feb  5 22:15:28 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.155.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.111
description:
2025-02-05 22:15:57 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.111]:36798: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.143.3.132
description:
Feb  5 22:15:10 ait sshd[821894]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.143.3.132  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.121.155.21
description:
[2025-02-05 22:15:11 +0100] info [webmaild] 187.121.155.21 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.13.25.186
description:
Feb  5 22:15:47 ait sshd[822246]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.13.25.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.111
description:
Feb  5 22:15:55 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.3.132
description:
Feb  5 22:15:10 ait sshd[821894]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.143.3.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.155.105
description:
2025-02-05 22:15:30 dovecot_plain authenticator failed for ([222.68.155.105]) [222.68.155.105]:57441: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.143.231.208
description:
Feb  5 22:15:56 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.143.231.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.143.231.208
description:
2025-02-05 22:15:58 dovecot_plain authenticator failed for ([43.143.231.208]) [43.143.231.208]:46102: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.203.133.148
description:
[2025-02-05 22:15:59 +0100] info [webmaild] 186.203.133.148 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 39.60.161.15
description:
[2025-02-05 22:16:10 +0100] info [webmaild] 39.60.161.15 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.150.135.19
description:
Feb  5 22:16:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.150.135.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.88.96.37
description:
Feb  5 22:16:13 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.88.96.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.20.229
description:
2025-02-05 22:16:50 dovecot_plain authenticator failed for (fp5cca5266.gifg408.ap.nuro.jp) [154.47.20.229]:56268: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-16.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.160.123.6
description:
2025-02-05 22:16:34 dovecot_plain authenticator failed for (pulthry) [109.160.123.6]:54044: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.176.96.86
description:
[2025-02-05 22:16:39 +0100] info [webmaild] 45.176.96.86 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.41.42.76
description:
2025-02-05 22:16:42 dovecot_plain authenticator failed for (oumic) [185.41.42.76]:16125: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.47.20.229
description:
Feb  5 22:16:48 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.47.20.229 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.172.46.10
description:
Feb  5 22:16:59 ait sshd[822604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.172.46.10


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.88.96.37
description:
2025-02-05 22:16:15 dovecot_plain authenticator failed for ([58.131.97.5]) [180.88.96.37]:6078: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.160.123.6
description:
Feb  5 22:16:32 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.160.123.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
description:
2025-02-05 22:16:38 dovecot_plain authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:10176: 535 Incorrect authentication data (set_id=mail@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.41.42.76
description:
Feb  5 22:16:40 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.41.42.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.172.46.10
description:
Feb  5 22:16:59 ait sshd[822604]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.172.46.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.110.77
description:
Feb  5 22:17:35 ait sshd[822878]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.110.77


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.37.153.81
description:
Feb  5 22:17:51 ait sshd[822914]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.37.153.81 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.37.153.81
description:
Feb  5 22:17:51 ait sshd[822914]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.153.81


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.46.10
description:
Feb  5 22:17:01 ait sshd[822604]: Failed password for invalid user goudirect from 107.172.46.10 port 38038 ssh2


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.68
description:
47.128.121.68 - - [05/Feb/2025:22:17:16 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13523212 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=99%2C79%2C118" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.68


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.110.77
description:
Feb  5 22:17:35 ait sshd[822878]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.110.77 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.36.18.177
description:
[2025-02-05 22:17:44 +0100] info [webmaild] 177.36.18.177 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.190.139.137
description:
Feb  5 22:18:17 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.190.139.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.190.139.137
description:
2025-02-05 22:18:19 dovecot_plain authenticator failed for (c-50-190-139-137.unallocated.comcastbusiness.net) [50.190.139.137]:59659: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-02-05 22:18:39 dovecot_plain authenticator failed for ([14.88.228.202]) [14.88.228.202]:58694: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Feb  5 22:18:37 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.18.66.169
description:
[2025-02-05 22:18:19 +0100] info [webmaild] 46.18.66.169 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.79.52.152
description:
[2025-02-05 22:18:48 +0100] info [webmaild] 170.79.52.152 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.34.160.2
description:
[2025-02-05 22:19:19 +0100] info [webmaild] 178.34.160.2 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 22:20:09 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.37.153.81
description:
Feb  5 22:20:09 ait sshd[824082]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.37.153.81 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.37.153.81
description:
Feb  5 22:20:09 ait sshd[824082]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.153.81


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
description:
Feb  5 22:20:21 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
description:
2025-02-05 22:20:23 dovecot_login authenticator failed for (88x87x84x104.static-customer.volgograd.ertelecom.ru) [88.87.84.104]:57625: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.59.202.241
description:
Feb  5 22:20:11 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.59.202.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
description:
2025-02-05 22:20:13 dovecot_login authenticator failed for ([41.59.202.241]) [41.59.202.241]:33140: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.11.28.80
description:
[2025-02-05 22:20:17 +0100] info [webmaild] 177.11.28.80 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.59.44.19
description:
[2025-02-05 22:20:52 +0100] info [webmaild] 176.59.44.19 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.100.105.194
description:
Feb  5 22:21:52 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.100.105.194 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.177.21.44
description:
[2025-02-05 22:21:31 +0100] info [webmaild] 201.177.21.44 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.192.94
description:
2025-02-05 22:21:36 dovecot_login authenticator failed for 186-247-192-94.user.veloxzone.com.br [186.247.192.94]:50754: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.100.105.194
description:
2025-02-05 22:21:54 dovecot_login authenticator failed for d96469c2.static.ziggozakelijk.nl ([217.100.105.195]) [217.100.105.194]:42225: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.37.153.81
description:
Feb  5 22:21:19 ait sshd[824789]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.37.153.81 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.37.153.81
description:
Feb  5 22:21:19 ait sshd[824789]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.153.81


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.39.158
description:
2025-02-05 22:21:40 dovecot_plain authenticator failed for 95-31-39-158.broadband.corbina.ru [95.31.39.158]:59372: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 22:21:48 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.23.103
description:
2025-02-05 22:21:55 dovecot_plain authenticator failed for ([115.23.23.103]) [115.23.23.103]:42480: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.37.153.81
description:
Feb  5 22:21:21 ait sshd[824789]: Failed password for invalid user test from 54.37.153.81 port 40812 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.192.94
description:
Feb  5 22:21:34 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.192.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.39.158
description:
Feb  5 22:21:38 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.39.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.0.149.238
description:
Feb  5 22:21:47 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.0.149.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.0.149.238
description:
2025-02-05 22:21:49 dovecot_plain authenticator failed for net-130-0-149-238.cust.vodafonedsl.it (quebasefee) [130.0.149.238]:42107: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.23.103
description:
Feb  5 22:21:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.23.103 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.173.35.238
description:
[2025-02-05 22:22:00 +0100] info [webmaild] 78.173.35.238 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.115.37
description:
2025-02-05 22:22:03 dovecot_login authenticator failed for ([197.156.115.37]) [197.156.115.37]:34126: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
description:
Feb  5 22:22:38 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
description:
2025-02-05 22:22:40 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:49850: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
description:
Feb  5 22:22:02 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
description:
2025-02-05 22:22:04 dovecot_plain authenticator failed for (caling) [102.53.15.17]:33868: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.134.10.18
description:
Feb  5 22:22:18 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.134.10.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.2.234.106
description:
Feb  5 22:22:26 ait sshd[825218]: pam_imunify(sshd:auth): [IM360_RBL] The IP 212.2.234.106 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 212.2.234.106
description:
Feb  5 22:22:26 ait sshd[825218]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.2.234.106  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.156.115.37
description:
Feb  5 22:22:01 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.156.115.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.134.10.18
description:
2025-02-05 22:22:20 dovecot_plain authenticator failed for (188x134x10x18.static-business.spb.ertelecom.ru) [188.134.10.18]:56258: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.46.137.130
description:
[2025-02-05 22:22:45 +0100] info [webmaild] 181.46.137.130 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.34.246
description:
47.128.34.246 - - [05/Feb/2025:22:22:28 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15093150 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61&filter_course-language=79%2C95%2C198" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.34.246


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
description:
2025-02-05 22:23:17 dovecot_plain authenticator failed for (bason) [89.109.233.181]:51073: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.151.19
description:
2025-02-05 22:23:41 dovecot_plain authenticator failed for ([95.165.151.19]) [95.165.151.19]:43440: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.109.233.181
description:
Feb  5 22:23:15 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.109.233.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.160.140.138
description:
Feb  5 22:23:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.160.140.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.138
description:
2025-02-05 22:23:38 dovecot_login authenticator failed for ([113.160.140.138]) [113.160.140.138]:34108: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.109
description:
Feb  5 22:23:18 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Feb  5 22:23:26 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.62.85.230
description:
[2025-02-05 22:23:17 +0100] info [webmaild] 190.62.85.230 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.109
description:
2025-02-05 22:23:20 dovecot_login authenticator failed for 111-70-49-109.emome-ip.hinet.net [111.70.49.109]:33320: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-02-05 22:23:28 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:46001: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.151.19
description:
Feb  5 22:23:39 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.151.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.148.197.119
description:
Feb  5 22:23:49 ait sshd[825811]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.148.197.119 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.148.197.119
description:
Feb  5 22:23:49 ait sshd[825811]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.148.197.119


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
description:
2025-02-05 22:25:00 dovecot_plain authenticator failed for ([103.93.37.178]) [103.93.37.178]:39502: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.72.153.14
description:
2025-02-05 22:24:57 dovecot_plain authenticator failed for (160.72.153.14.lightower.net) [160.72.153.14]:33677: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.202.250.46
description:
Feb  5 22:24:58 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.202.250.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.93.37.178
description:
Feb  5 22:24:58 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.93.37.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.143.30.155
description:
2025-02-05 22:24:58 dovecot_plain authenticator failed for ([222.143.30.155]) [222.143.30.155]:50046: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
description:
2025-02-05 22:25:00 dovecot_plain authenticator failed for ([200.202.250.46]) [200.202.250.46]:59552: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.183.44.115
description:
[2025-02-05 22:24:21 +0100] info [webmaild] 187.183.44.115 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.72.153.14
description:
Feb  5 22:24:55 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.72.153.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.29.196.170
description:
Feb  5 22:24:43 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.29.196.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
description:
2025-02-05 22:24:44 dovecot_plain authenticator failed for ([50.217.255.171]) [50.217.255.171]:45788: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.198.143.228
description:
[2025-02-05 22:24:50 +0100] info [webmaild] 41.198.143.228 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.143.30.155
description:
Feb  5 22:24:56 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.143.30.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.217.255.171
description:
Feb  5 22:24:42 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.217.255.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.29.196.170
description:
2025-02-05 22:24:45 dovecot_plain authenticator failed for ([71.29.196.170]) [71.29.196.170]:56942: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.166.214
description:
Feb  5 22:25:10 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.166.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.166.214
description:
2025-02-05 22:25:12 dovecot_plain authenticator failed for ([220.180.166.214]) [220.180.166.214]:45581: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.232.114.71
description:
Feb  5 22:25:13 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.232.114.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.232.114.71
description:
2025-02-05 22:25:15 dovecot_plain authenticator failed for (187-50-27-129.customer.tdatabrasil.net.br) [200.232.114.71]:60225: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.141.40.72
description:
[2025-02-05 22:25:22 +0100] info [webmaild] 41.141.40.72 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.184.66.88
description:
[2025-02-05 22:25:55 +0100] info [webmaild] 197.184.66.88 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.225.194.121
description:
Feb  5 22:26:44 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.225.194.121 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 152.53.33.144
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-26.152.53.33.144


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.158.239.144
description:
Feb  5 22:26:04 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.158.239.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.239.144
description:
2025-02-05 22:26:06 dovecot_login authenticator failed for ([178.158.239.144]) [178.158.239.144]:48819: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.224.2.202
description:
Feb  5 22:26:17 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.224.2.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.254.115
description:
2025-02-05 22:26:34 dovecot_plain authenticator failed for 217-215-254-115-no2460.tbcn.telia.com (transum) [217.215.254.115]:47106: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.224.2.202
description:
2025-02-05 22:26:19 dovecot_login authenticator failed for ([221.224.2.202]) [221.224.2.202]:50125: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.215.254.115
description:
Feb  5 22:26:32 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.215.254.115 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.251.198.69
description:
[2025-02-05 22:26:46 +0100] info [webmaild] 154.251.198.69 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.225.194.121
description:
2025-02-05 22:26:46 dovecot_plain authenticator failed for (45-225-194-121.ibiunet.com.br) [45.225.194.121]:57840: 535 Incorrect authentication data (set_id=mail@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.202.1.58
description:
Feb  5 22:27:54 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.202.1.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.196.60.13
description:
Feb  5 22:27:03 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.196.60.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.168.173.87
description:
2025-02-05 22:27:42 dovecot_login authenticator failed for ([185.168.173.87]) [185.168.173.87]:55568: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.9.38.92
description:
Feb  5 22:27:39 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.9.38.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.188.85
description:
2025-02-05 22:27:48 dovecot_login authenticator failed for ([120.234.188.85]) [120.234.188.85]:57092: 535 Incorrect authentication data (set_id=test@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.225.185.154
description:
2025-02-05 22:27:19 dovecot_login authenticator failed for ([124.225.185.154]) [124.225.185.154]:55800: 535 Incorrect authentication data (set_id=test@aitlemass.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.97.236.1
description:
Feb  5 22:27:39 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.97.236.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.202.1.58
description:
2025-02-05 22:27:56 dovecot_plain authenticator failed for ([177.202.1.58]) [177.202.1.58]:54238: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.60.13
description:
2025-02-05 22:27:05 dovecot_plain authenticator failed for ([112.196.60.13]) [112.196.60.13]:33668: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.188.85
description:
Feb  5 22:27:46 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.188.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.57.217.38
description:
Feb  5 22:27:51 ait sshd[827663]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.57.217.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
description:
Feb  5 22:27:57 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.26.86
description:
Feb  5 22:27:29 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.26.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.97.236.1
description:
2025-02-05 22:27:41 dovecot_plain authenticator failed for (ip-189-97-236-1.user.vivozap.com.br) [189.97.236.1]:50460: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.93.247.226
description:
Feb  5 22:27:58 ait sshd[827743]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.93.247.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
description:
2025-02-05 22:27:59 dovecot_login authenticator failed for ([218.149.235.152]) [218.149.235.152]:38984: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.11.25.195
description:
2025-02-05 22:27:51 dovecot_plain authenticator failed for ([66.11.25.195]) [66.11.25.195]:35512: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.88.30.163
description:
[2025-02-05 22:27:56 +0100] info [webmaild] 213.88.30.163 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.57.217.38
description:
Feb  5 22:27:51 ait sshd[827663]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.57.217.38  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.38.92
description:
2025-02-05 22:27:41 dovecot_plain authenticator failed for ([59.9.38.92]) [59.9.38.92]:58542: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.11.25.195
description:
Feb  5 22:27:49 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.11.25.195 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.106
description:
47.128.119.106 - - [05/Feb/2025:22:27:28 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10445571 HTTP/2.0" 302 0 admission.ait-edu.us "https://admission.ait-edu.us/campus-based-undergraduate/engineering-programs/bachelor-of-engineering-in-telecommunications-engineering/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.26.86
description:
2025-02-05 22:27:31 dovecot_login authenticator failed for ([65.76.26.86]) [65.76.26.86]:46870: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.168.173.87
description:
Feb  5 22:27:40 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.168.173.87 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.93.247.226
description:
Feb  5 22:27:58 ait sshd[827743]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.93.247.226


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.202.43.174
description:
[2025-02-05 22:27:15 +0100] info [webmaild] 189.202.43.174 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.222.166.212
description:
Feb  5 22:27:29 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.222.166.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.225.185.154
description:
Feb  5 22:27:17 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.225.185.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
description:
2025-02-05 22:27:31 dovecot_login authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:49097: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.81.78
description:
2025-02-05 22:28:20 dovecot_login authenticator failed for ([61.51.81.78]) [61.51.81.78]:43856: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.182.61.79
description:
[2025-02-05 22:28:29 +0100] info [webmaild] 45.182.61.79 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.132.206
description:
Feb  5 22:28:33 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.132.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.132.206
description:
2025-02-05 22:28:35 dovecot_login authenticator failed for ([222.68.132.206]) [222.68.132.206]:48209: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
description:
Feb  5 22:28:55 ait sshd[828216]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Feb  5 22:28:55 ait sshd[828216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.93.247.226
description:
Feb  5 22:28:00 ait sshd[827743]: Failed password for invalid user ubuntu from 36.93.247.226 port 60150 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.81.78
description:
Feb  5 22:28:18 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.81.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
description:
Feb  5 22:29:54 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
description:
2025-02-05 22:29:56 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:33284: 535 Incorrect authentication data (set_id=nyarko)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.200.66.164
description:
Feb  5 22:29:23 ait sshd[828324]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.200.66.164


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.164.217.166
description:
Feb  5 22:29:52 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.164.217.166 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.88.159.184
description:
[2025-02-05 22:29:20 +0100] info [webmaild] 176.88.159.184 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 22:29:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.28.218.66
description:
Feb  5 22:29:40 ait sshd[828526]: pam_imunify(sshd:auth): [IM360_RBL] The IP 124.28.218.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.190.110.210
description:
Feb  5 22:29:46 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.190.110.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.164.217.166
description:
2025-02-05 22:29:54 dovecot_plain authenticator failed for ([119.164.217.166]) [119.164.217.166]:48268: 535 Incorrect authentication data (set_id=aabdulrahaman@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.66.164
description:
Feb  5 22:29:23 ait sshd[828324]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.200.66.164 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.28.218.66
description:
Feb  5 22:29:40 ait sshd[828526]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.28.218.66


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.190.110.210
description:
2025-02-05 22:29:48 dovecot_plain authenticator failed for ([222.190.110.210]) [222.190.110.210]:39640: 535 Incorrect authentication data (set_id=nyarko@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.161.40
description:
[2025-02-05 22:29:50 +0100] info [webmaild] 179.125.161.40 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.145.221.21
description:
Feb  5 22:30:52 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.145.221.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.237.83.130
description:
Feb  5 22:30:31 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.237.83.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.172.225.52
description:
2025-02-05 22:30:35 dovecot_plain authenticator failed for ([178.172.225.52]) [178.172.225.52]:42456: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.227.66.92
description:
Feb  5 22:30:41 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.227.66.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.134.31.193
description:
Feb  5 22:30:51 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.134.31.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
description:
2025-02-05 22:30:45 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.154.175]:36360: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.48.104.200
description:
Feb  5 22:30:49 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.48.104.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.172.225.52
description:
Feb  5 22:30:33 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.172.225.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.154.175
description:
Feb  5 22:30:43 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.154.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.82.33
description:
2025-02-05 22:30:47 dovecot_plain authenticator failed for ([94.205.82.33]) [94.205.82.33]:49653: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.145.221.21
description:
2025-02-05 22:30:54 dovecot_plain authenticator failed for ([219.145.221.21]) [219.145.221.21]:46820: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.237.83.130
description:
2025-02-05 22:30:33 dovecot_plain authenticator failed for ([23.237.83.130]) [23.237.83.130]:46142: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.82.33
description:
Feb  5 22:30:45 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.82.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.232.206
description:
2025-02-05 22:30:55 dovecot_plain authenticator failed for ([177.6.232.206]) [177.6.232.206]:33891: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.0.90.81
description:
Feb  5 22:30:04 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.0.90.81 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.80.60.186
description:
[2025-02-05 22:30:30 +0100] info [webmaild] 170.80.60.186 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.158.72.138
description:
2025-02-05 22:30:33 dovecot_plain authenticator failed for 67-158-72-138.dhcp.execulink.com [67.158.72.138]:51484: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.32.19.205
description:
2025-02-05 22:30:35 dovecot_plain authenticator failed for 114-32-19-205.hinet-ip.hinet.net [114.32.19.205]:58818: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
description:
2025-02-05 22:30:06 dovecot_plain authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:53708: 535 Incorrect authentication data (set_id=aabdulrahaman)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.1.177
description:
Feb  5 22:30:31 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.1.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.32.19.205
description:
Feb  5 22:30:33 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.32.19.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.48.104.200
description:
2025-02-05 22:30:51 dovecot_plain authenticator failed for ([112.48.104.200]) [112.48.104.200]:50069: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.177
description:
2025-02-05 22:30:33 dovecot_plain authenticator failed for (marvitel.static.gvt.net.br) [179.185.1.177]:60342: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.227.66.92
description:
2025-02-05 22:30:43 dovecot_plain authenticator failed for ([188.227.66.92]) [188.227.66.92]:53500: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.232.206
description:
Feb  5 22:30:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.232.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.158.72.138
description:
Feb  5 22:30:31 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.158.72.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
description:
2025-02-05 22:30:53 dovecot_plain authenticator failed for ([121.134.31.193]) [121.134.31.193]:46855: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.179.131.55
description:
Feb  5 22:31:57 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.179.131.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Feb  5 22:31:58 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
description:
Feb  5 22:31:58 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.123.33
description:
Feb  5 22:31:07 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.123.33 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-31.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.235.227.53
description:
[2025-02-05 22:31:51 +0100] info [webmaild] 186.235.227.53 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.222.190.69
description:
2025-02-05 22:31:52 dovecot_plain authenticator failed for (client.fttb.2day.kz) [176.222.190.69]:32858: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.100.248.64
description:
Feb  5 22:31:57 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.100.248.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.100.248.64
description:
2025-02-05 22:31:59 dovecot_plain authenticator failed for ([223.100.248.64]) [223.100.248.64]:34465: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.99.242.32
description:
2025-02-05 22:31:59 dovecot_plain authenticator failed for ([103.98.21.22]) [125.99.242.32]:36343: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.96.101.124
description:
2025-02-05 22:31:59 dovecot_plain authenticator failed for ([186.96.101.124]) [186.96.101.124]:40550: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.10.172.245
description:
[2025-02-05 22:31:04 +0100] info [webmaild] 190.10.172.245 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
description:
2025-02-05 22:31:54 dovecot_login authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:57884: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.67.18
description:
Feb  5 22:31:57 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.67.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.77.211.174
description:
2025-02-05 22:31:57 dovecot_plain authenticator failed for (host-174.211.77.5.ucom.am) [5.77.211.174]:45111: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.229.1.186
description:
Feb  5 22:31:59 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.229.1.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.207.50
description:
2025-02-05 22:31:08 dovecot_plain authenticator failed for vps-f5bece10.vps.ovh.net [135.125.207.50]:42190: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.190.139.137
description:
Feb  5 22:31:22 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.190.139.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
description:
2025-02-05 22:31:36 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:36099: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 184.168.122.184
description:
Feb  5 22:31:49 ait sshd[829496]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=184.168.122.184


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.86.134.216
description:
Feb  5 22:31:59 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.86.134.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.131.55
description:
2025-02-05 22:31:59 dovecot_plain authenticator failed for (abts-mum-static-055.131.179.122.airtelbroadband.in) [122.179.131.55]:51728: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.20.170
description:
Feb  5 22:31:34 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.20.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
description:
2025-02-05 22:31:57 dovecot_plain authenticator failed for ([90.160.139.163]) [90.160.139.163]:46355: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.208.108.52
description:
Feb  5 22:31:58 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.208.108.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.100.230
description:
2025-02-05 22:31:58 dovecot_plain authenticator failed for ([180.168.100.230]) [180.168.100.230]:43922: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.67.18
description:
2025-02-05 22:31:59 dovecot_plain authenticator failed for ([112.91.67.18]) [112.91.67.18]:34402: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.72.9.151
description:
Feb  5 22:31:52 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.72.9.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
description:
2025-02-05 22:31:59 dovecot_plain authenticator failed for ([218.21.241.50]) [218.21.241.50]:46858: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
description:
Feb  5 22:31:18 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.190.139.137
description:
2025-02-05 22:31:24 dovecot_login authenticator failed for ([50.190.139.137]) [50.190.139.137]:49470: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.99
description:
Feb  5 22:31:28 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.168.122.184
description:
Feb  5 22:31:49 ait sshd[829496]: pam_imunify(sshd:auth): [IM360_RBL] The IP 184.168.122.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.99.242.32
description:
Feb  5 22:31:57 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.99.242.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.123.33
description:
2025-02-05 22:31:09 dovecot_plain authenticator failed for ([117.176.123.33]) [117.176.123.33]:34784: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.99
description:
2025-02-05 22:31:30 dovecot_plain authenticator failed for ([207.219.221.99]) [207.219.221.99]:55632: 535 Incorrect authentication data (set_id=adsby)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.77.211.174
description:
Feb  5 22:31:55 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.77.211.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.241.50
description:
Feb  5 22:31:57 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.241.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.220.33
description:
Feb  5 22:31:57 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.220.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.253.51
description:
2025-02-05 22:31:45 dovecot_login authenticator failed for ([112.91.253.51]) [112.91.253.51]:54138: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.160.139.163
description:
Feb  5 22:31:55 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.160.139.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.100.230
description:
Feb  5 22:31:56 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.100.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.101.124
description:
Feb  5 22:31:57 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.101.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
description:
2025-02-05 22:31:59 dovecot_plain authenticator failed for ([106.51.120.94]) [106.51.220.33]:28920: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.207.50
description:
Feb  5 22:31:06 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.207.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
description:
2025-02-05 22:31:20 dovecot_plain authenticator failed for ([27.223.100.94]) [27.223.100.90]:41136: 535 Incorrect authentication data (set_id=adsby@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.253.51
description:
Feb  5 22:31:43 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.253.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.222.190.69
description:
Feb  5 22:31:50 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.222.190.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.76.127
description:
2025-02-05 22:32:15 dovecot_plain authenticator failed for ([183.107.76.127]) [183.107.76.127]:53932: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.241.102
description:
2025-02-05 22:32:26 dovecot_plain authenticator failed for ([112.186.241.102]) [112.186.241.102]:44808: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.149.123
description:
2025-02-05 22:32:03 dovecot_plain authenticator failed for 123.149.48.116.static.netvigator.com [116.48.149.123]:57587: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
description:
Feb  5 22:32:08 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.152.119.174
description:
Feb  5 22:32:12 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.152.119.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.92.77
description:
2025-02-05 22:32:12 dovecot_plain authenticator failed for ([124.246.92.77]) [124.246.92.77]:48629: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.104.245
description:
2025-02-05 22:32:13 dovecot_plain authenticator failed for ([179.125.104.245]) [179.125.104.245]:51985: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.214.52.214
description:
2025-02-05 22:32:14 dovecot_plain authenticator failed for ([175.214.52.214]) [175.214.52.214]:40139: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.239.202
description:
Feb  5 22:32:00 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.239.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.239.252.94
description:
Feb  5 22:32:07 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.239.252.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
description:
2025-02-05 22:32:06 dovecot_plain authenticator failed for ([45.115.173.11]) [45.115.173.11]:42632: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.35.200.202
description:
Feb  5 22:32:14 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.35.200.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Feb  5 22:32:00 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.197.237.177
description:
Feb  5 22:32:05 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.197.237.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
description:
2025-02-05 22:32:00 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:38250: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.175.76.146
description:
Feb  5 22:32:03 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.175.76.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Feb  5 22:32:09 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.201.58
description:
Feb  5 22:32:10 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.201.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.246.92.77
description:
Feb  5 22:32:10 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.246.92.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.142.41.167
description:
2025-02-05 22:32:28 dovecot_plain authenticator failed for ([78.142.41.167]) [78.142.41.167]:37202: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.252.197.3
description:
Feb  5 22:32:54 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.252.197.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.86.134.216
description:
2025-02-05 22:32:01 dovecot_plain authenticator failed for syn-097-086-134-216.res.spectrum.com [97.86.134.216]:3547: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
description:
2025-02-05 22:32:05 dovecot_plain authenticator failed for ([210.206.24.238]) [210.206.24.234]:6102: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.214.52.214
description:
Feb  5 22:32:12 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.214.52.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.164.235.208
description:
Feb  5 22:32:19 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.164.235.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.218.10.21
description:
2025-02-05 22:32:22 dovecot_plain authenticator failed for ([118.218.10.21]) [118.218.10.21]:59615: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.132.150.162
description:
Feb  5 22:32:01 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.132.150.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.104.166.110
description:
Feb  5 22:32:17 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.104.166.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.247.159.106
description:
Feb  5 22:32:03 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.247.159.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.115.173.11
description:
Feb  5 22:32:04 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.115.173.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.84.132.142
description:
2025-02-05 22:32:06 dovecot_plain authenticator failed for (41.84.132.142.liquidtelecom.net) [41.84.132.142]:55752: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-02-05 22:32:11 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:40800: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.126.185
description:
Feb  5 22:32:12 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.126.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.30.104
description:
Feb  5 22:32:18 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.30.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.212.219
description:
Feb  5 22:32:18 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.212.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.175.11.119
description:
Feb  5 22:32:20 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.175.11.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.101.204.242
description:
Feb  5 22:32:24 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.101.204.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.151.19
description:
Feb  5 22:32:37 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.151.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.208.108.52
description:
2025-02-05 22:32:00 dovecot_plain authenticator failed for ([60.208.108.52]) [60.208.108.52]:39134: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.185
description:
2025-02-05 22:32:14 dovecot_plain authenticator failed for ([196.189.126.185]) [196.189.126.185]:46144: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.138.196.194
description:
Feb  5 22:32:16 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.138.196.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.199.98.51
description:
Feb  5 22:32:20 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.199.98.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
description:
2025-02-05 22:32:25 dovecot_plain authenticator failed for ([211.105.213.144]) [211.105.213.144]:49636: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.132.7.7
description:
Feb  5 22:32:10 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.132.7.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.200.202
description:
2025-02-05 22:32:16 dovecot_plain authenticator failed for ([159.223.250.131]) [161.35.200.202]:59304: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.218.10.21
description:
Feb  5 22:32:20 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.218.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
description:
Feb  5 22:32:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.13.138.138
description:
2025-02-05 22:32:52 dovecot_plain authenticator failed for (hn.kd.smx.adsl) [221.13.138.138]:47667: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.153.13.161
description:
Feb  5 22:32:06 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.153.13.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.74.9.190
description:
Feb  5 22:32:16 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.74.9.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.142.41.167
description:
Feb  5 22:32:26 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.142.41.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.195
description:
Feb  5 22:32:27 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.194.128.158
description:
Feb  5 22:32:42 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.194.128.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.149.123
description:
Feb  5 22:32:01 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.149.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
description:
2025-02-05 22:32:01 dovecot_plain authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:41688: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
description:
2025-02-05 22:32:02 dovecot_plain authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:57266: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.16.195
description:
2025-02-05 22:32:29 dovecot_plain authenticator failed for ([27.71.16.195]) [27.71.16.195]:60559: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.220.235.237
description:
2025-02-05 22:32:11 dovecot_plain authenticator failed for ([112.220.235.237]) [112.220.235.237]:57258: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.74.9.190
description:
2025-02-05 22:32:18 dovecot_plain authenticator failed for ([101.230.0.49]) [124.74.9.190]:60589: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.226.228
description:
2025-02-05 22:32:12 dovecot_plain authenticator failed for broadband-77-37-226-228.ip.moscow.rt.ru [77.37.226.228]:50800: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.7.100
description:
2025-02-05 22:32:17 dovecot_plain authenticator failed for 100.7.61.94.rev.vodafone.pt [94.61.7.100]:51416: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
description:
2025-02-05 22:32:20 dovecot_plain authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:47615: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.25
description:
2025-02-05 22:32:22 dovecot_plain authenticator failed for ([121.202.154.25]) [121.202.154.25]:46094: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
description:
2025-02-05 22:32:27 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:22243: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.251.121.70
description:
Feb  5 22:32:01 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.251.121.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-02-05 22:32:02 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (60-242-84-9.static.tpgi.com.au) [110.175.220.250]:53099: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.101.204.242
description:
2025-02-05 22:32:26 dovecot_plain authenticator failed for ([112.101.204.242]) [112.101.204.242]:37177: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.153.13.161
description:
2025-02-05 22:32:08 dovecot_plain authenticator failed for ([219.153.13.161]) [219.153.13.161]:42301: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.152.119.174
description:
2025-02-05 22:32:14 dovecot_plain authenticator failed for ([121.152.119.174]) [121.152.119.174]:45810: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
description:
2025-02-05 22:32:28 dovecot_plain authenticator failed for ([179.252.107.105]) [177.6.235.62]:52091: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.0.90.81
description:
Feb  5 22:32:00 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.0.90.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.163.122.133
description:
Feb  5 22:32:04 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.163.122.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
description:
2025-02-05 22:32:05 dovecot_plain authenticator failed for ([115.247.159.106]) [115.247.159.106]:33690: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.179.161
description:
2025-02-05 22:32:16 dovecot_plain authenticator failed for (161-179-53-194.mairnet.net) [194.53.179.161]:39359: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.93.195.26
description:
Feb  5 22:32:18 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.93.195.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-02-05 22:32:21 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:55562: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.11.119
description:
2025-02-05 22:32:22 dovecot_plain authenticator failed for ([122.175.11.119]) [122.175.11.119]:33183: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.13.120
description:
2025-02-05 22:32:09 dovecot_plain authenticator failed for ([5.31.13.120]) [5.31.13.120]:43059: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.156.85
description:
Feb  5 22:32:12 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.156.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
description:
Feb  5 22:32:13 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
description:
2025-02-05 22:32:19 dovecot_plain authenticator failed for ([211.104.166.110]) [211.104.166.110]:40073: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.199.98.51
description:
2025-02-05 22:32:22 dovecot_plain authenticator failed for ([185.199.98.51]) [185.199.98.51]:59726: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.149.173.90
description:
Feb  5 22:32:24 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.149.173.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.194.181.238
description:
Feb  5 22:32:41 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.194.181.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.13.138.138
description:
Feb  5 22:32:50 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.13.138.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
description:
2025-02-05 22:32:06 dovecot_plain authenticator failed for ([182.163.122.133]) [182.163.122.133]:33945: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.129.92
description:
2025-02-05 22:32:20 dovecot_plain authenticator failed for ([111.53.129.92]) [111.53.129.92]:49848: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.91.173.203
description:
Feb  5 22:32:26 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.91.173.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.127.114
description:
2025-02-05 22:32:35 dovecot_plain authenticator failed for ([178.178.127.114]) [178.178.127.114]:31375: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.61
description:
2025-02-05 22:32:44 dovecot_login authenticator failed for (m121-202-155-61.smartone.com) [121.202.155.61]:10420: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.93.247.226
description:
Feb  5 22:32:49 ait sshd[829924]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.93.247.226


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-02-05 22:32:00 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:24360: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.132.7.7
description:
2025-02-05 22:32:12 dovecot_plain authenticator failed for (customer-PUE-MCA-7-7.megared.net.mx) [201.132.7.7]:36025: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.126.214
description:
2025-02-05 22:32:13 dovecot_plain authenticator failed for ([175.205.126.214]) [175.205.126.214]:45662: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.179.161
description:
Feb  5 22:32:14 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.179.161 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 151.135.175.78
description:
[2025-02-05 22:32:20 +0100] info [webmaild] 151.135.175.78 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.30.104
description:
2025-02-05 22:32:20 dovecot_plain authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:54890: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.186.122
description:
Feb  5 22:32:35 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.186.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.111.59.146
description:
Feb  5 22:32:39 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.111.59.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.182.227.240
description:
2025-02-05 22:32:19 dovecot_plain authenticator failed for ([121.182.227.240]) [121.182.227.240]:50867: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.93.195.26
description:
2025-02-05 22:32:20 dovecot_plain authenticator failed for ([218.93.195.26]) [218.93.195.26]:38392: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
description:
2025-02-05 22:32:44 dovecot_plain authenticator failed for ([14.194.128.158]) [14.194.128.158]:33932: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
description:
2025-02-05 22:32:10 dovecot_plain authenticator failed for ([121.128.76.109]) [61.72.59.106]:51541: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
description:
2025-02-05 22:32:12 dovecot_plain authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:53168: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.205.112.156
description:
Feb  5 22:32:17 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.205.112.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.129.92
description:
Feb  5 22:32:18 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.129.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
description:
Feb  5 22:32:25 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.61
description:
Feb  5 22:32:42 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.239.252.94
description:
2025-02-05 22:32:09 dovecot_plain authenticator failed for 061239252094.static.ctinets.com [61.239.252.94]:17192: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.104.245
description:
Feb  5 22:32:11 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.104.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.156.85
description:
2025-02-05 22:32:14 dovecot_plain authenticator failed for (abts-north-static-085.156.160.122.airtelbroadband.in) [122.160.156.85]:33782: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.205.112.156
description:
2025-02-05 22:32:19 dovecot_plain authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:2529: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.84.5.183
description:
2025-02-05 22:32:23 dovecot_plain authenticator failed for (210-84-5-183.tpgi.com.au) [210.84.5.183]:45925: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.87.122.207
description:
2025-02-05 22:32:23 dovecot_plain authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:56170: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.146.186.122
description:
2025-02-05 22:32:37 dovecot_plain authenticator failed for ([221.146.186.122]) [221.146.186.122]:44000: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.13.120
description:
Feb  5 22:32:07 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.13.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
description:
2025-02-05 22:32:07 dovecot_plain authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:56692: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.235.62
description:
Feb  5 22:32:26 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.235.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.93.247.226
description:
Feb  5 22:32:49 ait sshd[829924]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.93.247.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.252.197.3
description:
2025-02-05 22:32:56 dovecot_login authenticator failed for ([151.252.197.3]) [151.252.197.3]:44854: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.138.196.194
description:
2025-02-05 22:32:18 dovecot_plain authenticator failed for ([200.138.196.194]) [200.138.196.194]:48353: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.25
description:
Feb  5 22:32:20 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.164.235.208
description:
2025-02-05 22:32:21 dovecot_plain authenticator failed for (208.235.164.124.adsl-pool.sx.cn) [124.164.235.208]:60102: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.186.241.102
description:
Feb  5 22:32:24 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.186.241.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.120
description:
2025-02-05 22:32:47 dovecot_plain authenticator failed for ([121.202.152.120]) [121.202.152.120]:46313: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.250.249.12
description:
Feb  5 22:32:02 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.250.249.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.250.249.12
description:
2025-02-05 22:32:04 dovecot_plain authenticator failed for ([45.250.249.12]) [45.250.249.12]:46972: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.126.214
description:
Feb  5 22:32:11 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.126.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.148.187.146
description:
2025-02-05 22:32:11 dovecot_plain authenticator failed for (azteca-comunicaciones.com) [186.148.187.146]:44873: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.182.227.240
description:
Feb  5 22:32:17 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.182.227.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.87.122.207
description:
Feb  5 22:32:21 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.87.122.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.91.173.203
description:
2025-02-05 22:32:28 dovecot_plain authenticator failed for (197-91-173-203.dyn.mweb.co.za) [197.91.173.203]:51108: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.206.24.234
description:
Feb  5 22:32:03 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.206.24.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.33.204.130
description:
Feb  5 22:32:05 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.33.204.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.197.237.177
description:
2025-02-05 22:32:07 dovecot_plain authenticator failed for (177.237.197.116.unknown.m1.com.sg) [116.197.237.177]:36925: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.201.58
description:
2025-02-05 22:32:12 dovecot_plain authenticator failed for ([220.178.201.58]) [220.178.201.58]:43375: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.61.7.100
description:
Feb  5 22:32:15 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.61.7.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.105.113
description:
Feb  5 22:32:20 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.105.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.122
description:
2025-02-05 22:32:23 dovecot_plain authenticator failed for ([103.79.175.122]) [103.79.175.122]:46246: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.149.173.90
description:
2025-02-05 22:32:26 dovecot_plain authenticator failed for ([117.149.173.90]) [117.149.173.90]:35000: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.84.132.142
description:
Feb  5 22:32:04 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.84.132.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.151.19
description:
2025-02-05 22:32:39 dovecot_plain authenticator failed for ([95.165.151.19]) [95.165.151.19]:57196: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.120
description:
Feb  5 22:32:45 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
description:
2025-02-05 22:32:03 dovecot_plain authenticator failed for works.ssc-gr.info [160.251.121.70]:37616: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.148.187.146
description:
Feb  5 22:32:09 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.148.187.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.220.235.237
description:
Feb  5 22:32:09 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.220.235.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.226.228
description:
Feb  5 22:32:10 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.226.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Feb  5 22:32:19 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.84.5.183
description:
Feb  5 22:32:21 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.84.5.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.122
description:
Feb  5 22:32:21 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.127.114
description:
Feb  5 22:32:33 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.127.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
description:
2025-02-05 22:32:02 dovecot_plain authenticator failed for ([117.247.239.202]) [117.247.239.202]:54986: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
description:
2025-02-05 22:32:03 dovecot_plain authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:39092: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
description:
2025-02-05 22:32:05 dovecot_plain authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:45450: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.248.7
description:
Feb  5 22:32:10 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.105.113
description:
2025-02-05 22:32:22 dovecot_plain authenticator failed for (177-174-105-113.user.vivozap.com.br) [177.174.105.113]:49017: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.111.59.146
description:
2025-02-05 22:32:41 dovecot_plain authenticator failed for ([75.111.59.146]) [75.111.59.146]:47522: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.194.181.238
description:
2025-02-05 22:32:43 dovecot_plain authenticator failed for ([175.194.181.238]) [175.194.181.238]:64379: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.218.71.184
description:
[2025-02-05 22:33:00 +0100] info [webmaild] 31.218.71.184 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.142.242
description:
2025-02-05 22:33:38 dovecot_login authenticator failed for 242.142.48.116.static.netvigator.com [116.48.142.242]:47956: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 184.168.122.184
description:
Feb  5 22:33:51 ait sshd[830254]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=184.168.122.184


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.66.164
description:
Feb  5 22:33:18 ait sshd[830021]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.200.66.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Feb  5 22:33:21 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.84.154.106
description:
Feb  5 22:33:29 ait sshd[830177]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.84.154.106 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.84.154.106
description:
Feb  5 22:33:29 ait sshd[830177]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.84.154.106  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.97.186.101
description:
[2025-02-05 22:33:36 +0100] info [webmaild] 138.97.186.101 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.142.242
description:
Feb  5 22:33:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.142.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-02-05 22:33:23 dovecot_login authenticator failed for ([116.50.246.69]) [58.69.17.18]:54760: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.133.214.161
description:
Feb  5 22:33:26 ait sshd[830046]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.133.214.161  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.168.122.184
description:
Feb  5 22:33:51 ait sshd[830254]: pam_imunify(sshd:auth): [IM360_RBL] The IP 184.168.122.184 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.200.66.164
description:
Feb  5 22:33:18 ait sshd[830021]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.200.66.164


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.133.214.161
description:
Feb  5 22:33:26 ait sshd[830046]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.133.214.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.28.218.66
description:
Feb  5 22:34:31 ait sshd[830489]: pam_imunify(sshd:auth): [IM360_RBL] The IP 124.28.218.66 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.28.218.66
description:
Feb  5 22:34:31 ait sshd[830489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.28.218.66


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.200.66.164
description:
Feb  5 22:34:44 ait sshd[830579]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.200.66.164


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.93.247.226
description:
Feb  5 22:34:17 ait sshd[830328]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.93.247.226 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.93.247.226
description:
Feb  5 22:34:19 ait sshd[830328]: Disconnected from invalid user ftpuser 36.93.247.226 port 55862 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.189.29.224
description:
[2025-02-05 22:34:26 +0100] info [webmaild] 200.189.29.224 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.93.247.226
description:
Feb  5 22:34:17 ait sshd[830328]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.93.247.226


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.66.164
description:
Feb  5 22:34:44 ait sshd[830579]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.200.66.164 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.190.138.209
description:
[2025-02-05 22:34:54 +0100] info [webmaild] 177.190.138.209 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
description:
2025-02-05 22:35:33 dovecot_plain authenticator failed for ([89.101.36.159]) [89.101.36.159]:51365: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.221.64.10
description:
Feb  5 22:35:41 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.221.64.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.64.10
description:
2025-02-05 22:35:43 dovecot_plain authenticator failed for ([102.221.64.10]) [102.221.64.10]:38262: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.212.153.73
description:
Feb  5 22:35:52 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.212.153.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.168.122.184
description:
Feb  5 22:35:23 ait sshd[830923]: pam_imunify(sshd:auth): [IM360_RBL] The IP 184.168.122.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-02-05 22:35:24 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:22940: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.101.36.159
description:
Feb  5 22:35:31 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.101.36.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.152.234.133
description:
Feb  5 22:35:38 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.152.234.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.153.73
description:
2025-02-05 22:35:54 dovecot_plain authenticator failed for (80-184-100-101.myrepublic.com.sg) [218.212.153.73]:42220: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.106.78.215
description:
Feb  5 22:35:56 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.106.78.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.106.78.215
description:
2025-02-05 22:35:58 dovecot_plain authenticator failed for ([77.106.78.215]) [77.106.78.215]:11015: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Feb  5 22:35:22 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.152.234.133
description:
2025-02-05 22:35:40 dovecot_login authenticator failed for ([103.152.234.133]) [103.152.234.133]:38956: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.207.252.124
description:
Feb  5 22:35:56 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.207.252.124 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.0.18.109
description:
[2025-02-05 22:36:00 +0100] info [webmaild] 197.0.18.109 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 184.168.122.184
description:
Feb  5 22:35:23 ait sshd[830923]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=184.168.122.184


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.230.27.120
description:
[2025-02-05 22:35:26 +0100] info [webmaild] 45.230.27.120 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.207.252.124
description:
2025-02-05 22:35:58 dovecot_plain authenticator failed for (pool-31-207-252-124.is74.ru) [31.207.252.124]:33715: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.102
description:
Feb  5 22:36:10 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.102 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.27.51
description:
47.128.27.51 - - [05/Feb/2025:22:36:26 +0100] "GET /wp-content/themes/edumall/assets/images/page-404-image.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=14885539" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.27.51


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.132.43.94
description:
2025-02-05 22:36:32 dovecot_login authenticator failed for ([116.132.43.94]) [116.132.43.94]:26854: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.219.177.95
description:
2025-02-05 22:36:08 dovecot_plain authenticator failed for ([113.219.177.95]) [113.219.177.95]:56432: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.11.126
description:
2025-02-05 22:36:03 dovecot_plain authenticator failed for ([220.182.11.126]) [220.182.11.126]:56321: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.28.61
description:
Feb  5 22:36:09 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.28.61
description:
2025-02-05 22:36:11 dovecot_login authenticator failed for ([60.173.88.145]) [111.39.28.61]:33594: 535 Incorrect authentication data (set_id=test@ait-open.net)


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 45.197.14.83
description:
2025-02-05 22:36:43 H=(mail.aitedu.net) [45.197.14.83]:64586 F=<oaitcszv@aitedu.net> rejected RCPT <validxxxg@gmail.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.102
description:
2025-02-05 22:36:25 dovecot_plain authenticator failed for ([111.48.214.102]) [111.48.214.102]:55426: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.181.64.136
description:
[2025-02-05 22:36:58 +0100] info [webmaild] 78.181.64.136 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.41.81.24
description:
Feb  5 22:36:00 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.41.81.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.81.24
description:
2025-02-05 22:36:02 dovecot_plain authenticator failed for (24.81.41.31.ip4.feromedia.eu) [31.41.81.24]:53906: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.19
description:
Feb  5 22:36:15 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.102
description:
Feb  5 22:36:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.219.177.95
description:
Feb  5 22:36:06 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.219.177.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.19
description:
2025-02-05 22:36:17 dovecot_plain authenticator failed for ([127.0.0.1]) [141.98.11.19]:63884: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 204.10.194.42
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ASD-ATA-0002||WPU:ASD-ATA-0002||RSV:6.65||T:APACHE||MV:22-36.204.10.194.42


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.11.126
description:
Feb  5 22:36:01 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.11.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.102
description:
2025-02-05 22:36:12 dovecot_plain authenticator failed for ([121.202.152.102]) [121.202.152.102]:65432: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.179.131.55
description:
Feb  5 22:36:13 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.179.131.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.131.55
description:
2025-02-05 22:36:15 dovecot_plain authenticator failed for (abts-mum-static-055.131.179.122.airtelbroadband.in) [122.179.131.55]:35938: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.247.207.98
description:
Feb  5 22:36:25 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.247.207.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.247.207.98
description:
2025-02-05 22:36:27 dovecot_plain authenticator failed for ([114.247.207.98]) [114.247.207.98]:57343: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.132.43.94
description:
Feb  5 22:36:30 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.132.43.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.28.218.66
description:
Feb  5 22:37:47 ait sshd[832193]: pam_imunify(sshd:auth): [IM360_RBL] The IP 124.28.218.66 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.28.218.66
description:
Feb  5 22:37:47 ait sshd[832193]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.28.218.66


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.253.50
description:
Feb  5 22:37:54 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.253.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.144.16.16
description:
2025-02-05 22:37:25 dovecot_login authenticator failed for ([219.144.16.16]) [219.144.16.16]:49436: 535 Incorrect authentication data (set_id=test@aitvarsity.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.177.209.66
description:
Feb  5 22:37:31 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.177.209.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.31.52
description:
Feb  5 22:37:49 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.31.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.68.50
description:
2025-02-05 22:37:56 dovecot_plain authenticator failed for ([61.185.68.50]) [61.185.68.50]:44879: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.253.50
description:
2025-02-05 22:37:56 dovecot_plain authenticator failed for ([112.91.253.50]) [112.91.253.50]:43501: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.174.148.170
description:
[2025-02-05 22:37:29 +0100] info [webmaild] 45.174.148.170 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.177.209.66
description:
2025-02-05 22:37:33 dovecot_login authenticator failed for ([42.177.209.66]) [42.177.209.66]:46883: 535 Incorrect authentication data (set_id=test@worldwide-university.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
description:
2025-02-05 22:37:35 dovecot_login authenticator failed for ([200.149.51.186]) [200.149.51.186]:36067: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.31.52
description:
2025-02-05 22:37:51 dovecot_login authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com [131.106.31.52]:51752: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.68.50
description:
Feb  5 22:37:54 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.68.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.144.16.16
description:
Feb  5 22:37:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.144.16.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
description:
Feb  5 22:37:33 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.222.174.50
description:
Feb  5 22:38:15 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.222.174.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.249.234.242
description:
2025-02-05 22:38:49 dovecot_login authenticator failed for pool-96-249-234-242.nrflva.fios.verizon.net [96.249.234.242]:34949: 535 Incorrect authentication data (set_id=test@lemsas.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.126.150.102
description:
[2025-02-05 22:38:41 +0100] info [webmaild] 103.126.150.102 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
description:
2025-02-05 22:38:29 dovecot_plain authenticator failed for ([70.89.116.5]) [70.89.116.5]:49254: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.153.110
description:
Feb  5 22:38:40 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.153.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.230.98
description:
Feb  5 22:38:41 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.230.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.230.98
description:
2025-02-05 22:38:43 dovecot_plain authenticator failed for ([1.180.230.112]) [1.180.230.98]:29915: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.249.234.242
description:
Feb  5 22:38:47 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.249.234.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.128.19.228
description:
Feb  5 22:38:04 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.128.19.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.128.19.228
description:
2025-02-05 22:38:06 dovecot_plain authenticator failed for ([57.128.19.228]) [57.128.19.228]:43074: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.60.171
description:
[2025-02-05 22:38:07 +0100] info [webmaild] 45.70.60.171 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.124.127.56
description:
Feb  5 22:38:56 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.124.127.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.124.127.56
description:
2025-02-05 22:38:58 dovecot_login authenticator failed for ([98.124.127.56]) [98.124.127.56]:37518: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.89.116.5
description:
Feb  5 22:38:27 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.89.116.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
description:
2025-02-05 22:38:42 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:37209: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.202.91.52
description:
Feb  5 22:38:09 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.202.91.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.202.91.52
description:
2025-02-05 22:38:11 dovecot_plain authenticator failed for (host-196.202.91.52-static.tedata.net) [196.202.91.52]:44594: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.222.174.50
description:
2025-02-05 22:38:17 dovecot_login authenticator failed for ([102.222.174.50]) [102.222.174.50]:56144: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.207.213
description:
2025-02-05 22:39:12 dovecot_login authenticator failed for (197-255-207-213.netpagedns.net) [197.255.207.213]:54165: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.9.169.14
description:
[2025-02-05 22:39:30 +0100] info [webmaild] 38.9.169.14 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.196.7.202
description:
2025-02-05 22:39:38 dovecot_login authenticator failed for ([117.196.7.202]) [117.196.7.202]:52714: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Feb  5 22:39:09 ait sshd[832778]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Feb  5 22:39:09 ait sshd[832778]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.196.7.202
description:
Feb  5 22:39:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.196.7.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.207.213
description:
Feb  5 22:39:10 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.207.213 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.200.232.168
description:
[2025-02-05 22:40:02 +0100] info [webmaild] 190.200.232.168 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.74.136.134
description:
Feb  5 22:40:06 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.74.136.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
description:
2025-02-05 22:40:08 dovecot_login authenticator failed for syn-050-074-136-134.biz.spectrum.com [50.74.136.134]:47338: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.34
description:
2025-02-05 22:40:16 dovecot_login authenticator failed for ([65.20.204.34]) [65.20.204.34]:53182: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 22:40:34 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.27.166.227
description:
[2025-02-05 22:40:34 +0100] info [webmaild] 186.27.166.227 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.174.233.64
description:
2025-02-05 22:40:55 dovecot_plain authenticator failed for h-158-174-233-64.a192.priv.bahnhof.se [158.174.233.64]:56320: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.34
description:
Feb  5 22:40:14 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.0.199.165
description:
Feb  5 22:40:20 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.0.199.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.199.165
description:
2025-02-05 22:40:22 dovecot_login authenticator failed for 14-0-199-165.static.pccw-hkt.com [14.0.199.165]:59511: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.140.244.144
description:
Feb  5 22:40:31 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.140.244.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.64.191
description:
2025-02-05 22:40:08 dovecot_login authenticator failed for ([2.55.64.191]) [2.55.64.191]:57471: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.140.244.144
description:
2025-02-05 22:40:33 dovecot_login authenticator failed for ([125.140.244.144]) [125.140.244.144]:39402: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.174.233.64
description:
Feb  5 22:40:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.174.233.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.166.221.202
description:
[2025-02-05 22:41:08 +0100] info [webmaild] 181.166.221.202 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Feb  5 22:41:14 ait sshd[833720]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 22:41:22 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.57.119.194
description:
2025-02-05 22:41:56 dovecot_plain authenticator failed for ([113.57.119.194]) [113.57.119.194]:9500: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.232.138
description:
Feb  5 22:41:02 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.232.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.89.232.138
description:
2025-02-05 22:41:04 dovecot_plain authenticator failed for ([159.89.232.138]) [159.89.232.138]:51840: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Feb  5 22:41:14 ait sshd[833720]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.57.119.194
description:
Feb  5 22:41:54 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.57.119.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.46.166
description:
Feb  5 22:42:16 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.46.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.166
description:
2025-02-05 22:42:18 dovecot_plain authenticator failed for 166.46.246.220.static.netvigator.com [220.246.46.166]:64139: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.22.238.36
description:
[2025-02-05 22:42:36 +0100] info [webmaild] 186.22.238.36 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.137.118.249
description:
[2025-02-05 22:42:07 +0100] info [webmaild] 143.137.118.249 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 22:43:33 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
description:
2025-02-05 22:43:50 dovecot_plain authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:54714: 535 Incorrect authentication data (set_id=sarpong-nsiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.181.74
description:
Feb  5 22:43:59 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.181.74 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.43.144.70
description:
Feb  5 22:43:29 ait sshd[834227]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.43.144.70


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.43.144.70
description:
Feb  5 22:43:29 ait sshd[834227]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.43.144.70 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.227.150.22
description:
[2025-02-05 22:43:45 +0100] info [webmaild] 45.227.150.22 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.76.194.159
description:
Feb  5 22:43:48 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.76.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.174.38.134
description:
[2025-02-05 22:43:12 +0100] info [webmaild] 105.174.38.134 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.249.167.45
description:
2025-02-05 22:44:15 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:54725: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 22:44:59 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.181.74
description:
2025-02-05 22:44:01 dovecot_plain authenticator failed for ([103.65.227.72]) [114.130.181.74]:51180: 535 Incorrect authentication data (set_id=sarpong-nsiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Feb  5 22:44:10 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-02-05 22:44:12 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (ancule) [91.56.31.167]:61326: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.20
description:
Feb  5 22:44:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.20
description:
2025-02-05 22:44:25 dovecot_plain authenticator failed for ([103.190.91.20]) [103.190.91.20]:46210: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.118.115
description:
47.128.118.115 - - [05/Feb/2025:22:44:12 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10678451 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/open/index.php?Itemid=328&id=352&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.118.115


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.249.167.45
description:
Feb  5 22:44:13 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.249.167.45 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.181.177.30
description:
[2025-02-05 22:44:44 +0100] info [webmaild] 168.181.177.30 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
description:
2025-02-05 22:45:52 dovecot_plain authenticator failed for ([27.223.100.92]) [27.223.100.90]:45680: 535 Incorrect authentication data (set_id=mail@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 22:45:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.161.128.247
description:
[2025-02-05 22:45:57 +0100] info [webmaild] 131.161.128.247 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.77.216.166
description:
Feb  5 22:45:59 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.77.216.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.117.91.67
description:
Feb  5 22:45:26 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.117.91.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.19.123.170
description:
2025-02-05 22:45:38 dovecot_login authenticator failed for (ait.edu.gh) [186.19.123.170]:3684: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 84.247.145.208
domain: gvu.titopen.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:gvu_admin||WPU:gvu_admin||RSV:6.65||T:APACHE||MV:22-45.84.247.145.208


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
description:
Feb  5 22:45:50 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 84.247.145.208
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-45.84.247.145.208


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.113.43.68
description:
[2025-02-05 22:45:12 +0100] info [webmaild] 189.113.43.68 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.56.107.53
description:
2025-02-05 22:45:16 dovecot_plain authenticator failed for ([191.56.107.53]) [191.56.107.53]:33528: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.117.91.67
description:
2025-02-05 22:45:28 dovecot_plain authenticator failed for ([220.117.91.67]) [220.117.91.67]:60824: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.56.107.53
description:
Feb  5 22:45:14 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.56.107.53 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-46.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.13.237.163
description:
2025-02-05 22:46:51 dovecot_plain authenticator failed for ([59.13.237.163]) [59.13.237.163]:57268: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.89.99
description:
2025-02-05 22:46:52 dovecot_plain authenticator failed for ([177.174.89.105]) [177.174.89.99]:42028: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.77.216.166
description:
2025-02-05 22:46:01 dovecot_plain authenticator failed for 79-77-216-166.dynamic.dsl.as9105.com [79.77.216.166]:63974: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.13.237.163
description:
Feb  5 22:46:49 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.13.237.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.89.99
description:
Feb  5 22:46:50 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.89.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.41.137
description:
Feb  5 22:46:58 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.41.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
description:
2025-02-05 22:47:00 dovecot_plain authenticator failed for ([196.190.43.138]) [196.190.41.137]:39951: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.93.99.90
description:
[2025-02-05 22:46:31 +0100] info [webmaild] 197.93.99.90 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.56.115.66
description:
2025-02-05 22:47:43 dovecot_plain authenticator failed for ([103.56.115.66]) [103.56.115.66]:50384: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.199.57.230
description:
[2025-02-05 22:47:58 +0100] info [webmaild] 190.199.57.230 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.174.68.105
description:
[2025-02-05 22:47:16 +0100] info [webmaild] 212.174.68.105 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.140.240
description:
2025-02-05 22:47:37 dovecot_plain authenticator failed for ([111.48.140.240]) [111.48.140.240]:45088: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.113.10
description:
Feb  5 22:47:38 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.42.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.0.8.92
description:
2025-02-05 22:47:43 dovecot_plain authenticator failed for (apn-31-0-8-92.static.gprs.plus.pl) [31.0.8.92]:53052: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.19.80.138
description:
2025-02-05 22:47:54 dovecot_plain authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:48600: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.90.250
description:
Feb  5 22:47:55 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.90.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  5 22:47:02 ait sshd[835747]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
description:
2025-02-05 22:47:36 dovecot_plain authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:59758: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.90
description:
2025-02-05 22:47:42 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:34104: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
description:
2025-02-05 22:47:53 dovecot_plain authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:49288: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.129.154
description:
2025-02-05 22:47:55 dovecot_plain authenticator failed for ([197.231.129.154]) [197.231.129.154]:37204: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
description:
2025-02-05 22:47:56 dovecot_plain authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:43374: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  5 22:47:02 ait sshd[835747]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.85.137
description:
Feb  5 22:47:12 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.85.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.191.131
description:
2025-02-05 22:47:34 dovecot_plain authenticator failed for broadband-178-140-191-131.ip.moscow.rt.ru [178.140.191.131]:43056: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.174.226
description:
Feb  5 22:47:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.174.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.138.181
description:
Feb  5 22:47:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.138.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.175
description:
2025-02-05 22:47:46 dovecot_plain authenticator failed for ([121.202.153.175]) [121.202.153.175]:5733: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.189
description:
Feb  5 22:47:47 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.142.230.50
description:
2025-02-05 22:47:52 dovecot_plain authenticator failed for ([123.142.230.50]) [123.142.230.50]:50854: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.41.197.10
description:
2025-02-05 22:47:09 dovecot_plain authenticator failed for ([59.41.197.10]) [59.41.197.10]:44270: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.123.27.87
description:
Feb  5 22:47:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.123.27.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.190.69
description:
Feb  5 22:47:46 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.255.190.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.189
description:
2025-02-05 22:47:49 dovecot_plain authenticator failed for ([60.167.19.189]) [60.167.19.189]:35730: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
description:
2025-02-05 22:47:38 dovecot_plain authenticator failed for ([121.202.138.181]) [121.202.138.181]:53214: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
description:
Feb  5 22:47:48 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.184.143.93
description:
2025-02-05 22:47:42 dovecot_plain authenticator failed for ([39.184.143.93]) [39.184.143.93]:35729: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Feb  5 22:47:45 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
description:
2025-02-05 22:47:44 dovecot_plain authenticator failed for ([109.233.21.109]) [109.233.21.109]:53312: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.97.10
description:
Feb  5 22:47:48 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.97.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.232.184
description:
Feb  5 22:47:04 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.232.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.191.131
description:
Feb  5 22:47:32 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.191.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.0.8.92
description:
Feb  5 22:47:41 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.0.8.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.128.209.48
description:
Feb  5 22:47:54 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.128.209.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.152.3
description:
Feb  5 22:47:57 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.152.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.123.27.87
description:
2025-02-05 22:47:38 dovecot_plain authenticator failed for ([183.123.27.87]) [183.123.27.87]:60046: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.90
description:
Feb  5 22:47:40 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.12
description:
Feb  5 22:47:41 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.19.80.138
description:
Feb  5 22:47:52 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.19.80.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.85.137
description:
2025-02-05 22:47:14 dovecot_plain authenticator failed for (177-174-85-137.user.vivozap.com.br) [177.174.85.137]:41418: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.2.198
description:
Feb  5 22:47:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.2.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
description:
2025-02-05 22:47:51 dovecot_plain authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:47348: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.86.6
description:
Feb  5 22:47:55 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.86.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.41.197.10
description:
Feb  5 22:47:07 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.41.197.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.174.226
description:
2025-02-05 22:47:38 dovecot_plain authenticator failed for ([58.216.174.226]) [58.216.174.226]:30634: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.90.250
description:
2025-02-05 22:47:57 dovecot_plain authenticator failed for ([58.18.90.250]) [58.18.90.250]:37676: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.231.129.154
description:
Feb  5 22:47:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.231.129.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.152.3
description:
2025-02-05 22:47:59 dovecot_plain authenticator failed for ([120.197.152.3]) [120.197.152.3]:45125: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.2.110
description:
Feb  5 22:47:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.2.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.41.211.48
description:
Feb  5 22:47:49 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.41.211.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.142.230.50
description:
Feb  5 22:47:50 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.142.230.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-02-05 22:47:50 dovecot_plain authenticator failed for (13-78-123-185.host.cirex.ru) [185.123.78.13]:4103: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.232.184
description:
2025-02-05 22:47:06 dovecot_plain authenticator failed for ([120.234.232.184]) [120.234.232.184]:61162: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.12
description:
2025-02-05 22:47:43 dovecot_plain authenticator failed for (nsg-corporate-12.229.187.122.airtel.in) [122.187.229.12]:39800: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.2.110
description:
2025-02-05 22:47:38 dovecot_plain authenticator failed for ([187.12.2.110]) [187.12.2.110]:39194: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.184.143.93
description:
Feb  5 22:47:40 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.184.143.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.12.254.47
description:
2025-02-05 22:47:46 dovecot_plain authenticator failed for ([106.12.254.47]) [106.12.254.47]:41008: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.175.76.146
description:
Feb  5 22:47:34 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.175.76.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.140.240
description:
Feb  5 22:47:35 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.140.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-02-05 22:47:36 dovecot_plain authenticator failed for ([2.57.219.14]) [2.57.219.2]:42096: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.2.198
description:
2025-02-05 22:47:38 dovecot_plain authenticator failed for 111-70-2-198.emome-ip.hinet.net [111.70.2.198]:51345: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.0.131
description:
Feb  5 22:48:00 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.0.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Feb  5 22:47:34 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.254.47
description:
Feb  5 22:47:44 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.12.254.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-02-05 22:47:47 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (shily) [91.56.31.167]:63027: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.160.166.237
description:
Feb  5 22:47:51 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.160.166.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.190.69
description:
2025-02-05 22:47:48 dovecot_plain authenticator failed for ([92.255.190.69]) [92.255.190.69]:43808: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.97.10
description:
2025-02-05 22:47:50 dovecot_plain authenticator failed for ([116.114.97.10]) [116.114.97.10]:50754: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.86.6
description:
2025-02-05 22:47:57 dovecot_plain authenticator failed for ([188.168.86.6]) [188.168.86.6]:51748: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
description:
2025-02-05 22:47:40 dovecot_plain authenticator failed for ([182.42.113.10]) [182.42.113.10]:37738: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.115.66
description:
Feb  5 22:47:41 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.56.115.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.233.21.109
description:
Feb  5 22:47:42 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.233.21.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.175
description:
Feb  5 22:47:44 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.183.39.246
description:
[2025-02-05 22:48:31 +0100] info [webmaild] 191.183.39.246 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 172.104.137.177
description:
Feb  5 22:48:59 ait sshd[836514]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.104.137.177  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.84.11.180
description:
Feb  5 22:48:11 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.84.11.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.208.221
description:
Feb  5 22:48:15 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.208.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.208.221
description:
2025-02-05 22:48:17 dovecot_plain authenticator failed for ([113.64.208.221]) [113.64.208.221]:54328: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.181.81
description:
2025-02-05 22:48:24 dovecot_plain authenticator failed for ([85.130.181.81]) [85.130.181.81]:29409: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 22:48:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.104.137.177
description:
Feb  5 22:48:59 ait sshd[836514]: pam_imunify(sshd:auth): [IM360_RBL] The IP 172.104.137.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.26.205.154
description:
Feb  5 22:48:13 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.26.205.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.26.205.154
description:
2025-02-05 22:48:15 dovecot_plain authenticator failed for (154.205.26.218.internet.sx.cn) [218.26.205.154]:34346: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.181.81
description:
Feb  5 22:48:22 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.181.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.0.131
description:
2025-02-05 22:48:02 dovecot_plain authenticator failed for ([123.212.0.131]) [123.212.0.131]:33214: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.116
description:
2025-02-05 22:48:08 dovecot_plain authenticator failed for (116.20.167.124.adsl-pool.sx.cn) [124.167.20.116]:40273: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.84.11.180
description:
2025-02-05 22:48:13 dovecot_plain authenticator failed for ([59.84.11.180]) [59.84.11.180]:61266: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.116
description:
Feb  5 22:48:06 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.116 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.236.113.127
description:
[2025-02-05 22:48:29 +0100] info [webmaild] 188.236.113.127 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 22:49:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-02-05 22:49:51 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt (coidaes) [89.153.62.100]:48732: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.17.57.41
description:
[2025-02-05 22:49:02 +0100] info [webmaild] 188.17.57.41 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.250.191.189
description:
Feb  5 22:49:34 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.250.191.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
description:
2025-02-05 22:49:36 dovecot_plain authenticator failed for (unders) [178.250.191.189]:37146: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.43.110.216
description:
[2025-02-05 22:49:40 +0100] info [webmaild] 31.43.110.216 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Feb  5 22:49:49 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.152.119.174
description:
2025-02-05 22:50:04 dovecot_login authenticator failed for ([121.152.119.174]) [121.152.119.174]:39758: 535 Incorrect authentication data (set_id=test@ait-edu.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-02-05 22:50:06 dovecot_plain authenticator failed for (pisubieved) [109.166.70.166]:18342: 535 Incorrect authentication data (set_id=ads20b00330y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.161.68
description:
Feb  5 22:50:12 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.161.68 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.89.144.156
description:
[2025-02-05 22:50:11 +0100] info [webmaild] 190.89.144.156 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.161.68
description:
2025-02-05 22:50:14 dovecot_login authenticator failed for ([65.20.161.68]) [65.20.161.68]:45992: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.235.134.198
description:
[2025-02-05 22:51:00 +0100] info [webmaild] 185.235.134.198 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.152.119.174
description:
Feb  5 22:50:02 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.152.119.174 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.5.248.195
description:
[2025-02-05 22:51:33 +0100] info [webmaild] 45.5.248.195 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.22.182.230
description:
Feb  5 22:51:54 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.22.182.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.22.182.230
description:
2025-02-05 22:51:56 dovecot_plain authenticator failed for ip4d16b6e6.dynamic.kabel-deutschland.de [77.22.182.230]:45389: 535 Incorrect authentication data (set_id=mail@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.42.163.252
description:
Feb  5 22:52:07 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.42.163.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.42.163.252
description:
2025-02-05 22:52:09 dovecot_plain authenticator failed for ([185.42.163.252]) [185.42.163.252]:59924: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.158.228.110
description:
[2025-02-05 22:52:12 +0100] info [webmaild] 186.158.228.110 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.240.176.161
description:
[2025-02-05 22:52:41 +0100] info [webmaild] 88.240.176.161 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.179.102.182
description:
2025-02-05 22:53:44 dovecot_plain authenticator failed for ([163.179.102.182]) [163.179.102.182]:40084: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.222.171.6
description:
Feb  5 22:53:50 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.222.171.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.222.171.6
description:
2025-02-05 22:53:52 dovecot_plain authenticator failed for 6.ip-92-222-171.eu [92.222.171.6]:39838: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
description:
Feb  5 22:53:02 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
description:
2025-02-05 22:53:04 dovecot_plain authenticator failed for (preers) [102.53.15.17]:47240: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.192.208.85
description:
Feb  5 22:53:07 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.192.208.85 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.82.8.204
description:
[2025-02-05 22:53:36 +0100] info [webmaild] 41.82.8.204 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.179.102.182
description:
Feb  5 22:53:42 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.179.102.182 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.68.250.227
description:
[2025-02-05 22:54:10 +0100] info [webmaild] 186.68.250.227 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.145.181.48
description:
Feb  5 22:54:14 ait sshd[838646]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.145.181.48 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.145.181.48
description:
Feb  5 22:54:14 ait sshd[838646]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.145.181.48  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 24.152.71.84
description:
[2025-02-05 22:54:44 +0100] info [webmaild] 24.152.71.84 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.112
description:
Feb  5 22:54:14 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.112
description:
2025-02-05 22:54:16 dovecot_login authenticator failed for (122.11.169-112.unknown.starhub.net.sg) [122.11.169.112]:1489: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.183.103.117
description:
Feb  5 22:54:18 ait sshd[838653]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.183.103.117 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.183.103.117
description:
Feb  5 22:54:18 ait sshd[838653]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.103.117  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.110.53.177
description:
Feb  5 22:54:29 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.110.53.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.110.53.177
description:
2025-02-05 22:54:31 dovecot_login authenticator failed for (123-110-53-177.cctv.dynamic.tbcnet.net.tw) [123.110.53.177]:52655: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.191.1.212
description:
[2025-02-05 22:55:14 +0100] info [webmaild] 181.191.1.212 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.168.250.134
description:
Feb  5 22:55:52 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.168.250.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.95.67.92
description:
Feb  5 22:55:54 ait sshd[839447]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.95.67.92 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.95.67.92
description:
Feb  5 22:55:54 ait sshd[839447]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.95.67.92


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.168.250.134
description:
2025-02-05 22:55:54 dovecot_login authenticator failed for ppp-110-168-250-134.revip5.asianet.co.th (31094-49731.bacloud.info.) [110.168.250.134]:4220: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.168.250.134
description:
2025-02-05 22:56:02 dovecot_plain authenticator failed for ppp-110-168-250-134.revip5.asianet.co.th (31094-49731.bacloud.info.) [110.168.250.134]:4220: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.176.66
description:
2025-02-05 22:56:04 dovecot_plain authenticator failed for (forcharch) [105.72.176.66]:38370: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.63.225
description:
Feb  5 22:56:43 ait sshd[839768]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.63.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.135.6.10
description:
2025-02-05 22:56:49 dovecot_login authenticator failed for ([117.135.6.10]) [117.135.6.10]:59449: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.63.225
description:
Feb  5 22:56:43 ait sshd[839768]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.63.225


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.135.6.10
description:
Feb  5 22:56:47 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.135.6.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.72.176.66
description:
Feb  5 22:56:02 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.72.176.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 141.98.143.16
description:
[2025-02-05 22:56:18 +0100] info [webmaild] 141.98.143.16 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.158.63.153
description:
[2025-02-05 22:56:51 +0100] info [webmaild] 102.158.63.153 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.19.233.108
description:
[2025-02-05 22:57:18 +0100] info [webmaild] 191.19.233.108 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 22:57:45 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.15.78
description:
[2025-02-05 22:57:50 +0100] info [webmaild] 45.70.15.78 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.129.92
description:
Feb  5 22:57:03 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.129.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.129.92
description:
2025-02-05 22:57:05 dovecot_login authenticator failed for ([111.53.129.92]) [111.53.129.92]:50852: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.120.165
description:
47.128.120.165 - - [05/Feb/2025:22:58:26 +0100] "GET /wp-content/plugins/elementor/assets/css/frontend-legacy.min.css HTTP/2.0" 200 1420 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12271542" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"1" PEER:47.128.120.165


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.63.46.34
description:
Feb  5 22:58:32 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.63.46.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.63.46.34
description:
2025-02-05 22:58:34 dovecot_login authenticator failed for ([203.29.84.253]) [203.63.46.34]:59915: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.46.79
description:
Feb  5 22:58:45 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.46.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.46.79
description:
2025-02-05 22:58:47 dovecot_plain authenticator failed for ([117.158.46.79]) [117.158.46.79]:54578: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.189.90
description:
2025-02-05 22:59:09 dovecot_plain authenticator failed for ([112.172.189.90]) [112.172.189.90]:59206: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.226.104
description:
2025-02-05 22:59:12 dovecot_plain authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:40709: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.189.44.106
description:
[2025-02-05 22:59:27 +0100] info [webmaild] 179.189.44.106 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.226.104
description:
Feb  5 22:59:10 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.226.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.113.61.126
description:
Feb  5 22:59:29 ait sshd[840903]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.113.61.126


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.68.52.210
description:
Feb  5 22:59:25 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.68.52.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
description:
2025-02-05 22:59:27 dovecot_plain authenticator failed for ([103.68.52.210]) [103.68.52.210]:50882: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 102.209.16.253
description:
Feb  5 22:59:34 ait sshd[840926]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.209.16.253


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.189.90
description:
Feb  5 22:59:07 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.189.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.113.61.126
description:
Feb  5 22:59:29 ait sshd[840903]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.113.61.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.209.16.253
description:
Feb  5 22:59:34 ait sshd[840926]: pam_imunify(sshd:auth): [IM360_RBL] The IP 102.209.16.253 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 141.136.78.51
description:
[2025-02-05 22:59:46 +0100] info [webmaild] 141.136.78.51 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
description:
2025-02-05 23:00:25 dovecot_plain authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:44474: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.136.192.106
description:
2025-02-05 23:00:35 dovecot_plain authenticator failed for ([175.136.192.106]) [175.136.192.106]:37894: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 87.117.185.150
description:
[2025-02-05 23:00:03 +0100] info [webmaild] 87.117.185.150 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.13.25.186
description:
Feb  5 23:00:16 ait sshd[841267]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.13.25.186 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.214.53.166
description:
[2025-02-05 23:00:18 +0100] info [webmaild] 41.214.53.166 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.41.171
description:
2025-02-05 23:00:30 dovecot_plain authenticator failed for 171.41.246.220.static.netvigator.com [220.246.41.171]:50469: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-02-05 23:00:43 dovecot_plain authenticator failed for ([218.106.120.18]) [58.49.113.138]:10888: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.39.230.40
description:
2025-02-05 23:00:44 dovecot_plain authenticator failed for ([118.39.230.40]) [118.39.230.40]:4695: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.13.25.186
description:
Feb  5 23:00:16 ait sshd[841267]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.13.25.186


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Feb  5 23:00:22 ait sshd[841286]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.124.14
description:
Feb  5 23:00:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.124.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Feb  5 23:00:41 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.39.230.40
description:
Feb  5 23:00:42 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.39.230.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.149.142.21
description:
2025-02-05 23:00:33 dovecot_plain authenticator failed for ([93.125.83.110]) [91.149.142.21]:57534: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.136.192.106
description:
Feb  5 23:00:33 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.136.192.106 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-00.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Feb  5 23:00:22 ait sshd[841286]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.41.171
description:
Feb  5 23:00:28 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.41.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.149.142.21
description:
Feb  5 23:00:31 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.149.142.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.162.187
description:
Feb  5 23:01:49 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.162.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.117.197.238
description:
2025-02-05 23:01:58 dovecot_plain authenticator failed for net-109-117-197-238.cust.vodafonedsl.it [109.117.197.238]:55964: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.215.2.207
description:
Feb  5 23:01:44 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.215.2.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.246.214
description:
2025-02-05 23:01:48 dovecot_plain authenticator failed for (nsg-corporate-214.246.187.122.airtel.in) [122.187.246.214]:53929: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 23:01:48 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.246.214
description:
Feb  5 23:01:46 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.246.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.117.197.238
description:
Feb  5 23:01:56 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.117.197.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 23:01:13 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.162.187
description:
2025-02-05 23:01:51 dovecot_plain authenticator failed for (maens) [65.20.162.187]:37162: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.28.66.78
description:
Feb  5 23:02:48 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.28.66.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.28.66.78
description:
2025-02-05 23:02:50 dovecot_plain authenticator failed for ([62.28.66.78]) [62.28.66.78]:38030: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.10.6.170
description:
[2025-02-05 23:02:16 +0100] info [webmaild] 187.10.6.170 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 90.151.141.142
description:
[2025-02-05 23:02:50 +0100] info [webmaild] 90.151.141.142 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.78.51.249
description:
[2025-02-05 23:02:41 +0100] info [webmaild] 170.78.51.249 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.108.174.218
description:
[2025-02-05 23:02:03 +0100] info [webmaild] 41.108.174.218 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 23:02:05 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.93.12.184
description:
Feb  5 23:02:28 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.93.12.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.93.12.184
description:
2025-02-05 23:02:30 dovecot_plain authenticator failed for ([124.93.12.184]) [124.93.12.184]:15612: 535 Incorrect authentication data (set_id=mail@myait.org)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.22.58
description:
47.128.22.58 - - [05/Feb/2025:23:03:06 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988001 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/9/?filter_course-language=99&filtering=1&price_type=free" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.22.58


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.134.44
description:
Feb  5 23:03:47 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.134.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.0.61.49
description:
2025-02-05 23:03:55 dovecot_plain authenticator failed for ([27.0.61.49]) [27.0.61.49]:40610: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.87.187.71
description:
Feb  5 23:03:21 ait sshd[842558]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.87.187.71


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.54.223
description:
47.128.54.223 - - [05/Feb/2025:23:03:55 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=24988637 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/5/?duration=short%2Clong&filter_course-category=205&filtering=1&instructor=2&level=beginner%2Cintermediate" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.54.223


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.87.187.71
description:
Feb  5 23:03:21 ait sshd[842558]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.87.187.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.91.173.203
description:
Feb  5 23:03:43 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.91.173.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.0.61.49
description:
Feb  5 23:03:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.0.61.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.91.173.203
description:
2025-02-05 23:03:45 dovecot_plain authenticator failed for (197-91-173-203.dyn.mweb.co.za) [197.91.173.203]:36284: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 23:03:49 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.83.0.148
description:
Feb  5 23:04:33 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.83.0.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.165.148.166
description:
Feb  5 23:04:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.165.148.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
description:
2025-02-05 23:04:55 dovecot_plain authenticator failed for ([200.165.163.121]) [200.165.148.166]:40237: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.237.100.224
description:
[2025-02-05 23:04:58 +0100] info [webmaild] 45.237.100.224 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.0.148
description:
2025-02-05 23:04:35 dovecot_plain authenticator failed for ool-43530094.dyn.optonline.net [67.83.0.148]:51625: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.250.63
description:
Feb  5 23:04:39 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.250.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.63
description:
2025-02-05 23:04:41 dovecot_plain authenticator failed for (honiade) [65.20.250.63]:33296: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 87.117.49.5
description:
[2025-02-05 23:04:43 +0100] info [webmaild] 87.117.49.5 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 23:04:44 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.246.49.99
description:
Feb  5 23:05:57 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.246.49.99 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.245.144.74
description:
[2025-02-05 23:05:19 +0100] info [webmaild] 170.245.144.74 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.185.13.59
description:
Feb  5 23:05:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.185.13.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.185.13.59
description:
2025-02-05 23:05:38 dovecot_login authenticator failed for ([211.185.13.59]) [211.185.13.59]:52348: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.102.160
description:
2025-02-05 23:05:27 dovecot_plain authenticator failed for (abts-mum-static-160.102.169.122.airtelbroadband.in) [122.169.102.160]:35729: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.33.22
description:
47.128.33.22 - - [05/Feb/2025:23:05:45 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18567678 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=125%2C106%2C61&filter_course-language=183%2C79%2C118&filtering=1&instructor=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.33.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.246.49.99
description:
2025-02-05 23:05:59 dovecot_login authenticator failed for (abts-mp-static-185.120.168.122.airtelbroadband.in) [115.246.49.99]:35766: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.16.156.103
description:
2025-02-05 23:05:12 dovecot_plain authenticator failed for (173-16-156-103.client.mchsi.com) [173.16.156.103]:36718: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  5 23:05:17 ait sshd[843273]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.71.106
description:
Feb  5 23:05:22 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.71.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.192.102.55
description:
[2025-02-05 23:05:28 +0100] info [webmaild] 200.192.102.55 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.94.18.69
description:
Feb  5 23:05:50 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.94.18.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.94.18.69
description:
2025-02-05 23:05:52 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:57230: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.16.156.103
description:
Feb  5 23:05:10 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.16.156.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  5 23:05:17 ait sshd[843273]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.102.160
description:
Feb  5 23:05:25 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.102.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.197.40
description:
2025-02-05 23:05:50 dovecot_login authenticator failed for (m121-202-197-40.smartone.com) [121.202.197.40]:28691: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.71.106
description:
2025-02-05 23:05:24 dovecot_login authenticator failed for (abts-kk-static-106.71.166.122.airtelbroadband.in) [122.166.71.106]:58262: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.197.40
description:
Feb  5 23:05:48 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.197.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.77.172.143
description:
Feb  5 23:06:06 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.77.172.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.77.172.143
description:
2025-02-05 23:06:08 dovecot_plain authenticator failed for ([119.77.172.143]) [119.77.172.143]:1925: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.67.38.27
description:
Feb  5 23:06:55 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.67.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
description:
2025-02-05 23:06:57 dovecot_login authenticator failed for 89-67-38-27.dynamic.chello.pl [89.67.38.27]:57855: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.79.232.38
description:
2025-02-05 23:08:55 dovecot_plain authenticator failed for ([142.79.232.38]) [142.79.232.38]:55115: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.101.204.242
description:
Feb  5 23:09:00 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.101.204.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.79.91.142
description:
Feb  5 23:08:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.79.91.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.105
description:
Feb  5 23:08:54 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.79.91.142
description:
2025-02-05 23:08:55 dovecot_plain authenticator failed for wsip-174-79-91-142.br.br.cox.net [174.79.91.142]:63121: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.115.53.66
description:
Feb  5 23:08:41 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.115.53.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.53.66
description:
2025-02-05 23:08:43 dovecot_plain authenticator failed for (58-115-53-66.twt1.com.tw) [58.115.53.66]:59104: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.79.232.38
description:
Feb  5 23:08:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.79.232.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.105
description:
2025-02-05 23:08:56 dovecot_login authenticator failed for 111-70-49-105.emome-ip.hinet.net [111.70.49.105]:55065: 535 Incorrect authentication data (set_id=freeman@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.35.226.158
description:
Feb  5 23:09:39 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.35.226.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.35.226.158
description:
2025-02-05 23:09:41 dovecot_plain authenticator failed for (sasomic) [193.35.226.158]:37909: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.242.149.240
description:
Feb  5 23:09:03 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.242.149.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.242.149.240
description:
2025-02-05 23:09:05 dovecot_login authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:56728: 535 Incorrect authentication data (set_id=freeman)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.59.94.130
description:
Feb  5 23:09:13 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.59.94.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.233.85.194
description:
Feb  5 23:09:28 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.233.85.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-02-05 23:09:42 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (refluna) [51.255.84.180]:43448: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.101.204.242
description:
2025-02-05 23:09:02 dovecot_plain authenticator failed for ([112.101.204.242]) [112.101.204.242]:52044: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
description:
2025-02-05 23:09:05 dovecot_plain authenticator failed for ([70.90.99.29]) [70.90.99.29]:36270: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.207.225.55
description:
Feb  5 23:09:10 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.207.225.55 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.52.141.93
description:
[2025-02-05 23:09:54 +0100] info [webmaild] 38.52.141.93 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.203.197.110
description:
[2025-02-05 23:10:00 +0100] info [webmaild] 41.203.197.110 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
description:
2025-02-05 23:09:12 dovecot_plain authenticator failed for wsip-64-207-225-55.tu.ok.cox.net (wsip-64-207-241-177.tu.ok.cox.net) [64.207.225.55]:43975: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.233.85.194
description:
2025-02-05 23:09:30 dovecot_plain authenticator failed for ([183.233.85.194]) [183.233.85.194]:33170: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Feb  5 23:09:40 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.90.99.29
description:
Feb  5 23:09:03 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.90.99.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.59.94.130
description:
2025-02-05 23:09:15 dovecot_plain authenticator failed for (rw-00130-94.59.137.rcil.gov.in) [137.59.94.130]:60008: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.251.112.152
description:
Feb  5 23:09:48 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.251.112.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 23:10:01 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.26.64
description:
Feb  5 23:10:07 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.26.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.113.66.20
description:
Feb  5 23:10:27 ait sshd[845435]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.113.66.20 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.113.66.20
description:
Feb  5 23:10:27 ait sshd[845435]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.113.66.20


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.70.105
description:
[2025-02-05 23:10:29 +0100] info [webmaild] 84.54.70.105 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.176.10.252
description:
[2025-02-05 23:10:54 +0100] info [webmaild] 45.176.10.252 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.109.33.120
description:
2025-02-05 23:11:44 dovecot_plain authenticator failed for rplus.dp.ua [77.109.33.120]:57548: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 154.161.162.149
domain: 136.243.145.84
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:rUJf||MV:5340 AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat ../../../etc/passwd')#||RSV:6.65||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 154.161.162.149
domain: 136.243.145.84
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:rUJf||MV:5340 AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat ../../../etc/passwd')#||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.109.33.120
description:
Feb  5 23:11:42 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.109.33.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.190
description:
2025-02-05 23:11:46 dovecot_plain authenticator failed for (nsg-corporate-190.227.187.122.airtel.in) [122.187.227.190]:50435: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.104.41
description:
Feb  5 23:11:55 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.104.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.124.47.11
description:
Feb  5 23:11:28 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.124.47.11 has been locked due to Imunify RBL


plugin: modsec
rule: 77350223
name: IM360 WAF: Common SQLi
abuser: 154.161.162.149
domain: 136.243.145.84
description:
IM360 WAF: Common SQLi||MVN:ARGS:rUJf||MV:5340 AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")</script>',table_name FROM information_schema.tables WHERE 2>1||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.190
description:
Feb  5 23:11:44 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.200.16
description:
Feb  5 23:11:52 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.200.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.200.16
description:
2025-02-05 23:11:54 dovecot_plain authenticator failed for (16.200.86.116.starhub.net.sg) [116.86.200.16]:38547: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.104.41
description:
2025-02-05 23:11:57 dovecot_plain authenticator failed for visaustralia.com [216.70.104.41]:56778: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.218
description:
Feb  5 23:11:07 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.124.47.11
description:
2025-02-05 23:11:30 dovecot_plain authenticator failed for ([111.124.47.11]) [111.124.47.11]:33832: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.145.163.164
description:
Feb  5 23:12:21 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.145.163.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.163.164
description:
2025-02-05 23:12:23 dovecot_plain authenticator failed for ([61.145.163.164]) [61.145.163.164]:40965: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.0.7.76
description:
[2025-02-05 23:12:30 +0100] info [webmaild] 138.0.7.76 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 23:12:34 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.175.253.49
description:
Feb  5 23:12:10 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.175.253.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Feb  5 23:12:08 ait sshd[846257]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.70
description:
Feb  5 23:12:02 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.70 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Feb  5 23:12:08 ait sshd[846257]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.253.49
description:
2025-02-05 23:12:12 dovecot_plain authenticator failed for ([89.175.253.49]) [89.175.253.49]:52700: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.70
description:
2025-02-05 23:12:04 dovecot_plain authenticator failed for ([185.167.56.70]) [185.167.56.70]:34054: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.221.79.210
description:
[2025-02-05 23:12:35 +0100] info [webmaild] 177.221.79.210 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Feb  5 23:13:06 ait sshd[846489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.106.194.74
description:
Feb  5 23:13:24 ait sshd[846685]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.106.194.74


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.142.135
description:
Feb  5 23:13:26 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.142.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.132.113
description:
Feb  5 23:13:50 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.132.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.132.113
description:
2025-02-05 23:13:52 dovecot_plain authenticator failed for ([188.226.132.113]) [188.226.132.113]:40554: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.167.55.230
description:
Feb  5 23:13:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.167.55.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.79.19
description:
Feb  5 23:13:42 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.187.79.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.19.6
description:
Feb  5 23:13:50 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.19.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.62.156.249
description:
[2025-02-05 23:13:04 +0100] info [webmaild] 187.62.156.249 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.237.166.244
description:
[2025-02-05 23:13:05 +0100] info [webmaild] 45.237.166.244 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.194.74
description:
Feb  5 23:13:24 ait sshd[846685]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.106.194.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.130
description:
2025-02-05 23:13:54 dovecot_login authenticator failed for ([119.198.191.130]) [119.198.191.130]:38260: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.49.60.24
description:
Feb  5 23:14:00 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.49.60.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Feb  5 23:13:06 ait sshd[846489]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.142.135
description:
2025-02-05 23:13:28 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:23279: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.79.19
description:
2025-02-05 23:13:44 dovecot_plain authenticator failed for ([103.187.79.19]) [103.187.79.19]:45366: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.19.6
description:
2025-02-05 23:13:52 dovecot_plain authenticator failed for ([195.158.19.6]) [195.158.19.6]:42016: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.198.191.130
description:
Feb  5 23:13:52 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.198.191.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
description:
2025-02-05 23:13:55 dovecot_plain authenticator failed for ([168.167.55.230]) [168.167.55.230]:56524: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.61
description:
Feb  5 23:14:30 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.49.60.24
description:
2025-02-05 23:14:02 dovecot_login authenticator failed for (l49-60-24.novotelecom.ru) [178.49.60.24]:51324: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.248.223
description:
Feb  5 23:14:12 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.248.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.235.45
description:
2025-02-05 23:14:15 dovecot_plain authenticator failed for p48045-obmd01.osaka.ocn.ne.jp [153.141.235.45]:40413: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.160
description:
Feb  5 23:14:18 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.160 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.212.54
description:
Feb  5 23:14:26 ait sshd[847091]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.212.54


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.106.23.215
description:
Feb  5 23:14:37 ait sshd[847153]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.106.23.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.235.45
description:
Feb  5 23:14:13 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.235.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
description:
2025-02-05 23:14:14 dovecot_plain authenticator failed for 95-87-248-223.ip.btc-net.bg (95-87-248-223.net1.bg) [95.87.248.223]:33690: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Feb  5 23:14:16 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.250.63
description:
Feb  5 23:14:24 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.250.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.212.54
description:
Feb  5 23:14:26 ait sshd[847091]: pam_imunify(sshd:auth): [IM360_RBL] The IP 139.59.212.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.63
description:
2025-02-05 23:14:26 dovecot_plain authenticator failed for (chrous) [65.20.250.63]:38847: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-02-05 23:14:18 dovecot_plain authenticator failed for ([186.200.8.115]) [186.200.249.162]:54222: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.61
description:
2025-02-05 23:14:32 dovecot_login authenticator failed for (m121-202-155-61.smartone.com) [121.202.155.61]:58421: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.106.23.215
description:
Feb  5 23:14:37 ait sshd[847153]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.106.23.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.160
description:
2025-02-05 23:14:20 dovecot_login authenticator failed for ([218.149.228.160]) [218.149.228.160]:43595: 535 Incorrect authentication data (set_id=info@ait-open.net)


