# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.134.243.37
country_id: 2017370
description:
2025-02-06 05:21:17 dovecot_login authenticator failed for ([31.134.243.37]) [31.134.243.37]:43513: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.175.61.9
country_id: 1835841
description:
Feb  6 05:21:24 ait sshd[990920]: pam_imunify(sshd:auth): [IM360_RBL] The IP 112.175.61.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.31.73
country_id: 6252001
description:
Feb  6 05:21:28 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.31.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.90.150.51
country_id: 2921044
description:
Feb  6 05:21:23 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.90.150.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.31.73
country_id: 6252001
description:
2025-02-06 05:21:30 dovecot_plain authenticator failed for ([65.76.31.73]) [65.76.31.73]:36618: 535 Incorrect authentication data (set_id=admin@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.120.208.148
country_id: 2017370
description:
Feb  6 05:21:33 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.120.208.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.243.37
country_id: 2017370
description:
Feb  6 05:21:15 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.243.37 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 112.175.61.9
country_id: 1835841
description:
Feb  6 05:21:24 ait sshd[990920]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.175.61.9  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2025-02-06 05:21:40 dovecot_plain authenticator failed for ([196.190.43.139]) [196.190.41.137]:28949: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.72.128.185
country_id: 3469034
description:
Feb  6 05:22:17 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.72.128.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.191.88.29
country_id: 1562822
description:
Feb  6 05:22:19 ait sshd[991257]: pam_imunify(sshd:auth): [IM360_RBL] The IP 160.191.88.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.133.206
country_id: 6252001
description:
2025-02-06 05:22:51 dovecot_plain authenticator failed for syn-035-130-133-206.biz.spectrum.com [35.130.133.206]:37434: 535 Incorrect authentication data (set_id=ads32a00023y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.151.237.21
country_id: 690791
description:
[2025-02-06 05:22:12 +0100] info [webmaild] 45.151.237.21 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.241.161
country_id: 1835841
description:
2025-02-06 05:22:26 dovecot_login authenticator failed for ([115.23.241.161]) [115.23.241.161]:56377: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 160.191.88.29
country_id: 1562822
description:
Feb  6 05:22:19 ait sshd[991257]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.191.88.29  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.232.166.125
country_id: 3469034
description:
[2025-02-06 05:22:44 +0100] info [webmaild] 179.232.166.125 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.133.206
country_id: 6252001
description:
Feb  6 05:22:49 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.133.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.225.109.30
country_id: 1733045
description:
Feb  6 05:22:51 ait sshd[991323]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.225.109.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.100.136
country_id: 1821275
description:
Feb  6 05:22:53 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.100.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.72.128.185
country_id: 3469034
description:
2025-02-06 05:22:19 dovecot_plain authenticator failed for (187-072-128-185.static.ctbctelecom.com.br) [187.72.128.185]:51354: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.241.161
country_id: 1835841
description:
Feb  6 05:22:24 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.241.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.102.66.226
country_id: 6251999
description:
Feb  6 05:22:03 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.102.66.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.243
country_id: 1668284
description:
Feb  6 05:22:38 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.237.100.136
country_id: 1821275
description:
2025-02-06 05:22:55 dovecot_login authenticator failed for ([103.237.100.136]) [103.237.100.136]:45338: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.102.66.226
country_id: 6251999
description:
2025-02-06 05:22:05 dovecot_plain authenticator failed for ([207.102.66.226]) [207.102.66.226]:59305: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.134.215.194
country_id: 3865483
description:
[2025-02-06 05:22:33 +0100] info [webmaild] 186.134.215.194 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.196.148.24
country_id: 3469034
description:
[2025-02-06 05:22:04 +0100] info [webmaild] 38.196.148.24 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.218.134.95
country_id: 6252001
description:
2025-02-06 05:22:36 dovecot_plain authenticator failed for 32-218-134-95.bng02.trtn.ct.frontiernet.net [32.218.134.95]:43884: 535 Incorrect authentication data (set_id=ads32a00023y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.243
country_id: 1668284
description:
2025-02-06 05:22:40 dovecot_login authenticator failed for 111-70-23-243.emome-ip.hinet.net [111.70.23.243]:44672: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.225.109.30
country_id: 1733045
description:
Feb  6 05:22:51 ait sshd[991323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.225.109.30


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.218.134.95
country_id: 6252001
description:
Feb  6 05:22:34 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.218.134.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.252.225
country_id: 6252001
description:
Feb  6 05:23:53 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.252.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.108.95.66
country_id: 690791
description:
2025-02-06 05:23:56 dovecot_plain authenticator failed for (coppommin) [109.108.95.66]:40704: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.189.154.33
country_id: 1880251
description:
Feb  6 05:23:33 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.189.154.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.152.99.171
country_id: 6252001
description:
Feb  6 05:23:43 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.152.99.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.171
country_id: 6252001
description:
2025-02-06 05:23:45 dovecot_plain authenticator failed for syn-184-152-099-171.res.spectrum.com [184.152.99.171]:33388: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.180
country_id: 2542007
description:
Feb  6 05:23:56 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.242.71.107
country_id: 1814991
description:
2025-02-06 05:23:24 dovecot_plain authenticator failed for ([36.32.223.199]) [58.242.71.107]:46450: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.108.95.66
country_id: 690791
description:
Feb  6 05:23:54 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.108.95.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.252.225
country_id: 6252001
description:
2025-02-06 05:23:55 dovecot_plain authenticator failed for syn-076-176-252-225.res.spectrum.com [76.176.252.225]:44336: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-02-06 05:23:58 dovecot_plain authenticator failed for (sheakhage) [102.53.15.180]:41202: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.242.71.107
country_id: 1814991
description:
Feb  6 05:23:22 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.242.71.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.189.154.33
country_id: 1880251
description:
2025-02-06 05:23:35 dovecot_plain authenticator failed for ([206.189.154.33]) [206.189.154.33]:37892: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.130.18.21
country_id: 1668284
description:
2025-02-06 05:24:21 dovecot_login authenticator failed for 220-130-18-21.hinet-ip.hinet.net [220.130.18.21]:49504: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.159.229.11
country_id: 3658394
description:
[2025-02-06 05:24:39 +0100] info [webmaild] 38.159.229.11 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.28.154.169
country_id: 6252001
description:
Feb  6 05:24:58 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.28.154.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.130.18.21
country_id: 1668284
description:
Feb  6 05:24:19 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.130.18.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.32.19.205
country_id: 1668284
description:
Feb  6 05:24:37 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.32.19.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.32.19.205
country_id: 1668284
description:
2025-02-06 05:24:39 dovecot_plain authenticator failed for 114-32-19-205.hinet-ip.hinet.net [114.32.19.205]:55130: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.4.255.205
country_id: 1835841
description:
Feb  6 05:24:43 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.4.255.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.4.255.205
country_id: 1835841
description:
2025-02-06 05:24:45 dovecot_login authenticator failed for ([59.4.255.205]) [59.4.255.205]:35520: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.46.39.15
country_id: 3865483
description:
[2025-02-06 05:24:50 +0100] info [webmaild] 181.46.39.15 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.163.57.10
country_id: 1643084
description:
Feb  6 05:24:56 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.163.57.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.163.57.10
country_id: 1643084
description:
2025-02-06 05:24:58 dovecot_plain authenticator failed for (ip-103-133.222-205.cloudteknologinusantara.co.id) [125.163.57.10]:45638: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.28.154.169
country_id: 6252001
description:
2025-02-06 05:25:00 dovecot_plain authenticator failed for s169-154-28-8.gec.tx.wi-power.com [8.28.154.169]:45347: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.43.32.181
country_id: 3895114
description:
[2025-02-06 05:25:10 +0100] info [webmaild] 181.43.32.181 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.166.162.78
country_id: 1814991
description:
Feb  6 05:25:10 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.166.162.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.166.162.78
country_id: 1814991
description:
2025-02-06 05:25:12 dovecot_plain authenticator failed for ([180.166.162.78]) [180.166.162.78]:47566: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.209.32.202
country_id: 953987
description:
[2025-02-06 05:25:23 +0100] info [webmaild] 105.209.32.202 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.143.246.12
country_id: 1835841
description:
Feb  6 05:25:34 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.143.246.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.143.246.12
country_id: 1835841
description:
2025-02-06 05:25:36 dovecot_plain authenticator failed for ([125.143.246.12]) [125.143.246.12]:58185: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.83
country_id: 1819730
description:
Feb  6 05:25:06 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.83
country_id: 1819730
description:
2025-02-06 05:25:08 dovecot_plain authenticator failed for (m121-202-154-83.smartone.com) [121.202.154.83]:42770: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.148.197.119
country_id: 2750405
description:
Feb  6 05:25:31 ait sshd[992092]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.148.197.119 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.148.197.119
country_id: 2750405
description:
Feb  6 05:25:31 ait sshd[992092]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.148.197.119  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-02-06 05:26:45 dovecot_login authenticator failed for ([216.194.174.74]) [216.194.174.27]:32288: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.116.123
country_id: 1880251
description:
47.128.116.123 - - [06/Feb/2025:05:26:03 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19339571 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/?filtering=1&instructor=2&level=expert" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.116.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.36.64.247
country_id: 3175395
description:
2025-02-06 05:26:25 dovecot_plain authenticator failed for net-2-36-64-247.cust.vodafonedsl.it (aggey) [2.36.64.247]:42421: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
country_id: 1880251
description:
2025-02-06 05:26:32 dovecot_login authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:59838: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
country_id: 6252001
description:
Feb  6 05:26:43 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.59.147
country_id: 1880251
description:
47.128.59.147 - - [06/Feb/2025:05:26:58 +0100] "GET /wp-content/themes/edumall/assets/images/page-404-image.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7251564" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.59.147


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 05:26:58 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.36.64.247
country_id: 3175395
description:
Feb  6 05:26:23 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.36.64.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
country_id: 1880251
description:
Feb  6 05:26:30 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.68.194.54
country_id: 1835841
description:
Feb  6 05:27:05 ait sshd[992589]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.68.194.54  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.111.34
country_id: 1814991
description:
Feb  6 05:27:22 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.111.34 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 102.209.16.253
country_id: 927384
description:
Feb  6 05:27:07 ait sshd[992713]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.209.16.253  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.190.181
country_id: 6252001
description:
2025-02-06 05:27:52 dovecot_plain authenticator failed for ([47.149.190.181]) [47.149.190.181]:58124: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.43.101.139
country_id: 3469034
description:
[2025-02-06 05:27:18 +0100] info [webmaild] 38.43.101.139 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.7.94.124
country_id: 3469034
description:
[2025-02-06 05:27:34 +0100] info [webmaild] 191.7.94.124 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77350496
name: IM360 WAF: RCE through argument injection in PHP CGI (CVE-2024-4577)
abuser: 192.42.116.202
country_id: 2750405
domain: 136.243.145.84
description:
IM360 WAF: RCE through argument injection in PHP CGI (CVE-2024-4577)||URI:/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input||RSV:6.65||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 194.164.224.3
country_id: 587116
description:
[2025-02-06 05:27:54 +0100] info [webmaild] 194.164.224.3 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.244.246.221
country_id: 1835841
description:
2025-02-06 05:27:56 dovecot_plain authenticator failed for ([1.244.246.221]) [1.244.246.221]:40776: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.209.16.253
country_id: 927384
description:
Feb  6 05:27:07 ait sshd[992713]: pam_imunify(sshd:auth): [IM360_RBL] The IP 102.209.16.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.111.34
country_id: 1814991
description:
2025-02-06 05:27:24 dovecot_plain authenticator failed for ([180.168.111.34]) [180.168.111.34]:35005: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.43.144.70
country_id: 2635167
description:
Feb  6 05:27:49 ait sshd[992821]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.43.144.70


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.244.246.221
country_id: 1835841
description:
Feb  6 05:27:54 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.244.246.221 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.22.238.84
country_id: 3469034
description:
[2025-02-06 05:27:05 +0100] info [webmaild] 201.22.238.84 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.83.78
country_id: 1269750
description:
2025-02-06 05:27:42 dovecot_plain authenticator failed for ([182.78.83.78]) [182.78.83.78]:34734: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.190.181
country_id: 6252001
description:
Feb  6 05:27:50 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.190.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.175.122
country_id: 1814991
description:
Feb  6 05:27:55 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.175.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.68.194.54
country_id: 1835841
description:
Feb  6 05:27:05 ait sshd[992589]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.68.194.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.83.78
country_id: 1269750
description:
Feb  6 05:27:40 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.83.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.43.144.70
country_id: 2635167
description:
Feb  6 05:27:49 ait sshd[992821]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.43.144.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.175.122
country_id: 1814991
description:
2025-02-06 05:27:57 dovecot_plain authenticator failed for ([120.236.175.122]) [120.236.175.122]:37028: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.53.114.86
country_id: 6252001
description:
Feb  6 05:28:29 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.53.114.86 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.41.164
country_id: 1880251
description:
47.128.41.164 - - [06/Feb/2025:05:28:36 +0100] "GET /wp-content/themes/edumall/assets/images/page-404-image.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19137088" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.41.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.226.173.151
country_id: 2017370
description:
2025-02-06 05:28:57 dovecot_plain authenticator failed for (pool-176-226-173-151.is74.ru) [176.226.173.151]:53368: 535 Incorrect authentication data (set_id=ads07b99022y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.14.31.158
country_id: 3017382
description:
Feb  6 05:28:58 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.14.31.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.53.114.86
country_id: 6252001
description:
2025-02-06 05:28:31 dovecot_plain authenticator failed for syn-067-053-114-086.biz.spectrum.com [67.53.114.86]:33639: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.226.173.151
country_id: 2017370
description:
Feb  6 05:28:55 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.226.173.151 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.123.4
country_id: 1880251
description:
47.128.123.4 - - [06/Feb/2025:05:28:56 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=8257009 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/5/?duration=short&filter_course-language=183&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.123.4


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
country_id: 3017382
description:
2025-02-06 05:29:00 dovecot_plain authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr (coebilbure) [80.14.31.158]:37668: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2025-02-06 05:29:37 dovecot_plain authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:38026: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.240.121.31
country_id: 6252001
description:
2025-02-06 05:29:39 dovecot_plain authenticator failed for cm-72-240-121-31.buckeyecom.net [72.240.121.31]:54261: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.99
country_id: 6251999
description:
2025-02-06 05:29:49 dovecot_plain authenticator failed for ([207.219.221.99]) [207.219.221.99]:56889: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.7.200.152
country_id: 1861060
description:
Feb  6 05:29:06 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.7.200.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.240.121.31
country_id: 6252001
description:
Feb  6 05:29:37 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.240.121.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.44
country_id: 6251999
description:
Feb  6 05:29:31 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.241.232.14
country_id: 2921044
description:
Feb  6 05:29:35 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.241.232.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.196.64.203
country_id: 1814991
description:
2025-02-06 05:29:56 dovecot_plain authenticator failed for ([120.196.64.203]) [120.196.64.203]:42799: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
country_id: 1835841
description:
Feb  6 05:29:11 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
country_id: 1835841
description:
2025-02-06 05:29:13 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:44906: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.44
country_id: 6251999
description:
2025-02-06 05:29:33 dovecot_plain authenticator failed for ([207.219.222.44]) [207.219.222.44]:60009: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.99
country_id: 6251999
description:
Feb  6 05:29:47 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.99 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.0.205.201
country_id: 3469034
description:
[2025-02-06 05:29:54 +0100] info [webmaild] 131.0.205.201 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 05:29:12 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.190.147.29
country_id: 6252001
description:
Feb  6 05:29:54 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.190.147.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.196.64.203
country_id: 1814991
description:
Feb  6 05:29:54 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.196.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.165.83
country_id: 99237
description:
Feb  6 05:29:54 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.165.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.165.83
country_id: 99237
description:
2025-02-06 05:29:56 dovecot_plain authenticator failed for (kinedly) [65.20.165.83]:44688: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.190.147.29
country_id: 6252001
description:
2025-02-06 05:29:56 dovecot_plain authenticator failed for static-47-190-147-29.dlls.tx.frontiernet.net [47.190.147.29]:57854: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
country_id: 1861060
description:
2025-02-06 05:29:08 dovecot_plain authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:37996: 535 Incorrect authentication data (set_id=ads07b99022y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.66.226.237
country_id: 3658394
description:
[2025-02-06 05:29:44 +0100] info [webmaild] 186.66.226.237 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.206.23
country_id: 1814991
description:
Feb  6 05:30:02 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.206.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.231.242
country_id: 1814991
description:
2025-02-06 05:30:05 dovecot_plain authenticator failed for ([124.115.231.242]) [124.115.231.242]:54191: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 05:30:09 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.252.171.26
country_id: 3017382
description:
Feb  6 05:30:09 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.252.171.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.206.23
country_id: 1814991
description:
2025-02-06 05:30:04 dovecot_plain authenticator failed for ([111.39.206.23]) [111.39.206.23]:50782: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.255.45
country_id: 1210997
description:
2025-02-06 05:30:09 dovecot_plain authenticator failed for (27-123-255-45-mcnbd.com) [27.123.255.45]:53810: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.66.90.16
country_id: 3469034
description:
[2025-02-06 05:30:28 +0100] info [webmaild] 177.66.90.16 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.255.45
country_id: 1210997
description:
Feb  6 05:30:07 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.255.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.165.83
country_id: 99237
description:
Feb  6 05:30:09 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.165.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.165.83
country_id: 99237
description:
2025-02-06 05:30:11 dovecot_plain authenticator failed for (guounifte) [65.20.165.83]:45500: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.183.30.112
country_id: 3996063
description:
[2025-02-06 05:30:12 +0100] info [webmaild] 189.183.30.112 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.135
country_id: 2017370
description:
2025-02-06 05:30:17 dovecot_plain authenticator failed for ([178.178.194.135]) [178.178.194.135]:56530: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.252.171.26
country_id: 3017382
description:
2025-02-06 05:30:11 dovecot_plain authenticator failed for lmontsouris-656-1-112-26.w193-252.abo.wanadoo.fr (wayemid) [193.252.171.26]:59046: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.135
country_id: 2017370
description:
Feb  6 05:30:15 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.188.253.150
country_id: 1269750
description:
Feb  6 05:31:27 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.188.253.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.226.228
country_id: 2017370
description:
Feb  6 05:31:38 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.226.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.82.102
country_id: 3017382
description:
Feb  6 05:31:25 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.82.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.82.102
country_id: 3017382
description:
2025-02-06 05:31:27 dovecot_plain authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:55796: 535 Incorrect authentication data (set_id=ads21a00069y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2025-02-06 05:31:29 dovecot_plain authenticator failed for ([180.188.253.150]) [180.188.253.150]:48250: 535 Incorrect authentication data (set_id=agbozume1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.226.228
country_id: 2017370
description:
2025-02-06 05:31:40 dovecot_plain authenticator failed for broadband-77-37-226-228.ip.moscow.rt.ru [77.37.226.228]:60448: 535 Incorrect authentication data (set_id=ads21a00069y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.18.217
country_id: 1814991
description:
2025-02-06 05:31:55 dovecot_plain authenticator failed for ([117.175.18.217]) [117.175.18.217]:45011: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.39.208
country_id: 1880251
description:
47.128.39.208 - - [06/Feb/2025:05:31:18 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10507917 HTTP/2.0" 302 0 iric.us "https://iric.us/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.39.208


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.47.172.133
country_id: 1831722
description:
Feb  6 05:31:21 ait sshd[994142]: pam_imunify(sshd:auth): [IM360_RBL] The IP 163.47.172.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.187.22.206
country_id: 1880251
description:
Feb  6 05:31:37 ait sshd[994319]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.187.22.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.187.22.206
country_id: 1880251
description:
Feb  6 05:31:37 ait sshd[994319]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.22.206  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.18.217
country_id: 1814991
description:
Feb  6 05:31:53 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.18.217 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 163.47.172.133
country_id: 1831722
description:
Feb  6 05:31:21 ait sshd[994142]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.47.172.133


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.130.173.74
country_id: 2017370
description:
2025-02-06 05:31:49 dovecot_plain authenticator failed for (l5-130-173-74.novotelecom.ru) [5.130.173.74]:52008: 535 Incorrect authentication data (set_id=agbozume1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.177.40.85
country_id: 1269750
description:
Feb  6 05:32:11 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.177.40.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.40.85
country_id: 1269750
description:
2025-02-06 05:32:13 dovecot_plain authenticator failed for ([103.177.40.85]) [103.177.40.85]:44321: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.21.60.99
country_id: 3865483
description:
[2025-02-06 05:32:14 +0100] info [webmaild] 181.21.60.99 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 05:32:18 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.180.204.7
country_id: 3469034
description:
[2025-02-06 05:32:34 +0100] info [webmaild] 45.180.204.7 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.39.191.14
country_id: 6251999
description:
Feb  6 05:32:12 ait sshd[994507]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.39.191.14 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.39.191.14
country_id: 6251999
description:
Feb  6 05:32:12 ait sshd[994507]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.191.14  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.247.188.11
country_id: 3469034
description:
[2025-02-06 05:32:42 +0100] info [webmaild] 179.247.188.11 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.208.186.206
country_id: 1835841
description:
Feb  6 05:33:06 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.208.186.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.208.186.206
country_id: 1835841
description:
2025-02-06 05:33:08 dovecot_login authenticator failed for ([175.208.186.206]) [175.208.186.206]:42800: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.192.94
country_id: 3469034
description:
Feb  6 05:33:17 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.192.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 05:33:45 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 81.241.179.229
country_id: 2802361
description:
Feb  6 05:33:48 ait sshd[994809]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.241.179.229


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.117.62.191
country_id: 1210997
description:
[2025-02-06 05:33:07 +0100] info [webmaild] 45.117.62.191 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.192.94
country_id: 3469034
description:
2025-02-06 05:33:19 dovecot_login authenticator failed for 186-247-192-94.user.veloxzone.com.br (179-236-122-153.user.veloxzone.com.br) [186.247.192.94]:39976: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.241.179.229
country_id: 2802361
description:
Feb  6 05:33:48 ait sshd[994809]: pam_imunify(sshd:auth): [IM360_RBL] The IP 81.241.179.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.203.183
country_id: 1835841
description:
2025-02-06 05:34:42 dovecot_plain authenticator failed for ([221.149.203.183]) [221.149.203.183]:38472: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.226.104
country_id: 1880251
description:
2025-02-06 05:34:52 dovecot_plain authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:53372: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.219.254
country_id: 1814991
description:
2025-02-06 05:34:22 dovecot_plain authenticator failed for ([124.115.219.254]) [124.115.219.254]:59091: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.226.104
country_id: 1880251
description:
Feb  6 05:34:50 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.226.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.185.204.10
country_id: 6252001
description:
Feb  6 05:34:15 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.185.204.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.185.204.10
country_id: 6252001
description:
2025-02-06 05:34:17 dovecot_plain authenticator failed for syn-107-185-204-010.res.spectrum.com [107.185.204.10]:36339: 535 Incorrect authentication data (set_id=baah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.65.54.204
country_id: 1835841
description:
2025-02-06 05:34:27 dovecot_plain authenticator failed for ([121.65.54.204]) [121.65.54.204]:56656: 535 Incorrect authentication data (set_id=baah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 05:34:39 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-34.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.219.254
country_id: 1814991
description:
Feb  6 05:34:20 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.219.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.65.54.204
country_id: 1835841
description:
Feb  6 05:34:25 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.65.54.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 05:34:43 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.90.213.28
country_id: 6252001
description:
Feb  6 05:35:01 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.90.213.28 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.224.24.1
country_id: 3469034
description:
[2025-02-06 05:35:07 +0100] info [webmaild] 186.224.24.1 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.83.71.207
country_id: 3175395
description:
Feb  6 05:35:16 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.83.71.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.75.30.6
country_id: 1814991
description:
Feb  6 05:35:21 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.75.30.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.92.192.154
country_id: 3469034
description:
Feb  6 05:35:25 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.92.192.154 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.78.83.139
country_id: 3686110
description:
[2025-02-06 05:35:06 +0100] info [webmaild] 181.78.83.139 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.75.30.6
country_id: 1814991
description:
2025-02-06 05:35:23 dovecot_plain authenticator failed for ([218.75.30.6]) [218.75.30.6]:56411: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.177.124.25
country_id: 1210997
description:
[2025-02-06 05:35:41 +0100] info [webmaild] 103.177.124.25 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.20.131
country_id: 1835841
description:
2025-02-06 05:35:18 dovecot_login authenticator failed for ([123.212.20.131]) [123.212.20.131]:33910: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.213.49.15
country_id: 2510769
description:
Feb  6 05:35:53 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.213.49.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.221.101.111
country_id: 3144096
description:
Feb  6 05:35:04 ait sshd[995272]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.221.101.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.221.101.111
country_id: 3144096
description:
Feb  6 05:35:04 ait sshd[995272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.221.101.111


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.180.0
country_id: 1269750
description:
Feb  6 05:35:08 ait sshd[995279]: pam_imunify(sshd:auth): [IM360_RBL] The IP 143.110.180.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 05:35:12 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.165.148.166
country_id: 3469034
description:
Feb  6 05:35:37 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.165.148.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
country_id: 3469034
description:
2025-02-06 05:35:39 dovecot_login authenticator failed for (148166.telemar.net.br) [200.165.148.166]:42154: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.213.49.15
country_id: 2510769
description:
2025-02-06 05:35:55 dovecot_login authenticator failed for 15.49.213.185.dynamic.electronicamartinez.es [185.213.49.15]:51109: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.20.131
country_id: 1835841
description:
Feb  6 05:35:16 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.20.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
country_id: 6252001
description:
2025-02-06 05:35:03 dovecot_login authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:43822: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.92.192.154
country_id: 3469034
description:
2025-02-06 05:35:27 dovecot_login authenticator failed for ([186.200.143.68]) [187.92.192.154]:34001: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.226.66.36
country_id: 3996063
description:
[2025-02-06 05:35:31 +0100] info [webmaild] 177.226.66.36 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.83.71.207
country_id: 3175395
description:
2025-02-06 05:35:18 dovecot_login authenticator failed for ([151.83.71.207]) [151.83.71.207]:55464: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 143.110.180.0
country_id: 1269750
description:
Feb  6 05:35:08 ait sshd[995279]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.110.180.0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.175.12.33
country_id: 1269750
description:
Feb  6 05:36:23 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.175.12.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.73.70.43
country_id: 2661886
description:
Feb  6 05:36:26 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.73.70.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.240.121.228
country_id: 1819730
description:
Feb  6 05:36:31 ait sshd[995968]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.240.121.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.95.67.92
country_id: 6252001
description:
Feb  6 05:36:33 ait sshd[995974]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.95.67.92


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 05:36:56 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.165.251
country_id: 1835841
description:
2025-02-06 05:36:12 dovecot_plain authenticator failed for ([211.178.165.251]) [211.178.165.251]:47269: 535 Incorrect authentication data (set_id=wilfri17@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.194.8
country_id: 1814991
description:
Feb  6 05:36:13 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.194.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.73.70.43
country_id: 2661886
description:
2025-02-06 05:36:28 dovecot_login authenticator failed for 78-73-70-43-no600.tbcn.telia.com [78.73.70.43]:55450: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.178.165.251
country_id: 1835841
description:
Feb  6 05:36:10 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.178.165.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.12.33
country_id: 1269750
description:
2025-02-06 05:36:25 dovecot_plain authenticator failed for ([122.175.12.33]) [122.175.12.33]:33596: 535 Incorrect authentication data (set_id=wilfri17)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.95.67.92
country_id: 6252001
description:
Feb  6 05:36:33 ait sshd[995974]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.95.67.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.194.8
country_id: 1814991
description:
2025-02-06 05:36:15 dovecot_login authenticator failed for ([183.247.194.8]) [183.247.194.8]:51005: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.240.121.228
country_id: 1819730
description:
Feb  6 05:36:31 ait sshd[995968]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.240.121.228  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.16.156.103
country_id: 6252001
description:
2025-02-06 05:37:13 dovecot_plain authenticator failed for (173-16-156-103.client.mchsi.com) [173.16.156.103]:58224: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.14.192.20
country_id: 1835841
description:
2025-02-06 05:37:26 dovecot_plain authenticator failed for ([110.14.192.20]) [110.14.192.20]:36552: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.37.65.15
country_id: 3469034
description:
[2025-02-06 05:37:41 +0100] info [webmaild] 189.37.65.15 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.189.118.24
country_id: 2017370
description:
2025-02-06 05:37:22 dovecot_plain authenticator failed for (5.189.118.24-FTTB.planeta.tc) [5.189.118.24]:39132: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 05:37:33 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
country_id: 1835841
description:
2025-02-06 05:37:16 dovecot_plain authenticator failed for ([121.128.76.108]) [211.196.31.2]:37807: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.218.181.19
country_id: 3625428
description:
2025-02-06 05:37:28 dovecot_plain authenticator failed for ([201.218.181.19]) [201.218.181.19]:52846: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
country_id: 1835841
description:
2025-02-06 05:37:38 dovecot_plain authenticator failed for ([211.105.213.144]) [211.105.213.144]:43912: 535 Incorrect authentication data (set_id=abs18a00023y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.20.145.60
country_id: 298795
description:
[2025-02-06 05:37:42 +0100] info [webmaild] 212.20.145.60 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.131.169.25
country_id: 3469034
description:
[2025-02-06 05:38:08 +0100] info [webmaild] 177.131.169.25 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.24.154.232
country_id: 2510769
description:
Feb  6 05:38:11 ait sshd[996414]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.24.154.232


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-02-06 05:38:51 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:51847: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.239.255.163
country_id: 2017370
description:
2025-02-06 05:38:55 dovecot_plain authenticator failed for (chemally) [77.239.255.163]:53596: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.24.154.232
country_id: 2510769
description:
Feb  6 05:38:11 ait sshd[996414]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.24.154.232 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.236.173.89
country_id: 285570
description:
[2025-02-06 05:38:15 +0100] info [webmaild] 188.236.173.89 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 05:38:35 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
country_id: 1814991
description:
Feb  6 05:39:15 ait sshd[996857]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
country_id: 1814991
description:
Feb  6 05:39:15 ait sshd[996857]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
country_id: 1269750
description:
Feb  6 05:39:01 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
country_id: 1269750
description:
2025-02-06 05:39:03 dovecot_login authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:56210: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.53.58.10
country_id: 1835841
description:
2025-02-06 05:40:39 dovecot_plain authenticator failed for ([211.53.58.10]) [211.53.58.10]:51472: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 05:40:42 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.73.130.43
country_id: 1814991
description:
Feb  6 05:40:41 ait sshd[997534]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.73.130.43 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.73.130.43
country_id: 1814991
description:
Feb  6 05:40:41 ait sshd[997534]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.73.130.43


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.208.101.15
country_id: 298795
description:
[2025-02-06 05:40:42 +0100] info [webmaild] 185.208.101.15 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 05:40:23 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.250.134.35
country_id: 6252001
description:
2025-02-06 05:40:34 dovecot_login authenticator failed for ([130.250.134.35]) [130.250.134.35]:54414: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.175.129.206
country_id: 3469034
description:
[2025-02-06 05:40:37 +0100] info [webmaild] 45.175.129.206 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.163.151.200
country_id: 3469034
description:
[2025-02-06 05:40:08 +0100] info [webmaild] 45.163.151.200 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.104
country_id: 1668284
description:
2025-02-06 05:40:19 dovecot_login authenticator failed for 111-70-49-104.emome-ip.hinet.net [111.70.49.104]:52100: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.182.227.240
country_id: 1835841
description:
2025-02-06 05:40:27 dovecot_plain authenticator failed for ([121.182.227.240]) [121.182.227.240]:55943: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.95.123.220
country_id: 6252001
description:
2025-02-06 05:40:57 dovecot_plain authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:36773: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.42.116.173
country_id: 2750405
description:
Feb  6 05:40:13 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.42.116.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.81.70.80
country_id: 6252001
description:
2025-02-06 05:41:08 dovecot_plain authenticator failed for (50-81-70-80.client.mchsi.com) [50.81.70.80]:52694: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.150.98.189
country_id: 690791
description:
[2025-02-06 05:41:15 +0100] info [webmaild] 46.150.98.189 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.82.12.128
country_id: 6252001
description:
2025-02-06 05:41:19 dovecot_plain authenticator failed for (50-82-12-128.client.mchsi.com) [50.82.12.128]:33380: 535 Incorrect authentication data (set_id=ads20b00288y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2025-02-06 05:41:24 dovecot_login authenticator failed for (dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:34005: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.82
country_id: 1835841
description:
2025-02-06 05:41:41 dovecot_login authenticator failed for ([58.230.236.82]) [58.230.236.82]:44708: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.6.133
country_id: 1835841
description:
2025-02-06 05:41:30 dovecot_plain authenticator failed for ([106.246.6.133]) [106.246.6.133]:39888: 535 Incorrect authentication data (set_id=ads20b00288y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.188.225
country_id: 1861060
description:
2025-02-06 05:43:01 dovecot_login authenticator failed for ([180.7.188.225]) [180.7.188.225]:59626: 535 Incorrect authentication data (set_id=test@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
country_id: 1819730
description:
2025-02-06 05:42:02 dovecot_plain authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:35500: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 05:42:05 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.251.95
country_id: 3469034
description:
2025-02-06 05:42:17 dovecot_plain authenticator failed for ([191.59.251.95]) [191.59.251.95]:57194: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.197.40.58
country_id: 3703430
description:
[2025-02-06 05:42:38 +0100] info [webmaild] 181.197.40.58 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.207
country_id: 1880251
description:
47.128.119.207 - - [06/Feb/2025:05:42:34 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11100963 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=106%2C125%2C205&filter_course-language=79%2C183%2C121&filtering=1&instructor=1%2C2&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.207


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.111.34
country_id: 1814991
description:
2025-02-06 05:42:57 dovecot_login authenticator failed for ([180.168.111.34]) [180.168.111.34]:34434: 535 Incorrect authentication data (set_id=test@lemsas.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-02-06 05:43:11 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:53560: 535 Incorrect authentication data (set_id=test@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.166
country_id: 1819730
description:
2025-02-06 05:43:24 dovecot_plain authenticator failed for 166.46.246.220.static.netvigator.com [220.246.46.166]:50101: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.228.225.91
country_id: 1668284
description:
2025-02-06 05:43:28 dovecot_plain authenticator failed for 125-228-225-91.hinet-ip.hinet.net [125.228.225.91]:40260: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.30.108.247
country_id: 1168579
description:
2025-02-06 05:43:30 dovecot_plain authenticator failed for static-host119-30-108-247.link.net.pk [119.30.108.247]:50762: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.142.27.67
country_id: 2400553
description:
[2025-02-06 05:43:47 +0100] info [webmaild] 102.142.27.67 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.8.117.184
country_id: 3625428
description:
[2025-02-06 05:43:08 +0100] info [webmaild] 200.8.117.184 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.206.136.24
country_id: 1814991
description:
2025-02-06 05:43:13 dovecot_login authenticator failed for ([218.206.136.24]) [218.206.136.24]:59266: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.58.205.132
country_id: 6252001
description:
2025-02-06 05:43:15 dovecot_plain authenticator failed for (64-58-205-132-yelcot.com) [64.58.205.132]:40225: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
country_id: 1269750
description:
2025-02-06 05:43:47 dovecot_plain authenticator failed for (nsg-corporate-194.153.186.122.airtel.in) [106.51.220.33]:28148: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.51.221.195
country_id: 3625428
description:
[2025-02-06 05:43:14 +0100] info [webmaild] 38.51.221.195 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-02-06 05:43:19 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:33284: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.52.202.92
country_id: 1814991
description:
2025-02-06 05:43:44 dovecot_plain authenticator failed for ([123.52.202.92]) [123.52.202.92]:58086: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.171.137.226
country_id: 1814991
description:
2025-02-06 05:44:35 dovecot_plain authenticator failed for ([60.171.137.226]) [60.171.137.226]:34577: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.113.74.46
country_id: 2635167
description:
Feb  6 05:44:55 ait sshd[998699]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.113.74.46  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 194.44.41.130
country_id: 690791
description:
[2025-02-06 05:45:01 +0100] info [webmaild] 194.44.41.130 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.124.143.165
country_id: 2017370
description:
2025-02-06 05:44:06 dovecot_login authenticator failed for ([92.124.143.165]) [92.124.143.165]:36496: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.232.72.247
country_id: 2661886
description:
2025-02-06 05:44:18 dovecot_plain authenticator failed for 81-232-72-247-no600.tbcn.telia.com [81.232.72.247]:47120: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.69.76.148
country_id: 1814991
description:
2025-02-06 05:44:18 dovecot_login authenticator failed for ([125.69.76.148]) [125.69.76.148]:50838: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.113.74.46
country_id: 2635167
description:
Feb  6 05:44:55 ait sshd[998699]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.113.74.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.251.202.80
country_id: 1835841
description:
Feb  6 05:45:36 ait sshd[999034]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.251.202.80 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.204.12.84
country_id: 3932488
description:
[2025-02-06 05:45:32 +0100] info [webmaild] 138.204.12.84 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.251.202.80
country_id: 1835841
description:
Feb  6 05:45:36 ait sshd[999034]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.251.202.80


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.51.154.154
country_id: 3469034
description:
[2025-02-06 05:45:45 +0100] info [webmaild] 179.51.154.154 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.231.102.189
country_id: 6252001
description:
2025-02-06 05:45:53 dovecot_login authenticator failed for ([73.231.102.189]) [73.231.102.189]:58224: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 05:45:25 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.137.159
country_id: 1269750
description:
Feb  6 05:45:57 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.137.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.137.159
country_id: 1269750
description:
2025-02-06 05:45:59 dovecot_login authenticator failed for ([103.109.44.163]) [122.165.137.159]:52180: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.139.35.161
country_id: 6252001
description:
Feb  6 05:46:00 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.139.35.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
country_id: 1835841
description:
2025-02-06 05:46:06 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:40114: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.178.132
country_id: 3175395
description:
2025-02-06 05:46:08 dovecot_plain authenticator failed for (132-178-53-194.mairnet.net) [194.53.178.132]:58421: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.151
country_id: 2017370
description:
Feb  6 05:46:16 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.171.12.124
country_id: 3469034
description:
[2025-02-06 05:46:19 +0100] info [webmaild] 45.171.12.124 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.151
country_id: 2017370
description:
2025-02-06 05:46:18 dovecot_plain authenticator failed for ([178.178.194.151]) [178.178.194.151]:59446: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.127.67.83
country_id: 2077456
description:
Feb  6 05:46:05 ait sshd[999175]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.67.83  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.51.0.170
country_id: 3585968
description:
Feb  6 05:46:17 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.51.0.170 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 80.94.95.157
country_id: 798549
domain: www.lms.aitsmartschool.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/aitsmart02/public_html/wp-admin/images/index.php


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.218
country_id: 1819730
description:
2025-02-06 05:46:28 dovecot_login authenticator failed for ([121.202.200.218]) [121.202.200.218]:9792: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.41.18
country_id: 290557
description:
Feb  6 05:46:09 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.41.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.41.18
country_id: 290557
description:
2025-02-06 05:46:11 dovecot_login authenticator failed for ([94.206.41.18]) [94.206.41.18]:44381: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.146
country_id: 732800
description:
Feb  6 05:46:29 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.146 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 05:46:02 ait sshd[999153]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
country_id: 1835841
description:
Feb  6 05:46:04 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.127.67.83
country_id: 2077456
description:
Feb  6 05:46:05 ait sshd[999175]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.127.67.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.218
country_id: 1819730
description:
Feb  6 05:46:26 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 80.94.95.157
country_id: 798549
domain: www.lms.aitsmartschool.com
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:05-46.80.94.95.157||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.50.120.215
country_id: 1814991
description:
Feb  6 05:46:58 ait sshd[999546]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.50.120.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.50.120.215
country_id: 1814991
description:
Feb  6 05:46:58 ait sshd[999546]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.120.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.139.35.161
country_id: 6252001
description:
2025-02-06 05:46:02 dovecot_login authenticator failed for 161.sm-u1.dialup.garlic.net [216.139.35.161]:57130: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.0.170
country_id: 3585968
description:
2025-02-06 05:46:19 dovecot_plain authenticator failed for ([179.51.0.170]) [179.51.0.170]:53981: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.178.132
country_id: 3175395
description:
Feb  6 05:46:06 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.178.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.167.21.148
country_id: 1835841
description:
Feb  6 05:46:03 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.167.21.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.170.230.238
country_id: 1814991
description:
Feb  6 05:46:10 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.170.230.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 05:46:02 ait sshd[999153]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.21.148
country_id: 1835841
description:
2025-02-06 05:46:05 dovecot_login authenticator failed for ([221.167.21.148]) [221.167.21.148]:53590: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.170.230.238
country_id: 1814991
description:
2025-02-06 05:46:12 dovecot_login authenticator failed for ([222.170.230.238]) [222.170.230.238]:47542: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.146
country_id: 732800
description:
2025-02-06 05:46:31 dovecot_login authenticator failed for ([185.255.212.146]) [185.255.212.146]:61460: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.131.163.41
country_id: 6252001
description:
Feb  6 05:47:04 ait sshd[999588]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.131.163.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.227.203
country_id: 1562822
description:
Feb  6 05:47:10 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.227.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  6 05:47:20 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.90.239.158
country_id: 1835841
description:
Feb  6 05:48:00 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.90.239.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.113.66.20
country_id: 2635167
description:
Feb  6 05:47:41 ait sshd[999796]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.113.66.20 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.113.66.20
country_id: 2635167
description:
Feb  6 05:47:41 ait sshd[999796]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.113.66.20


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.131.84.38
country_id: 1814991
description:
Feb  6 05:47:44 ait sshd[999800]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.131.84.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.63
country_id: 1819730
description:
2025-02-06 05:47:44 dovecot_plain authenticator failed for (m121-202-201-63.smartone.com) [121.202.201.63]:33701: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.86.134.216
country_id: 6252001
description:
Feb  6 05:47:24 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.86.134.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.86.134.216
country_id: 6252001
description:
2025-02-06 05:47:26 dovecot_login authenticator failed for syn-097-086-134-216.res.spectrum.com [97.86.134.216]:4221: 535 Incorrect authentication data (set_id=21m1150009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.63
country_id: 1819730
description:
Feb  6 05:47:42 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.71.109
country_id: 1835841
description:
2025-02-06 05:47:56 dovecot_plain authenticator failed for ([112.168.71.109]) [112.168.71.109]:54778: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.227.203
country_id: 1562822
description:
2025-02-06 05:47:12 dovecot_plain authenticator failed for ([118.70.227.203]) [118.70.227.203]:48381: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
country_id: 6252001
description:
2025-02-06 05:47:28 dovecot_plain authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:56410: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.131.84.38
country_id: 1814991
description:
Feb  6 05:47:44 ait sshd[999800]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.131.84.38


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.168.71.109
country_id: 1835841
description:
Feb  6 05:47:54 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.168.71.109 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.131.163.41
country_id: 6252001
description:
Feb  6 05:47:04 ait sshd[999588]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.163.41  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.102.66.226
country_id: 6251999
description:
Feb  6 05:47:12 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.102.66.226 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.226.247.85
country_id: 3469034
description:
[2025-02-06 05:47:29 +0100] info [webmaild] 186.226.247.85 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.86.88.196
country_id: 2921044
description:
Feb  6 05:47:14 ait sshd[999605]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.86.88.196


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.86.88.196
country_id: 2921044
description:
Feb  6 05:47:14 ait sshd[999605]: pam_imunify(sshd:auth): [IM360_RBL] The IP 167.86.88.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
country_id: 1522867
description:
2025-02-06 05:47:15 dovecot_plain authenticator failed for (squatili) [109.166.70.166]:57817: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.121.199.203
country_id: 6252001
description:
Feb  6 05:47:26 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.121.199.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.176.231
country_id: 1814991
description:
Feb  6 05:47:43 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.176.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
country_id: 1522867
description:
Feb  6 05:47:13 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.102.66.226
country_id: 6251999
description:
2025-02-06 05:47:14 dovecot_login authenticator failed for ([207.102.66.226]) [207.102.66.226]:58703: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-06 05:47:22 dovecot_login authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-173.static.tpgi.com.au) [110.175.220.250]:53130: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.176.231
country_id: 1814991
description:
2025-02-06 05:47:45 dovecot_login authenticator failed for ([61.184.176.231]) [61.184.176.231]:31997: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.113
country_id: 1269750
description:
2025-02-06 05:48:31 dovecot_plain authenticator failed for ([103.190.91.113]) [103.190.91.113]:48646: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.62.34.216
country_id: 6252001
description:
Feb  6 05:48:58 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.62.34.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.252.222.82
country_id: 1814991
description:
Feb  6 05:49:00 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.252.222.82 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.55.20.36
country_id: 3686110
description:
[2025-02-06 05:48:22 +0100] info [webmaild] 181.55.20.36 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.113
country_id: 1269750
description:
Feb  6 05:48:29 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.176.170.160
country_id: 2510769
description:
Feb  6 05:48:29 ait sshd[1000032]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.176.170.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.99.64
country_id: 1880251
description:
Feb  6 05:48:11 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.99.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.1.40.151
country_id: 6251999
description:
Feb  6 05:48:18 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.1.40.151 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.176.170.160
country_id: 2510769
description:
Feb  6 05:48:29 ait sshd[1000032]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.176.170.160


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.249.93
country_id: 6252001
description:
2025-02-06 05:48:59 dovecot_plain authenticator failed for ([96.79.249.93]) [96.79.249.93]:60363: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.103.228
country_id: 1269750
description:
2025-02-06 05:49:00 dovecot_plain authenticator failed for (abts-north-static-228.103.160.122.airtelbroadband.in) [122.160.103.228]:41752: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-02-06 05:49:00 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:40662: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.90.239.158
country_id: 1835841
description:
2025-02-06 05:48:02 dovecot_plain authenticator failed for (mail.salee.co.kr) [220.90.239.158]:30033: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.52.40.58
country_id: 2017370
description:
[2025-02-06 05:48:27 +0100] info [webmaild] 176.52.40.58 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.130.72.105
country_id: 2017370
description:
[2025-02-06 05:48:54 +0100] info [webmaild] 31.130.72.105 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.249.93
country_id: 6252001
description:
Feb  6 05:48:57 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.249.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.103.228
country_id: 1269750
description:
Feb  6 05:48:58 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.103.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.99.64
country_id: 1880251
description:
2025-02-06 05:48:13 dovecot_plain authenticator failed for ([116.86.99.64]) [116.86.99.64]:58084: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2025-02-06 05:48:20 dovecot_plain authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:59349: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.255.45
country_id: 1210997
description:
Feb  6 05:49:10 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.255.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.227.30.210
country_id: 1814991
description:
Feb  6 05:49:23 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.227.30.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.227.30.210
country_id: 1814991
description:
2025-02-06 05:49:25 dovecot_plain authenticator failed for ([112.227.30.210]) [112.227.30.210]:51929: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.59.228.24
country_id: 3017382
description:
Feb  6 05:49:40 ait sshd[1000470]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.228.24


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.22.37.184
country_id: 3144096
description:
Feb  6 05:49:09 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.22.37.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.201.37.210
country_id: 6252001
description:
Feb  6 05:49:11 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.201.37.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.25.205
country_id: 1668284
description:
2025-02-06 05:49:11 dovecot_plain authenticator failed for 111-70-25-205.emome-ip.hinet.net [111.70.25.205]:37403: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.255.45
country_id: 1210997
description:
2025-02-06 05:49:12 dovecot_plain authenticator failed for (27-123-255-45-mcnbd.com) [27.123.255.45]:39132: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.116
country_id: 1269750
description:
Feb  6 05:49:14 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.44
country_id: 1269750
description:
Feb  6 05:49:15 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.116
country_id: 1269750
description:
2025-02-06 05:49:16 dovecot_plain authenticator failed for ([103.190.91.116]) [103.190.91.116]:37754: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-02-06 05:49:17 dovecot_plain authenticator failed for ([103.147.248.44]) [103.147.248.44]:54566: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.252.222.82
country_id: 1814991
description:
2025-02-06 05:49:02 dovecot_plain authenticator failed for ([58.252.222.82]) [58.252.222.82]:43608: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.62.78.180
country_id: 3469034
description:
[2025-02-06 05:49:54 +0100] info [webmaild] 187.62.78.180 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.59.228.24
country_id: 3017382
description:
Feb  6 05:49:40 ait sshd[1000470]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.59.228.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.164.194
country_id: 1814991
description:
2025-02-06 05:49:04 dovecot_plain authenticator failed for ([122.224.164.194]) [122.224.164.194]:50875: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.201.37.210
country_id: 6252001
description:
2025-02-06 05:49:13 dovecot_plain authenticator failed for ([50.201.37.210]) [50.201.37.210]:54847: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-49.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.224.164.194
country_id: 1814991
description:
Feb  6 05:49:02 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.224.164.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.22.37.184
country_id: 3144096
description:
2025-02-06 05:49:11 dovecot_plain authenticator failed for ([217.22.37.184]) [217.22.37.184]:41185: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.25.205
country_id: 1668284
description:
Feb  6 05:49:09 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.25.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.134.35
country_id: 298795
description:
2025-02-06 05:50:05 dovecot_plain authenticator failed for (prestus) [78.186.134.35]:33259: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.13.243.101
country_id: 2264397
description:
Feb  6 05:50:23 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.13.243.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.115.19.225
country_id: 6252001
description:
Feb  6 05:50:24 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.115.19.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.175.8.140
country_id: 1835841
description:
Feb  6 05:50:45 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.175.8.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.207.252.124
country_id: 2017370
description:
Feb  6 05:50:38 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.207.252.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.201.140.227
country_id: 1831722
description:
2025-02-06 05:50:46 dovecot_plain authenticator failed for ([45.201.140.227]) [45.201.140.227]:37336: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.238.200
country_id: 298795
description:
Feb  6 05:50:22 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.238.200 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.71.42
country_id: 1512440
description:
[2025-02-06 05:50:25 +0100] info [webmaild] 84.54.71.42 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.146.148.173
country_id: 6252001
description:
Feb  6 05:50:27 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.146.148.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.84.11.180
country_id: 1861060
description:
Feb  6 05:50:27 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.84.11.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-02-06 05:50:29 dovecot_plain authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:48058: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.128.202
country_id: 6252001
description:
Feb  6 05:50:30 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.128.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.231.251
country_id: 6252001
description:
2025-02-06 05:50:39 dovecot_plain authenticator failed for ([47.149.231.251]) [47.149.231.251]:53576: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.53.126.112
country_id: 1835841
description:
Feb  6 05:50:41 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.53.126.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.215.204.109
country_id: 3469034
description:
Feb  6 05:50:26 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.215.204.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
country_id: 1835841
description:
2025-02-06 05:50:28 dovecot_plain authenticator failed for ([222.114.200.160]) [222.114.200.160]:34406: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
country_id: 1835841
description:
2025-02-06 05:50:28 dovecot_plain authenticator failed for ([115.22.247.178]) [115.22.247.178]:50037: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.20.197
country_id: 6252001
description:
Feb  6 05:50:31 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.20.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.220.168.116
country_id: 2017370
description:
2025-02-06 05:50:32 dovecot_plain authenticator failed for ([31.220.168.116]) [31.220.168.116]:51549: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.221.174
country_id: 1269750
description:
2025-02-06 05:50:36 dovecot_plain authenticator failed for ([103.186.221.174]) [103.186.221.174]:58584: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.143.166
country_id: 1819730
description:
Feb  6 05:50:48 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.143.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
country_id: 1694008
description:
2025-02-06 05:51:00 dovecot_plain authenticator failed for ([203.177.65.26]) [58.69.17.18]:39322: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.244.246.221
country_id: 1835841
description:
2025-02-06 05:50:28 dovecot_plain authenticator failed for ([1.244.246.221]) [1.244.246.221]:59970: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.227.87.29
country_id: 1814991
description:
Feb  6 05:50:44 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.227.87.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.227.200.201
country_id: 1562822
description:
Feb  6 05:50:47 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.227.200.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.96.11.230
country_id: 2510769
description:
Feb  6 05:50:51 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.96.11.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.27.32.70
country_id: 6252001
description:
Feb  6 05:50:55 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.27.32.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
country_id: 1694008
description:
Feb  6 05:50:58 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.82.66.194
country_id: 1814991
description:
Feb  6 05:50:42 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.82.66.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
country_id: 99237
description:
Feb  6 05:50:43 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.68.208
country_id: 1835841
description:
Feb  6 05:50:25 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.125.68.208 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.57.217.38
country_id: 1643084
description:
Feb  6 05:50:25 ait sshd[1000762]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.57.217.38


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.154.222
country_id: 1814991
description:
Feb  6 05:50:35 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.154.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.47
country_id: 1835841
description:
2025-02-06 05:50:34 dovecot_plain authenticator failed for ([121.154.90.47]) [121.154.90.47]:56768: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.17.90.246
country_id: 6252001
description:
2025-02-06 05:50:36 dovecot_plain authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:56090: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.95.114.242
country_id: 3469034
description:
Feb  6 05:50:40 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.95.114.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.84.5.183
country_id: 2077456
description:
2025-02-06 05:50:45 dovecot_plain authenticator failed for (210-84-5-183.tpgi.com.au) [210.84.5.183]:50610: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.183.11.30
country_id: 1643084
description:
2025-02-06 05:50:56 dovecot_plain authenticator failed for ([103.183.11.30]) [103.183.11.30]:36602: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
country_id: 1835841
description:
Feb  6 05:50:56 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.188.149.243
country_id: 3923057
description:
Feb  6 05:50:45 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.188.149.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.122.202
country_id: 294640
description:
Feb  6 05:50:24 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.122.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.196.64.203
country_id: 1814991
description:
2025-02-06 05:50:42 dovecot_plain authenticator failed for ([120.196.64.203]) [120.196.64.203]:51756: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.218.181.19
country_id: 3625428
description:
2025-02-06 05:50:26 dovecot_plain authenticator failed for ([201.218.181.19]) [201.218.181.19]:48308: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.192.131
country_id: 1835841
description:
Feb  6 05:50:34 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.192.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-02-06 05:50:40 dovecot_plain authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:54196: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.8.106
country_id: 1814991
description:
Feb  6 05:50:50 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.8.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.88.121.73
country_id: 1835841
description:
Feb  6 05:50:53 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.88.121.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.99.15.104
country_id: 1269750
description:
Feb  6 05:50:26 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.99.15.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.146.121.12
country_id: 1814991
description:
Feb  6 05:50:28 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.146.121.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.95.150.16
country_id: 6252001
description:
2025-02-06 05:50:36 dovecot_plain authenticator failed for syn-070-095-150-016.res.spectrum.com [70.95.150.16]:65407: 535 Incorrect authentication data (set_id=ads19b00191y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.201.140.227
country_id: 1831722
description:
Feb  6 05:50:44 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.201.140.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.184
country_id: 1668284
description:
2025-02-06 05:50:45 dovecot_plain authenticator failed for 111-70-49-184.emome-ip.hinet.net [111.70.49.184]:59073: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2025-02-06 05:50:58 dovecot_plain authenticator failed for ([218.149.235.152]) [218.149.235.152]:36376: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.156.85
country_id: 1269750
description:
Feb  6 05:50:31 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.156.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.156.85
country_id: 1269750
description:
2025-02-06 05:50:33 dovecot_plain authenticator failed for (abts-north-static-085.156.160.122.airtelbroadband.in) [122.160.156.85]:47264: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.125.68.208
country_id: 1835841
description:
2025-02-06 05:50:27 dovecot_plain authenticator failed for ([175.125.68.208]) [175.125.68.208]:39443: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.189.232
country_id: 2017370
description:
Feb  6 05:50:28 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.189.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2025-02-06 05:50:36 dovecot_plain authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:54263: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.107.173.49
country_id: 1668284
description:
2025-02-06 05:50:39 dovecot_plain authenticator failed for (106.107.173.49.adsl.dynamic.seed.net.tw) [106.107.173.49]:3000: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.184
country_id: 1668284
description:
Feb  6 05:50:43 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.3.72
country_id: 1668284
description:
2025-02-06 05:50:43 dovecot_plain authenticator failed for ([101.13.3.72]) [101.13.3.72]:35698: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-02-06 05:50:45 dovecot_plain authenticator failed for ([65.20.205.197]) [65.20.205.197]:55468: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.163.164
country_id: 1814991
description:
2025-02-06 05:50:57 dovecot_plain authenticator failed for ([61.145.163.164]) [61.145.163.164]:41738: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.3.72
country_id: 1668284
description:
Feb  6 05:50:41 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.3.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
country_id: 3469034
description:
2025-02-06 05:50:40 dovecot_plain authenticator failed for (187-50-84-19.customer.tdatabrasil.net.br) [177.43.106.73]:45674: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.11.25.195
country_id: 6252001
description:
2025-02-06 05:50:25 dovecot_plain authenticator failed for ([66.11.25.195]) [66.11.25.195]:51392: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.123
country_id: 1036973
description:
2025-02-06 05:50:27 dovecot_plain authenticator failed for ([196.28.226.123]) [196.28.226.123]:35805: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.3.18.38
country_id: 1269750
description:
Feb  6 05:50:30 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.3.18.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.22.154
country_id: 1668284
description:
Feb  6 05:50:33 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.22.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.136.164.157
country_id: 6252001
description:
Feb  6 05:50:34 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.136.164.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.102.148.242
country_id: 6252001
description:
Feb  6 05:50:38 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.102.148.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.171.150
country_id: 1814991
description:
2025-02-06 05:50:40 dovecot_plain authenticator failed for ([221.0.171.150]) [221.0.171.150]:45300: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.90.43
country_id: 1814991
description:
2025-02-06 05:50:41 dovecot_plain authenticator failed for ([39.174.90.48]) [39.174.90.43]:54834: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.116.95.48
country_id: 1880251
description:
Feb  6 05:50:49 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.116.95.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.194.38.121
country_id: 3175395
description:
2025-02-06 05:50:40 dovecot_plain authenticator failed for ([2.194.38.121]) [2.194.38.121]:45384: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
country_id: 1814991
description:
Feb  6 05:50:42 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
country_id: 3175395
description:
2025-02-06 05:50:50 dovecot_plain authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:48844: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2025-02-06 05:50:55 dovecot_plain authenticator failed for 42-200-60-186.static.imsbiz.com [42.200.60.186]:65195: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-02-06 05:50:57 dovecot_plain authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:45896: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.29.135.230
country_id: 6252001
description:
2025-02-06 05:50:59 dovecot_plain authenticator failed for 50.29.135.230.res-cmts.mtp2.ptd.net [50.29.135.230]:51286: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.219.154.156
country_id: 2750405
description:
Feb  6 05:50:22 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.219.154.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.84.11.180
country_id: 1861060
description:
2025-02-06 05:50:29 dovecot_plain authenticator failed for ([59.84.11.180]) [59.84.11.180]:29594: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.107.173.49
country_id: 1668284
description:
Feb  6 05:50:37 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.107.173.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.227
country_id: 1819730
description:
Feb  6 05:50:40 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.129.154
country_id: 2413451
description:
2025-02-06 05:50:46 dovecot_plain authenticator failed for ([197.231.129.154]) [197.231.129.154]:43869: 535 Incorrect authentication data (set_id=ads19b00191y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.152.28
country_id: 3469034
description:
Feb  6 05:50:53 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.152.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.95.150.16
country_id: 6252001
description:
Feb  6 05:50:34 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.95.150.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.231.129.154
country_id: 2413451
description:
Feb  6 05:50:44 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.231.129.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.81.14.113
country_id: 3469034
description:
Feb  6 05:50:47 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.81.14.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.227.87.29
country_id: 1814991
description:
2025-02-06 05:50:46 dovecot_plain authenticator failed for ([106.227.87.29]) [106.227.87.29]:34718: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.149.243
country_id: 3923057
description:
2025-02-06 05:50:47 dovecot_plain authenticator failed for (scz-181-188-149-00243.tigo.bo) [181.188.149.243]:42715: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.183.11.30
country_id: 1643084
description:
Feb  6 05:50:54 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.183.11.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.123
country_id: 1036973
description:
Feb  6 05:50:25 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.82
country_id: 1269750
description:
2025-02-06 05:50:25 dovecot_plain authenticator failed for (nsg-corporate-82.227.187.122.airtel.in) [122.187.227.82]:48706: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.10.46
country_id: 1814991
description:
2025-02-06 05:50:37 dovecot_plain authenticator failed for ([120.197.10.46]) [120.197.10.46]:48834: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.8.106
country_id: 1814991
description:
2025-02-06 05:50:52 dovecot_plain authenticator failed for ([58.16.8.106]) [58.16.8.106]:59819: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
country_id: 2658434
description:
2025-02-06 05:50:23 dovecot_plain authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:42545: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.238.200
country_id: 298795
description:
2025-02-06 05:50:24 dovecot_plain authenticator failed for ([5.11.238.200]) [5.11.238.200]:59480: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
country_id: 1835841
description:
Feb  6 05:50:26 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.10.46
country_id: 1814991
description:
Feb  6 05:50:35 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.10.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.49.250
country_id: 1814991
description:
2025-02-06 05:50:37 dovecot_plain authenticator failed for ([58.16.49.250]) [58.16.49.250]:50684: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.114.242
country_id: 3469034
description:
2025-02-06 05:50:42 dovecot_plain authenticator failed for (242.114.95.187.static.liggatelecom.com.br) [187.95.114.242]:6356: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.57.217.38
country_id: 1643084
description:
Feb  6 05:50:25 ait sshd[1000762]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.57.217.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.146.148.173
country_id: 6252001
description:
2025-02-06 05:50:29 dovecot_plain authenticator failed for ([129.146.148.173]) [129.146.148.173]:52580: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.146.121.12
country_id: 1814991
description:
2025-02-06 05:50:30 dovecot_plain authenticator failed for ([61.146.121.12]) [61.146.121.12]:40189: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
country_id: 1210997
description:
2025-02-06 05:50:33 dovecot_plain authenticator failed for ([103.103.35.130]) [103.103.35.130]:38858: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-02-06 05:50:42 dovecot_plain authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:53433: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
country_id: 1814991
description:
2025-02-06 05:50:44 dovecot_plain authenticator failed for ([111.50.70.34]) [111.50.70.34]:34347: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-02-06 05:50:26 dovecot_plain authenticator failed for (31-154-122-202.orange.net.il) [2.55.122.202]:39530: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.204.109
country_id: 3469034
description:
2025-02-06 05:50:28 dovecot_plain authenticator failed for (ucicinemas.static.gvt.net.br) [186.215.204.109]:43398: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.189.232
country_id: 2017370
description:
2025-02-06 05:50:30 dovecot_plain authenticator failed for (host-232.185.15.189.0.0xffffff00.STERLING.stercom.ru) [185.15.189.232]:57138: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.186.221.174
country_id: 1269750
description:
Feb  6 05:50:34 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.186.221.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.90.43
country_id: 1814991
description:
Feb  6 05:50:39 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.90.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
country_id: 1819730
description:
2025-02-06 05:50:50 dovecot_plain authenticator failed for 166.143.48.116.static.netvigator.com [116.48.143.166]:59008: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.154.222
country_id: 1814991
description:
2025-02-06 05:50:37 dovecot_plain authenticator failed for ([39.165.154.222]) [39.165.154.222]:57034: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
country_id: 3469034
description:
Feb  6 05:50:38 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.207.252.124
country_id: 2017370
description:
2025-02-06 05:50:40 dovecot_plain authenticator failed for (pool-31-207-252-124.is74.ru) [31.207.252.124]:48318: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.227.200.201
country_id: 1562822
description:
2025-02-06 05:50:49 dovecot_plain authenticator failed for ([171.227.200.201]) [171.227.200.201]:32395: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.98.215.147
country_id: 1835841
description:
Feb  6 05:50:56 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.98.215.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
country_id: 1835841
description:
Feb  6 05:50:26 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.212.219
country_id: 3175395
description:
Feb  6 05:50:48 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.212.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.96.11.230
country_id: 2510769
description:
2025-02-06 05:50:53 dovecot_plain authenticator failed for 230.red-213-96-11.staticip.rima-tde.net [213.96.11.230]:41640: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.28
country_id: 3469034
description:
2025-02-06 05:50:55 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.152.28]:59682: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.29.135.230
country_id: 6252001
description:
Feb  6 05:50:57 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.29.135.230 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.164.35.244
country_id: 3469034
description:
[2025-02-06 05:50:57 +0100] info [webmaild] 45.164.35.244 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.145.163.164
country_id: 1814991
description:
Feb  6 05:50:55 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.145.163.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
country_id: 2750405
description:
2025-02-06 05:50:24 dovecot_plain authenticator failed for ([103.219.154.156]) [103.219.154.156]:42952: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.171.150
country_id: 1814991
description:
Feb  6 05:50:38 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.171.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.84.5.183
country_id: 2077456
description:
Feb  6 05:50:43 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.84.5.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.171.64.170
country_id: 6252001
description:
Feb  6 05:50:56 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.171.64.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.154.90.47
country_id: 1835841
description:
Feb  6 05:50:32 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.154.90.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-02-06 05:50:32 dovecot_plain authenticator failed for ([192.34.128.202]) [192.34.128.202]:53068: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.175.8.140
country_id: 1835841
description:
2025-02-06 05:50:47 dovecot_plain authenticator failed for ([121.175.8.140]) [121.175.8.140]:49092: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.58.130.22
country_id: 1814991
description:
2025-02-06 05:50:52 dovecot_plain authenticator failed for ([58.58.130.22]) [58.58.130.22]:5441: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.218.181.19
country_id: 3625428
description:
Feb  6 05:50:24 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.218.181.19 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
country_id: 6252001
description:
Feb  6 05:50:27 ait sshd[1000771]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.160.45.26
country_id: 1814991
description:
Feb  6 05:50:29 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.160.45.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.154
country_id: 1668284
description:
2025-02-06 05:50:35 dovecot_plain authenticator failed for 111-70-22-154.emome-ip.hinet.net [111.70.22.154]:38618: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.194.38.121
country_id: 3175395
description:
Feb  6 05:50:38 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.194.38.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
country_id: 1880251
description:
Feb  6 05:50:43 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.17.90.246
country_id: 6252001
description:
Feb  6 05:50:34 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.17.90.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.131
country_id: 1835841
description:
2025-02-06 05:50:36 dovecot_plain authenticator failed for ([1.235.192.131]) [1.235.192.131]:35750: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.64.170
country_id: 6252001
description:
2025-02-06 05:50:58 dovecot_plain authenticator failed for ([50.171.64.170]) [50.171.64.170]:46238: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.13.243.101
country_id: 2264397
description:
2025-02-06 05:50:25 dovecot_plain authenticator failed for bl3-243-101.dsl.telepac.pt [213.13.243.101]:2307: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.3.18.38
country_id: 1269750
description:
2025-02-06 05:50:32 dovecot_plain authenticator failed for ([61.3.18.38]) [61.3.18.38]:36210: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.231.251
country_id: 6252001
description:
Feb  6 05:50:37 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.231.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.186.134.35
country_id: 298795
description:
Feb  6 05:50:03 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.186.134.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.4.81.206
country_id: 2658434
description:
Feb  6 05:50:21 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.4.81.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.82
country_id: 1269750
description:
Feb  6 05:50:23 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
country_id: 1831722
description:
Feb  6 05:50:27 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
country_id: 6252001
description:
Feb  6 05:50:27 ait sshd[1000771]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
country_id: 1210997
description:
Feb  6 05:50:31 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.81.14.113
country_id: 3469034
description:
2025-02-06 05:50:49 dovecot_plain authenticator failed for ([170.81.14.113]) [170.81.14.113]:41810: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.244.246.221
country_id: 1835841
description:
Feb  6 05:50:26 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.244.246.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.99.15.104
country_id: 1269750
description:
2025-02-06 05:50:28 dovecot_plain authenticator failed for ([103.99.15.104]) [103.99.15.104]:47816: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.82.66.194
country_id: 1814991
description:
2025-02-06 05:50:44 dovecot_plain authenticator failed for ([120.82.66.194]) [120.82.66.194]:43910: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
country_id: 1880251
description:
2025-02-06 05:50:45 dovecot_plain authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:37698: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.58.130.22
country_id: 1814991
description:
Feb  6 05:50:50 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.58.130.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.88.121.73
country_id: 1835841
description:
2025-02-06 05:50:55 dovecot_plain authenticator failed for ([115.88.121.73]) [115.88.121.73]:52215: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.11.25.195
country_id: 6252001
description:
Feb  6 05:50:23 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.11.25.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.220.168.116
country_id: 2017370
description:
Feb  6 05:50:30 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.220.168.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.160.45.26
country_id: 1814991
description:
2025-02-06 05:50:31 dovecot_plain authenticator failed for ([124.160.45.26]) [124.160.45.26]:46190: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.53.126.112
country_id: 1835841
description:
2025-02-06 05:50:43 dovecot_plain authenticator failed for ([14.53.126.112]) [14.53.126.112]:53880: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.215.147
country_id: 1835841
description:
2025-02-06 05:50:58 dovecot_plain authenticator failed for ([183.98.215.147]) [183.98.215.147]:6071: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.115.19.225
country_id: 6252001
description:
2025-02-06 05:50:26 dovecot_plain authenticator failed for 24.115.19.225.res-cmts.sm3.ptd.net [24.115.19.225]:39510: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.20.197
country_id: 6252001
description:
2025-02-06 05:50:33 dovecot_plain authenticator failed for ([65.76.20.197]) [65.76.20.197]:48804: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.49.250
country_id: 1814991
description:
Feb  6 05:50:35 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.196.64.203
country_id: 1814991
description:
Feb  6 05:50:40 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.196.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.116.95.48
country_id: 1880251
description:
2025-02-06 05:50:51 dovecot_plain authenticator failed for ([203.116.95.48]) [203.116.95.48]:41290: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.60.186
country_id: 1819730
description:
Feb  6 05:50:53 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.60.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.148.187.146
country_id: 3686110
description:
2025-02-06 05:51:07 dovecot_plain authenticator failed for (azteca-comunicaciones.com) [186.148.187.146]:53371: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.32.250.174
country_id: 1814991
description:
2025-02-06 05:51:07 dovecot_plain authenticator failed for ([117.32.250.174]) [117.32.250.174]:54446: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.232.39.165
country_id: 2510769
description:
Feb  6 05:51:14 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.232.39.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.239.1.134
country_id: 226074
description:
Feb  6 05:51:04 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.239.1.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2025-02-06 05:51:06 dovecot_plain authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:46646: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.232.39.165
country_id: 2510769
description:
2025-02-06 05:51:16 dovecot_plain authenticator failed for ([185.232.39.165]) [185.232.39.165]:55026: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.192.94
country_id: 3469034
description:
Feb  6 05:51:21 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.192.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.207.53
country_id: 1668284
description:
2025-02-06 05:51:22 dovecot_plain authenticator failed for 60-249-207-53.hinet-ip.hinet.net [60.249.207.53]:39874: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.192.94
country_id: 3469034
description:
2025-02-06 05:51:23 dovecot_plain authenticator failed for 186-247-192-94.user.veloxzone.com.br [186.247.192.94]:53179: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.144.1.251
country_id: 3996063
description:
[2025-02-06 05:51:30 +0100] info [webmaild] 187.144.1.251 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.118.234
country_id: 1880251
description:
Feb  6 05:51:04 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.199.118.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.148.187.146
country_id: 3686110
description:
Feb  6 05:51:05 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.148.187.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.186.221.174
country_id: 1269750
description:
Feb  6 05:51:06 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.186.221.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.160.119.116
country_id: 1814991
description:
2025-02-06 05:51:06 dovecot_plain authenticator failed for ([61.160.119.116]) [61.160.119.116]:23920: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.221.174
country_id: 1269750
description:
2025-02-06 05:51:08 dovecot_plain authenticator failed for ([103.186.221.174]) [103.186.221.174]:59194: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
country_id: 614540
description:
2025-02-06 05:51:09 dovecot_plain authenticator failed for ([2.57.219.14]) [2.57.219.2]:36014: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.127.97
country_id: 1814991
description:
Feb  6 05:51:12 ait sshd[1001155]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.127.97


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.32.250.174
country_id: 1814991
description:
Feb  6 05:51:05 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.32.250.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
country_id: 614540
description:
Feb  6 05:51:07 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.239.1.134
country_id: 226074
description:
2025-02-06 05:51:06 dovecot_plain authenticator failed for (134-1-239-197.r.airtel.ug) [197.239.1.134]:55504: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.82.135.154
country_id: 1814991
description:
Feb  6 05:51:08 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.82.135.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.82.135.154
country_id: 1814991
description:
2025-02-06 05:51:10 dovecot_plain authenticator failed for ([1.82.135.154]) [1.82.135.154]:39256: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.127.97
country_id: 1814991
description:
Feb  6 05:51:12 ait sshd[1001155]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.127.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.207.53
country_id: 1668284
description:
Feb  6 05:51:20 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.207.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.160.119.116
country_id: 1814991
description:
Feb  6 05:51:04 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.160.119.116 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.110.221
country_id: 3469034
description:
[2025-02-06 05:52:23 +0100] info [webmaild] 170.239.110.221 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 05:52:32 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.131.84.38
country_id: 1814991
description:
Feb  6 05:52:40 ait sshd[1001793]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.131.84.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.131.84.38
country_id: 1814991
description:
Feb  6 05:52:40 ait sshd[1001793]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.131.84.38


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.55.146.191
country_id: 1210997
description:
[2025-02-06 05:52:54 +0100] info [webmaild] 103.55.146.191 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.50.212.230
country_id: 3469034
description:
[2025-02-06 05:53:22 +0100] info [webmaild] 189.50.212.230 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.147.45
country_id: 99237
description:
Feb  6 05:53:32 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.147.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.168.173.87
country_id: 3175395
description:
2025-02-06 05:53:37 dovecot_plain authenticator failed for (cophiess) [185.168.173.87]:48810: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 142.4.1.40
country_id: 6252001
description:
Feb  6 05:53:46 ait sshd[1002047]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.4.1.40  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.122.119.83
country_id: 690791
description:
[2025-02-06 05:53:54 +0100] info [webmaild] 176.122.119.83 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
country_id: 1814991
description:
2025-02-06 05:54:02 dovecot_login authenticator failed for ([61.153.208.38]) [61.153.208.38]:29022: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.86.88.196
country_id: 2921044
description:
Feb  6 05:53:13 ait sshd[1001844]: pam_imunify(sshd:auth): [IM360_RBL] The IP 167.86.88.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.86.88.196
country_id: 2921044
description:
Feb  6 05:53:13 ait sshd[1001844]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.86.88.196


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-02-06 05:53:34 dovecot_plain authenticator failed for (comying) [65.20.147.45]:36308: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.168.173.87
country_id: 3175395
description:
Feb  6 05:53:35 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.168.173.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.4.1.40
country_id: 6252001
description:
Feb  6 05:53:46 ait sshd[1002047]: pam_imunify(sshd:auth): [IM360_RBL] The IP 142.4.1.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.234.154
country_id: 1814991
description:
2025-02-06 05:53:11 dovecot_plain authenticator failed for ([183.167.234.154]) [183.167.234.154]:42427: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
country_id: 1814991
description:
Feb  6 05:54:00 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.184.244
country_id: 3469034
description:
[2025-02-06 05:54:53 +0100] info [webmaild] 179.125.184.244 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.203.251.186
country_id: 1835841
description:
Feb  6 05:54:04 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.203.251.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.24
country_id: 1819730
description:
Feb  6 05:54:25 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.2.161.66
country_id: 3469034
description:
Feb  6 05:54:33 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.2.161.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.100.248.64
country_id: 1814991
description:
2025-02-06 05:54:36 dovecot_plain authenticator failed for ([223.100.248.64]) [223.100.248.64]:43208: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.254.136.116
country_id: 3017382
description:
Feb  6 05:54:52 ait sshd[1002368]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.254.136.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.82.12.128
country_id: 6252001
description:
2025-02-06 05:54:31 dovecot_plain authenticator failed for (50-82-12-128.client.mchsi.com) [50.82.12.128]:58002: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.165.23
country_id: 1269750
description:
2025-02-06 05:54:48 dovecot_plain authenticator failed for ([45.118.165.23]) [45.118.165.23]:40728: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2025-02-06 05:54:23 dovecot_plain authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:34087: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.86.88.196
country_id: 2921044
description:
Feb  6 05:54:45 ait sshd[1002303]: Failed password for invalid user ajarami from 167.86.88.196 port 52094 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.15
country_id: 6251999
description:
2025-02-06 05:54:56 dovecot_login authenticator failed for ([207.219.222.15]) [207.219.222.15]:54127: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.104.103
country_id: 1668284
description:
2025-02-06 05:54:05 dovecot_plain authenticator failed for 110-25-104-103.adsl.fetnet.net [110.25.104.103]:56650: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.38.74
country_id: 1814991
description:
Feb  6 05:54:34 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.38.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.2.161.66
country_id: 3469034
description:
2025-02-06 05:54:35 dovecot_login authenticator failed for ([177.2.161.89]) [177.2.161.66]:55150: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.128.19.228
country_id: 3017382
description:
2025-02-06 05:54:43 dovecot_plain authenticator failed for ([57.128.19.228]) [57.128.19.228]:33590: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-02-06 05:54:50 dovecot_login authenticator failed for ([103.147.248.44]) [103.147.248.44]:41404: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.128.19.228
country_id: 3017382
description:
Feb  6 05:54:41 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.128.19.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.124.14
country_id: 3469034
description:
Feb  6 05:54:42 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.124.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.44
country_id: 1269750
description:
Feb  6 05:54:48 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.109.10.69
country_id: 1880251
description:
Feb  6 05:54:51 ait sshd[1002363]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.109.10.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.198.18.3
country_id: 1835841
description:
Feb  6 05:54:15 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.198.18.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.43.109
country_id: 1819730
description:
Feb  6 05:54:19 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.43.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.111.34
country_id: 1814991
description:
Feb  6 05:54:32 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.111.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.38.74
country_id: 1814991
description:
2025-02-06 05:54:36 dovecot_login authenticator failed for ([118.122.38.74]) [118.122.38.74]:41774: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.10.69
country_id: 1880251
description:
Feb  6 05:54:51 ait sshd[1002363]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.10.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.0.149.238
country_id: 3175395
description:
2025-02-06 05:54:15 dovecot_plain authenticator failed for net-130-0-149-238.cust.vodafonedsl.it (chdesed) [130.0.149.238]:35214: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.82.12.128
country_id: 6252001
description:
Feb  6 05:54:29 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.82.12.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.100.248.64
country_id: 1814991
description:
Feb  6 05:54:34 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.100.248.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.165.23
country_id: 1269750
description:
Feb  6 05:54:46 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.165.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.188.40.123
country_id: 2017370
description:
Feb  6 05:55:01 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.188.40.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.18.3
country_id: 1835841
description:
2025-02-06 05:54:17 dovecot_login authenticator failed for ([175.198.18.3]) [175.198.18.3]:60898: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
country_id: 1819730
description:
2025-02-06 05:54:21 dovecot_plain authenticator failed for 109.43.246.220.static.netvigator.com [220.246.43.109]:51077: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
country_id: 3017382
description:
Feb  6 05:54:37 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.86.88.196
country_id: 2921044
description:
Feb  6 05:54:44 ait sshd[1002303]: pam_imunify(sshd:auth): [IM360_RBL] The IP 167.86.88.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.73.103.221
country_id: 6252001
description:
2025-02-06 05:54:49 dovecot_plain authenticator failed for ([216.73.103.221]) [216.73.103.221]:36223: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.0.149.238
country_id: 3175395
description:
Feb  6 05:54:13 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.0.149.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.111.34
country_id: 1814991
description:
2025-02-06 05:54:34 dovecot_plain authenticator failed for ([180.168.111.34]) [180.168.111.34]:38899: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.15
country_id: 6251999
description:
Feb  6 05:54:54 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.105.226.69
country_id: 298795
description:
Feb  6 05:54:04 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.105.226.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
country_id: 3932488
description:
Feb  6 05:54:22 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
country_id: 3017382
description:
2025-02-06 05:54:39 dovecot_login authenticator failed for 51.174.157.77.rev.sfr.net [77.157.174.51]:44733: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.86.88.196
country_id: 2921044
description:
Feb  6 05:54:44 ait sshd[1002303]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.86.88.196


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-02-06 05:54:24 dovecot_plain authenticator failed for ([190.117.96.174]) [190.117.96.174]:41084: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.254.136.116
country_id: 3017382
description:
Feb  6 05:54:52 ait sshd[1002368]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.136.116  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.226.69
country_id: 298795
description:
2025-02-06 05:54:06 dovecot_plain authenticator failed for (aimasoters) [85.105.226.69]:43076: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.203.251.186
country_id: 1835841
description:
2025-02-06 05:54:06 dovecot_plain authenticator failed for ([119.203.251.186]) [119.203.251.186]:58698: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 87.120.127.64
country_id: 732800
domain: ait.edu.gh
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/wp-content/plugins/wp-file-manager/inc/backup.php||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.104.103
country_id: 1668284
description:
Feb  6 05:54:03 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.104.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.40.122.250
country_id: 2629691
description:
Feb  6 05:54:21 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.40.122.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.24
country_id: 1819730
description:
2025-02-06 05:54:27 dovecot_plain authenticator failed for ([121.202.152.24]) [121.202.152.24]:20866: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-02-06 05:54:44 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:57733: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.73.103.221
country_id: 6252001
description:
Feb  6 05:54:47 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.73.103.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.175
country_id: 1819730
description:
Feb  6 05:54:52 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.175
country_id: 1819730
description:
2025-02-06 05:54:54 dovecot_login authenticator failed for ([121.202.153.175]) [121.202.153.175]:25247: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.218.3.175
country_id: 3996063
description:
[2025-02-06 05:55:22 +0100] info [webmaild] 189.218.3.175 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.86
country_id: 6252001
description:
Feb  6 05:55:38 ait sshd[1002701]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.86 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.86
country_id: 6252001
description:
Feb  6 05:55:38 ait sshd[1002701]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.86


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.165.94.102
country_id: 2017370
description:
[2025-02-06 05:55:52 +0100] info [webmaild] 109.165.94.102 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.234.106.218
country_id: 3865483
description:
Feb  6 05:55:30 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.234.106.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.218
country_id: 3865483
description:
2025-02-06 05:55:32 dovecot_plain authenticator failed for (201-234-106-218.static.impsat.net.ar) [201.234.106.218]:34772: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 05:55:50 ait sshd[1002784]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 05:55:50 ait sshd[1002784]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.188.40.123
country_id: 2017370
description:
2025-02-06 05:55:03 dovecot_login authenticator failed for (90.188.40.123.stbur.ru) [90.188.40.123]:36688: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.61.209
country_id: 1814991
description:
Feb  6 05:55:18 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.61.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.61.209
country_id: 1814991
description:
2025-02-06 05:55:20 dovecot_plain authenticator failed for ([39.165.61.209]) [39.165.61.209]:47200: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.131.84.38
country_id: 1814991
description:
Feb  6 05:55:49 ait sshd[1002780]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.131.84.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.131.84.38
country_id: 1814991
description:
Feb  6 05:55:49 ait sshd[1002780]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.131.84.38


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.196.84.188
country_id: 3469034
description:
Feb  6 05:56:40 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.196.84.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.161.98.179
country_id: 1269750
description:
Feb  6 05:56:42 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.161.98.179 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 93.170.171.187
country_id: 690791
description:
[2025-02-06 05:56:24 +0100] info [webmaild] 93.170.171.187 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.163.164
country_id: 1814991
description:
2025-02-06 05:56:24 dovecot_plain authenticator failed for ([61.145.163.164]) [61.145.163.164]:50961: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.204.108.172
country_id: 1814991
description:
Feb  6 05:56:32 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.204.108.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
country_id: 1835841
description:
Feb  6 05:56:08 ait sshd[1002829]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 173.0.106.179
country_id: 6252001
description:
Feb  6 05:56:30 ait sshd[1002873]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.0.106.179


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.196.84.188
country_id: 3469034
description:
2025-02-06 05:56:42 dovecot_plain authenticator failed for static-168-196-84-188.hilink.net.br [168.196.84.188]:60691: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.100.181
country_id: 2017370
description:
2025-02-06 05:57:01 dovecot_login authenticator failed for (broadband-37.204-100-181.ip.moscow.rt.ru) [37.204.100.181]:57806: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 173.0.106.179
country_id: 6252001
description:
[2025-02-06 05:56:35 +0100] info [webmaild] 173.0.106.179 - adom-oduro@ait.edu.gh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.96.43.215
country_id: 1562822
description:
Feb  6 05:56:36 ait sshd[1003081]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.43.215


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
country_id: 1835841
description:
Feb  6 05:56:08 ait sshd[1002829]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.81.78.32
country_id: 2510769
description:
Feb  6 05:56:18 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.81.78.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.145.163.164
country_id: 1814991
description:
Feb  6 05:56:22 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.145.163.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.229.51.206
country_id: 1835841
description:
2025-02-06 05:56:26 dovecot_plain authenticator failed for ([58.229.51.206]) [58.229.51.206]:32946: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.161.98.179
country_id: 1269750
description:
2025-02-06 05:56:44 dovecot_plain authenticator failed for ([119.161.97.235]) [119.161.98.179]:41948: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.100.181
country_id: 2017370
description:
Feb  6 05:56:59 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.100.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.81.78.32
country_id: 2510769
description:
2025-02-06 05:56:20 dovecot_plain authenticator failed for ([185.81.78.32]) [185.81.78.32]:56639: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.206
country_id: 1835841
description:
Feb  6 05:56:24 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.0.106.179
country_id: 6252001
description:
Feb  6 05:56:30 ait sshd[1002873]: pam_imunify(sshd:auth): [IM360_RBL] The IP 173.0.106.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.204.108.172
country_id: 1814991
description:
2025-02-06 05:56:34 dovecot_plain authenticator failed for ([129.204.108.172]) [129.204.108.172]:40108: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.96.43.215
country_id: 1562822
description:
Feb  6 05:56:36 ait sshd[1003081]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.96.43.215 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.70.103
country_id: 1512440
description:
[2025-02-06 05:57:18 +0100] info [webmaild] 84.54.70.103 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.201.58
country_id: 1814991
description:
2025-02-06 05:57:19 dovecot_plain authenticator failed for ([220.178.201.58]) [220.178.201.58]:48422: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.105.234
country_id: 1668284
description:
Feb  6 05:57:45 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.105.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.57.104.252
country_id: 1522867
description:
2025-02-06 05:57:06 dovecot_plain authenticator failed for 95.57.104.252.dynamic.telecom.kz [95.57.104.252]:49063: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.102.141.123
country_id: 6252001
description:
Feb  6 05:57:20 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.102.141.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.122.198.56
country_id: 1814991
description:
Feb  6 05:57:24 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.122.198.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.177.194
country_id: 1814991
description:
Feb  6 05:57:13 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.177.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.177.194
country_id: 1814991
description:
2025-02-06 05:57:15 dovecot_login authenticator failed for ([124.115.177.194]) [124.115.177.194]:59825: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.201.58
country_id: 1814991
description:
Feb  6 05:57:17 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.201.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.102.141.123
country_id: 6252001
description:
2025-02-06 05:57:22 dovecot_plain authenticator failed for ([75.102.141.123]) [75.102.141.123]:38261: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.234
country_id: 1668284
description:
2025-02-06 05:57:47 dovecot_plain authenticator failed for 110-25-105-234.adsl.fetnet.net [110.25.105.234]:44252: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.23.210.188
country_id: 2017370
description:
Feb  6 05:57:53 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.23.210.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.192.20.137
country_id: 3175395
description:
Feb  6 05:57:12 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.192.20.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.20.137
country_id: 3175395
description:
2025-02-06 05:57:14 dovecot_login authenticator failed for ([2.192.20.137]) [2.192.20.137]:55104: 535 Incorrect authentication data (set_id=eng38b22452y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.198.56
country_id: 1814991
description:
2025-02-06 05:57:26 dovecot_login authenticator failed for ([157.122.198.56]) [157.122.198.56]:54320: 535 Incorrect authentication data (set_id=eng38b22452y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.129.75.156
country_id: 2260494
description:
[2025-02-06 05:57:51 +0100] info [webmaild] 102.129.75.156 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.23.210.188
country_id: 2017370
description:
2025-02-06 05:57:55 dovecot_plain authenticator failed for (gammuts) [89.23.210.188]:33509: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.57.104.252
country_id: 1522867
description:
Feb  6 05:57:04 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.57.104.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.107.189
country_id: 3469034
description:
2025-02-06 05:58:05 dovecot_plain authenticator failed for (corporativo.static.gvt.net.br) [186.215.107.189]:44763: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.175.39.76
country_id: 1814991
description:
2025-02-06 05:58:29 dovecot_login authenticator failed for ([111.175.39.76]) [111.175.39.76]:49605: 535 Incorrect authentication data (set_id=abs65b11556y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.0.131
country_id: 1835841
description:
Feb  6 05:58:31 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.0.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.20.170
country_id: 6252001
description:
Feb  6 05:58:43 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.20.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
country_id: 1814991
description:
2025-02-06 05:58:26 dovecot_login authenticator failed for ([61.153.208.38]) [61.153.208.38]:10965: 535 Incorrect authentication data (set_id=eng19b00195y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 132.148.77.70
country_id: 6252001
description:
Feb  6 05:58:54 ait sshd[1003712]: pam_imunify(sshd:auth): [IM360_RBL] The IP 132.148.77.70 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 132.148.77.70
country_id: 6252001
description:
Feb  6 05:58:54 ait sshd[1003712]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.148.77.70  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.228.225.21
country_id: 1814991
description:
Feb  6 05:58:12 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.228.225.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.44.221
country_id: 2017370
description:
2025-02-06 05:58:14 dovecot_plain authenticator failed for broadband-37-110-44-221.ip.moscow.rt.ru [37.110.44.221]:9523: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.244.88
country_id: 2921044
description:
Feb  6 05:58:26 ait sshd[1003498]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.244.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
country_id: 1814991
description:
Feb  6 05:58:24 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.244.88
country_id: 2921044
description:
Feb  6 05:58:26 ait sshd[1003498]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.244.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.0.131
country_id: 1835841
description:
2025-02-06 05:58:33 dovecot_login authenticator failed for ([123.212.0.131]) [123.212.0.131]:44694: 535 Incorrect authentication data (set_id=ads76a66686y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.221.150.183
country_id: 3469034
description:
[2025-02-06 05:58:44 +0100] info [webmaild] 177.221.150.183 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.215.107.189
country_id: 3469034
description:
Feb  6 05:58:03 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.215.107.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.139.182.85
country_id: 1814991
description:
Feb  6 05:58:09 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.139.182.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.139.182.85
country_id: 1814991
description:
2025-02-06 05:58:11 dovecot_login authenticator failed for ([43.139.182.85]) [43.139.182.85]:38734: 535 Incorrect authentication data (set_id=eng19b00195y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.44.221
country_id: 2017370
description:
Feb  6 05:58:12 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.44.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.21
country_id: 1814991
description:
2025-02-06 05:58:14 dovecot_login authenticator failed for ([122.228.225.21]) [122.228.225.21]:62297: 535 Incorrect authentication data (set_id=abs65b11556y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.175.39.76
country_id: 1814991
description:
Feb  6 05:58:27 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.175.39.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
country_id: 6252001
description:
2025-02-06 05:58:45 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:39079: 535 Incorrect authentication data (set_id=ads76a66686y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 05:59:16 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.135.87.15
country_id: 3469034
description:
[2025-02-06 05:59:20 +0100] info [webmaild] 177.135.87.15 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.192.94
country_id: 3469034
description:
Feb  6 05:59:48 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.192.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.192.94
country_id: 3469034
description:
2025-02-06 05:59:50 dovecot_login authenticator failed for 186-247-192-94.user.veloxzone.com.br ([179.236.122.153]) [186.247.192.94]:42584: 535 Incorrect authentication data (set_id=ads22a00155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.140.210.134
country_id: 2017370
description:
Feb  6 05:59:55 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.140.210.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-02-06 05:59:32 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:57126: 535 Incorrect authentication data (set_id=eng19b00195y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.109.33.120
country_id: 690791
description:
2025-02-06 05:59:37 dovecot_login authenticator failed for rplus.dp.ua [77.109.33.120]:39950: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.0.240.126
country_id: 1814991
description:
2025-02-06 05:59:44 dovecot_login authenticator failed for ([113.0.240.126]) [113.0.240.126]:43593: 535 Incorrect authentication data (set_id=eng19b00195y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
country_id: 6252001
description:
Feb  6 05:59:30 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.109.33.120
country_id: 690791
description:
Feb  6 05:59:35 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.109.33.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.0.240.126
country_id: 1814991
description:
Feb  6 05:59:42 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.0.240.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.140.210.134
country_id: 2017370
description:
2025-02-06 05:59:57 dovecot_plain authenticator failed for (soncriss) [94.140.210.134]:37197: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.8.245
country_id: 6252001
description:
Feb  6 06:00:15 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.8.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.67.18
country_id: 1814991
description:
2025-02-06 06:00:31 dovecot_plain authenticator failed for ([112.91.67.18]) [112.91.67.18]:33533: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.189.90
country_id: 1835841
description:
2025-02-06 06:00:55 dovecot_plain authenticator failed for ([112.172.189.90]) [112.172.189.90]:37200: 535 Incorrect authentication data (set_id=eng21a00034y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.246
country_id: 1814991
description:
Feb  6 06:00:08 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.32.227.248
country_id: 3469034
description:
Feb  6 06:00:08 ait sshd[1004293]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.32.227.248


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.8.245
country_id: 6252001
description:
2025-02-06 06:00:17 dovecot_login authenticator failed for ([65.76.8.245]) [65.76.8.245]:53410: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.62.233.146
country_id: 1168579
description:
Feb  6 06:00:58 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.62.233.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.160.245.147
country_id: 1814991
description:
2025-02-06 06:00:27 dovecot_login authenticator failed for ([123.160.245.147]) [123.160.245.147]:50712: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.14.31.158
country_id: 3017382
description:
Feb  6 06:00:28 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.14.31.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.189.90
country_id: 1835841
description:
Feb  6 06:00:53 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.189.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.202.91.52
country_id: 357994
description:
Feb  6 06:00:59 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.202.91.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.32.227.248
country_id: 3469034
description:
Feb  6 06:00:08 ait sshd[1004293]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.32.227.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2025-02-06 06:00:10 dovecot_plain authenticator failed for ([116.114.84.246]) [116.114.84.246]:32910: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.62.233.146
country_id: 1168579
description:
2025-02-06 06:01:00 dovecot_login authenticator failed for ([103.62.233.146]) [103.62.233.146]:39639: 535 Incorrect authentication data (set_id=ads23b00195y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.160.245.147
country_id: 1814991
description:
Feb  6 06:00:25 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.160.245.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
country_id: 3017382
description:
2025-02-06 06:00:30 dovecot_plain authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr (fills) [80.14.31.158]:35100: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.112.88.162
country_id: 2542007
description:
[2025-02-06 06:00:07 +0100] info [webmaild] 196.112.88.162 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.67.18
country_id: 1814991
description:
Feb  6 06:00:29 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.67.18 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.241.169.152
country_id: 3996063
description:
[2025-02-06 06:00:45 +0100] info [webmaild] 177.241.169.152 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.202.91.52
country_id: 357994
description:
2025-02-06 06:01:01 dovecot_login authenticator failed for (host-196.202.91.52-static.tedata.net) [196.202.91.52]:47709: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.158.248.248
country_id: 2921044
description:
Feb  6 06:01:48 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.158.248.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.87.187.71
country_id: 2017370
description:
Feb  6 06:01:38 ait sshd[1004832]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.87.187.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.16.195
country_id: 1562822
description:
2025-02-06 06:01:04 dovecot_login authenticator failed for ([27.71.16.195]) [27.71.16.195]:61571: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.15
country_id: 6251999
description:
2025-02-06 06:01:07 dovecot_login authenticator failed for ([207.219.222.15]) [207.219.222.15]:36187: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.80.244.170
country_id: 3469034
description:
[2025-02-06 06:01:45 +0100] info [webmaild] 170.80.244.170 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.195
country_id: 1562822
description:
Feb  6 06:01:02 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.158.5.59
country_id: 6252001
description:
2025-02-06 06:01:35 dovecot_login authenticator failed for 47-158-5-59.lsan.ca.frontiernet.net [47.158.5.59]:65378: 535 Incorrect authentication data (set_id=ads23b00195y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.20.166
country_id: 1668284
description:
2025-02-06 06:01:56 dovecot_login authenticator failed for 111-70-20-166.emome-ip.hinet.net [111.70.20.166]:35702: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.15
country_id: 6251999
description:
Feb  6 06:01:05 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.105.113
country_id: 3469034
description:
Feb  6 06:01:32 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.105.113 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.97.132.7
country_id: 1562822
description:
Feb  6 06:01:26 ait sshd[1004659]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.97.132.7


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.110
country_id: 1814991
description:
2025-02-06 06:01:10 dovecot_login authenticator failed for (110.20.167.124.adsl-pool.sx.cn) [124.167.20.110]:50040: 535 Incorrect authentication data (set_id=ads23b00195y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.216.120.234
country_id: 6252001
description:
2025-02-06 06:01:13 dovecot_plain authenticator failed for 76-216-120-234.lightspeed.tukrga.sbcglobal.net [76.216.120.234]:35826: 535 Incorrect authentication data (set_id=eng21a00034y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.105.113
country_id: 3469034
description:
2025-02-06 06:01:34 dovecot_login authenticator failed for (177-174-105-113.user.vivozap.com.br) [177.174.105.113]:56698: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.110
country_id: 1814991
description:
Feb  6 06:01:08 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.130.70.80
country_id: 6252001
description:
Feb  6 06:01:17 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.130.70.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.97.132.7
country_id: 1562822
description:
Feb  6 06:01:26 ait sshd[1004659]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.97.132.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.158.248.248
country_id: 2921044
description:
2025-02-06 06:01:50 dovecot_login authenticator failed for ([193.158.248.248]) [193.158.248.248]:36910: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.70.80
country_id: 6252001
description:
2025-02-06 06:01:19 dovecot_login authenticator failed for mobile-166-130-70-80.mycingular.net [166.130.70.80]:35177: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.179.80.12
country_id: 3895114
description:
Feb  6 06:01:22 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.179.80.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.158.5.59
country_id: 6252001
description:
Feb  6 06:01:33 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.158.5.59 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.87.187.71
country_id: 2017370
description:
Feb  6 06:01:38 ait sshd[1004832]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.87.187.71


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.44.217.237
country_id: 2077456
description:
Feb  6 06:01:41 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.44.217.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.44.217.237
country_id: 2077456
description:
2025-02-06 06:01:43 dovecot_login authenticator failed for ([121.44.217.237]) [121.44.217.237]:59961: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.20.166
country_id: 1668284
description:
Feb  6 06:01:54 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.20.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.216.120.234
country_id: 6252001
description:
Feb  6 06:01:11 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.216.120.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.80.12
country_id: 3895114
description:
2025-02-06 06:01:24 dovecot_login authenticator failed for ([186.179.80.12]) [186.179.80.12]:50112: 535 Incorrect authentication data (set_id=ads23b00195y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.127.97
country_id: 1814991
description:
Feb  6 06:02:01 ait sshd[1005005]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.127.97


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.96.43.25
country_id: 1562822
description:
Feb  6 06:02:23 ait sshd[1005038]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.96.43.25 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.96.43.25
country_id: 1562822
description:
Feb  6 06:02:23 ait sshd[1005038]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.43.25  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.163
country_id: 1269750
description:
Feb  6 06:02:53 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.127.97
country_id: 1814991
description:
Feb  6 06:02:01 ait sshd[1005005]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.127.97 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.84.219.171
country_id: 3469034
description:
[2025-02-06 06:02:21 +0100] info [webmaild] 170.84.219.171 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.245.49.114
country_id: 953987
description:
[2025-02-06 06:02:53 +0100] info [webmaild] 197.245.49.114 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.163
country_id: 1269750
description:
2025-02-06 06:02:55 dovecot_login authenticator failed for ([103.146.233.163]) [103.146.233.163]:46102: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.239.109.147
country_id: 1814991
description:
2025-02-06 06:03:08 dovecot_login authenticator failed for ([221.239.109.147]) [221.239.109.147]:4752: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.148.43
country_id: 1835841
description:
2025-02-06 06:03:16 dovecot_login authenticator failed for ([183.109.148.43]) [183.109.148.43]:55904: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.229
country_id: 1819730
description:
2025-02-06 06:03:22 dovecot_login authenticator failed for (m121-202-153-229.smartone.com) [121.202.153.229]:51407: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.78.156.14
country_id: 3469034
description:
[2025-02-06 06:03:29 +0100] info [webmaild] 170.78.156.14 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.239.109.147
country_id: 1814991
description:
Feb  6 06:03:06 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.239.109.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 06:03:14 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.148.43
country_id: 1835841
description:
Feb  6 06:03:14 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.148.43 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.119.17.243
country_id: 6252001
description:
[2025-02-06 06:03:15 +0100] info [cpaneld] 92.119.17.243 - lemassne "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.229
country_id: 1819730
description:
Feb  6 06:03:20 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.150.226.207
country_id: 2661886
description:
2025-02-06 06:03:55 dovecot_plain authenticator failed for c188-150-226-207.bredband.tele2.se (fastal) [188.150.226.207]:56052: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2025-02-06 06:05:00 dovecot_login authenticator failed for ([20.46.45.121]) [20.46.45.121]:61469: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.190.129.68
country_id: 1835841
description:
Feb  6 06:04:15 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.190.129.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.220.235.237
country_id: 1835841
description:
Feb  6 06:04:23 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.220.235.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.220.235.237
country_id: 1835841
description:
2025-02-06 06:04:25 dovecot_login authenticator failed for ([112.220.235.237]) [112.220.235.237]:40226: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.21.148
country_id: 1835841
description:
2025-02-06 06:04:38 dovecot_login authenticator failed for ([221.167.21.148]) [221.167.21.148]:34482: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.147.162.219
country_id: 1210997
description:
[2025-02-06 06:04:40 +0100] info [webmaild] 103.147.162.219 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.190.129.68
country_id: 1835841
description:
2025-02-06 06:04:17 dovecot_login authenticator failed for ([121.190.129.68]) [121.190.129.68]:60238: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-04.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.59.53
country_id: 617790
description:
Feb  6 06:04:26 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.59.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.59.53
country_id: 617790
description:
2025-02-06 06:04:28 dovecot_login authenticator failed for ([185.167.59.53]) [185.167.59.53]:57366: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.167.21.148
country_id: 1835841
description:
Feb  6 06:04:36 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.167.21.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.46.45.121
country_id: 290557
description:
Feb  6 06:04:58 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.46.45.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.175.76.146
country_id: 6252001
description:
Feb  6 06:05:35 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.175.76.146 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 209.38.248.55
country_id: 2921044
description:
Feb  6 06:05:36 ait sshd[1006040]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.248.55  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.232.72.247
country_id: 2661886
description:
Feb  6 06:05:10 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.232.72.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
country_id: 1210997
description:
Feb  6 06:05:24 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.192.242
country_id: 290557
description:
2025-02-06 06:05:54 dovecot_login authenticator failed for ([94.204.192.242]) [94.204.192.242]:39962: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.90.114
country_id: 1814991
description:
Feb  6 06:05:25 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.90.114 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.112.171.23
country_id: 3469034
description:
[2025-02-06 06:05:45 +0100] info [webmaild] 187.112.171.23 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.232.72.247
country_id: 2661886
description:
2025-02-06 06:05:12 dovecot_plain authenticator failed for 81-232-72-247-no600.tbcn.telia.com [81.232.72.247]:60510: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.163.236.235
country_id: 1814991
description:
Feb  6 06:05:42 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.163.236.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.29.235.66
country_id: 1605651
description:
Feb  6 06:05:24 ait sshd[1005916]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.29.235.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.84.175
country_id: 1835841
description:
2025-02-06 06:05:23 dovecot_plain authenticator failed for ([222.114.84.175]) [222.114.84.175]:37248: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.148.148.191
country_id: 2661886
description:
2025-02-06 06:05:10 dovecot_plain authenticator failed for c188-148-148-191.bredband.tele2.se (nonverthic) [188.148.148.191]:57734: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.226.4.27
country_id: 2464461
description:
2025-02-06 06:05:12 dovecot_login authenticator failed for ([41.226.4.27]) [41.226.4.27]:55236: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
country_id: 6252001
description:
2025-02-06 06:05:37 dovecot_plain authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:39418: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.148.148.191
country_id: 2661886
description:
Feb  6 06:05:08 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.148.148.191 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.196.140.70
country_id: 3469034
description:
[2025-02-06 06:05:15 +0100] info [webmaild] 200.196.140.70 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.163.236.235
country_id: 1814991
description:
2025-02-06 06:05:44 dovecot_plain authenticator failed for ([222.163.236.235]) [222.163.236.235]:43148: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.226.4.27
country_id: 2464461
description:
Feb  6 06:05:10 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.226.4.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
country_id: 1210997
description:
2025-02-06 06:05:26 dovecot_login authenticator failed for ([103.124.54.14]) [103.124.54.14]:35810: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.84.175
country_id: 1835841
description:
Feb  6 06:05:21 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.84.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.108.186.10
country_id: 3077311
description:
2025-02-06 06:05:47 dovecot_plain authenticator failed for ([78.108.186.10]) [78.108.186.10]:43138: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.248.55
country_id: 2921044
description:
Feb  6 06:05:36 ait sshd[1006040]: pam_imunify(sshd:auth): [IM360_RBL] The IP 209.38.248.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.108.186.10
country_id: 3077311
description:
Feb  6 06:05:45 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.108.186.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.192.242
country_id: 290557
description:
Feb  6 06:05:52 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.192.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.29.235.66
country_id: 1605651
description:
Feb  6 06:05:24 ait sshd[1005916]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.29.235.66  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.90.114
country_id: 1814991
description:
2025-02-06 06:05:27 dovecot_plain authenticator failed for ([58.18.90.114]) [58.18.90.114]:48108: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.28.51
country_id: 1814991
description:
2025-02-06 06:06:24 dovecot_plain authenticator failed for ([222.128.28.51]) [222.128.28.51]:7464: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.60.194.189
country_id: 2510769
description:
2025-02-06 06:06:28 dovecot_plain authenticator failed for 81.60.194.189.dyn.user.ono.com [81.60.194.189]:56819: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.242.165.148
country_id: 1835841
description:
2025-02-06 06:06:33 dovecot_plain authenticator failed for ([1.242.165.148]) [1.242.165.148]:34597: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.111.34
country_id: 1814991
description:
Feb  6 06:06:04 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.111.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.177.106
country_id: 2275384
description:
Feb  6 06:06:05 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.177.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.213.101
country_id: 99237
description:
Feb  6 06:06:20 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.213.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.201.45
country_id: 1814991
description:
2025-02-06 06:06:22 dovecot_plain authenticator failed for (45.201.33.36.adsl-pool.ah.cnuninet.net) [36.33.201.45]:39960: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.96.151.110
country_id: 1814991
description:
Feb  6 06:06:23 ait sshd[1006373]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.96.151.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.183.1.82
country_id: 1814991
description:
Feb  6 06:07:00 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.183.1.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.83.89
country_id: 1835841
description:
Feb  6 06:06:07 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.83.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.88.186.142
country_id: 3469034
description:
Feb  6 06:06:13 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.88.186.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.60.194.189
country_id: 2510769
description:
Feb  6 06:06:26 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.60.194.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.32.93
country_id: 6252001
description:
Feb  6 06:06:26 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.32.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.143.253.112
country_id: 1835841
description:
2025-02-06 06:06:51 dovecot_login authenticator failed for ([125.143.253.112]) [125.143.253.112]:37000: 535 Incorrect authentication data (set_id=test@ait-edu.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.177.106
country_id: 2275384
description:
2025-02-06 06:06:07 dovecot_plain authenticator failed for ([196.250.177.106]) [196.250.177.106]:59431: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.134.110
country_id: 1814991
description:
Feb  6 06:06:16 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.134.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.85.12.142
country_id: 1835841
description:
Feb  6 06:06:30 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.85.12.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.85.12.142
country_id: 1835841
description:
2025-02-06 06:06:32 dovecot_plain authenticator failed for ([61.85.12.142]) [61.85.12.142]:44437: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.88.186.142
country_id: 3469034
description:
2025-02-06 06:06:15 dovecot_plain authenticator failed for ([201.88.186.142]) [201.88.186.142]:39128: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.28.51
country_id: 1814991
description:
Feb  6 06:06:22 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.28.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.72.153.14
country_id: 6252001
description:
2025-02-06 06:06:33 dovecot_plain authenticator failed for (160.72.153.14.lightower.net) [160.72.153.14]:52348: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
country_id: 1835841
description:
2025-02-06 06:06:34 dovecot_plain authenticator failed for ([36.39.140.2]) [36.39.140.2]:51530: 535 Incorrect authentication data (set_id=ads19b00188y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.165.23
country_id: 1269750
description:
Feb  6 06:06:07 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.165.23 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.104.242.91
country_id: 3469034
description:
[2025-02-06 06:06:17 +0100] info [webmaild] 177.104.242.91 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.115.42.62
country_id: 1814991
description:
Feb  6 06:06:07 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.115.42.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.83.89
country_id: 1835841
description:
2025-02-06 06:06:09 dovecot_plain authenticator failed for ([119.207.83.89]) [119.207.83.89]:45469: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.27
country_id: 1814991
description:
Feb  6 06:06:24 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.202.159.233
country_id: 6252001
description:
Feb  6 06:06:28 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 52.202.159.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.47.48.178
country_id: 1814991
description:
2025-02-06 06:06:39 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:52032: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.53.66
country_id: 1668284
description:
2025-02-06 06:06:55 dovecot_plain authenticator failed for (58-115-53-66.twt1.com.tw) [58.115.53.66]:34421: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.111.34
country_id: 1814991
description:
2025-02-06 06:06:06 dovecot_plain authenticator failed for ([180.168.111.34]) [180.168.111.34]:34468: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
country_id: 1269750
description:
2025-02-06 06:06:21 dovecot_plain authenticator failed for (nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:60752: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.1.117.226
country_id: 1562822
description:
2025-02-06 06:06:24 dovecot_plain authenticator failed for ([103.95.156.1]) [42.1.117.226]:49377: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 52.202.159.233
country_id: 6252001
description:
2025-02-06 06:06:30 dovecot_plain authenticator failed for ec2-52-202-159-233.compute-1.amazonaws.com [52.202.159.233]:53576: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.39.140.2
country_id: 1835841
description:
Feb  6 06:06:32 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.39.140.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.82
country_id: 1819730
description:
2025-02-06 06:06:25 dovecot_plain authenticator failed for (m121-202-152-82.smartone.com) [121.202.152.82]:31104: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.165.23
country_id: 1269750
description:
2025-02-06 06:06:09 dovecot_plain authenticator failed for ([45.118.165.23]) [45.118.165.23]:60451: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.134.110
country_id: 1814991
description:
2025-02-06 06:06:18 dovecot_plain authenticator failed for ([61.143.134.110]) [61.143.134.110]:37272: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.233.177
country_id: 1269750
description:
Feb  6 06:06:21 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.233.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
country_id: 3469034
description:
Feb  6 06:06:22 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.29.87.109
country_id: 1814991
description:
2025-02-06 06:06:22 dovecot_plain authenticator failed for ([112.29.87.109]) [112.29.87.109]:34380: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.1.210
country_id: 1814991
description:
Feb  6 06:06:07 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.1.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.84.175
country_id: 1835841
description:
2025-02-06 06:06:21 dovecot_plain authenticator failed for ([222.114.84.175]) [222.114.84.175]:40376: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.72.153.14
country_id: 6252001
description:
Feb  6 06:06:31 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.72.153.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.115.42.62
country_id: 1814991
description:
2025-02-06 06:06:09 dovecot_plain authenticator failed for ([27.115.42.62]) [27.115.42.62]:59758: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.194.116
country_id: 1814991
description:
2025-02-06 06:06:11 dovecot_plain authenticator failed for ([120.234.194.116]) [120.234.194.116]:42988: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.201.45
country_id: 1814991
description:
Feb  6 06:06:20 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.201.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.100.105.194
country_id: 2750405
description:
2025-02-06 06:06:29 dovecot_plain authenticator failed for d96469c2.static.ziggozakelijk.nl ([217.100.105.195]) [217.100.105.194]:54627: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.242.165.148
country_id: 1835841
description:
Feb  6 06:06:31 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.242.165.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.180.88.72
country_id: 6252001
description:
Feb  6 06:06:05 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.180.88.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.84.175
country_id: 1835841
description:
Feb  6 06:06:19 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.84.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.233.177
country_id: 1269750
description:
2025-02-06 06:06:23 dovecot_plain authenticator failed for (nsg-corporate-177.233.187.122.airtel.in) [122.187.233.177]:41661: 535 Incorrect authentication data (set_id=ads19b00188y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.96.151.110
country_id: 1814991
description:
Feb  6 06:06:23 ait sshd[1006373]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.96.151.110


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.27
country_id: 1814991
description:
2025-02-06 06:06:26 dovecot_plain authenticator failed for ([182.135.66.27]) [182.135.66.27]:44736: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.130.70.80
country_id: 6252001
description:
Feb  6 06:06:08 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.130.70.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.1.210
country_id: 1814991
description:
2025-02-06 06:06:09 dovecot_plain authenticator failed for ([60.172.1.210]) [60.172.1.210]:47347: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.65.134
country_id: 1814991
description:
2025-02-06 06:06:19 dovecot_plain authenticator failed for ([183.238.65.134]) [183.238.65.134]:50530: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.241.168
country_id: 2245662
description:
2025-02-06 06:06:19 dovecot_plain authenticator failed for ([154.65.33.26]) [196.207.241.168]:49004: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.221.130.246
country_id: 1835841
description:
2025-02-06 06:06:10 dovecot_plain authenticator failed for ([211.221.130.246]) [211.221.130.246]:39384: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.70.80
country_id: 6252001
description:
2025-02-06 06:06:10 dovecot_plain authenticator failed for mobile-166-130-70-80.mycingular.net [166.130.70.80]:35541: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.32.93
country_id: 6252001
description:
2025-02-06 06:06:28 dovecot_plain authenticator failed for ([158.140.32.93]) [158.140.32.93]:52160: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.47.48.178
country_id: 1814991
description:
Feb  6 06:06:37 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.47.48.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
country_id: 3469034
description:
2025-02-06 06:06:24 dovecot_plain authenticator failed for ([200.149.51.186]) [200.149.51.186]:44486: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.100.105.194
country_id: 2750405
description:
Feb  6 06:06:27 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.100.105.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.139.55
country_id: 1814991
description:
Feb  6 06:06:45 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.139.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.148.215.54
country_id: 6252001
description:
2025-02-06 06:06:06 dovecot_plain authenticator failed for (75-148-215-54-Houston.hfc.comcastbusiness.net) [75.148.215.54]:41494: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.194.116
country_id: 1814991
description:
Feb  6 06:06:09 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.194.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.207.241.168
country_id: 2245662
description:
Feb  6 06:06:17 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.207.241.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.1.117.226
country_id: 1562822
description:
Feb  6 06:06:22 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.1.117.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.82
country_id: 1819730
description:
Feb  6 06:06:23 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.48.194.21
country_id: 1562822
description:
Feb  6 06:06:42 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.48.194.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.194.21
country_id: 1562822
description:
2025-02-06 06:06:44 dovecot_plain authenticator failed for ([103.48.194.21]) [103.48.194.21]:33246: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.139.55
country_id: 1814991
description:
2025-02-06 06:06:47 dovecot_plain authenticator failed for ([112.194.139.55]) [112.194.139.55]:46704: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.148.215.54
country_id: 6252001
description:
Feb  6 06:06:04 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.148.215.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.180.88.72
country_id: 6252001
description:
2025-02-06 06:06:07 dovecot_plain authenticator failed for static-47-180-88-72.lsan.ca.frontiernet.net ([65.255.196.42]) [47.180.88.72]:36084: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.34
country_id: 1269750
description:
Feb  6 06:06:19 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.29.87.109
country_id: 1814991
description:
Feb  6 06:06:20 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.29.87.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.213.101
country_id: 99237
description:
2025-02-06 06:06:22 dovecot_plain authenticator failed for ([65.20.213.101]) [65.20.213.101]:46983: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.143.253.112
country_id: 1835841
description:
Feb  6 06:06:49 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.143.253.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.231.102.189
country_id: 6252001
description:
Feb  6 06:06:04 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.231.102.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.231.102.189
country_id: 6252001
description:
2025-02-06 06:06:06 dovecot_plain authenticator failed for ([73.231.102.189]) [73.231.102.189]:48456: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.221.130.246
country_id: 1835841
description:
Feb  6 06:06:08 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.221.130.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.65.134
country_id: 1814991
description:
Feb  6 06:06:17 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.65.134 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.53.255.90
country_id: 3469034
description:
[2025-02-06 06:07:26 +0100] info [webmaild] 187.53.255.90 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.148.186.186
country_id: 1814991
description:
Feb  6 06:07:51 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.148.186.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.32.11.3
country_id: 1814991
description:
Feb  6 06:08:00 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.32.11.3 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.245.29.237
country_id: 1835841
description:
Feb  6 06:07:11 ait sshd[1006908]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.245.29.237  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.28.61
country_id: 1814991
description:
Feb  6 06:07:15 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.28.61
country_id: 1814991
description:
2025-02-06 06:07:17 dovecot_plain authenticator failed for ([60.173.88.145]) [111.39.28.61]:48686: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 223.123.38.216
country_id: 1168579
description:
[2025-02-06 06:08:01 +0100] info [webmaild] 223.123.38.216 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-02-06 06:07:59 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:65168: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.245.29.237
country_id: 1835841
description:
Feb  6 06:07:11 ait sshd[1006908]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.245.29.237 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.86
country_id: 6252001
description:
Feb  6 06:07:40 ait sshd[1006991]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.86


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.150.135.19
country_id: 690791
description:
Feb  6 06:07:57 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.150.135.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.183.1.82
country_id: 1814991
description:
2025-02-06 06:07:02 dovecot_login authenticator failed for ([1.183.1.82]) [1.183.1.82]:53531: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.54.115.46
country_id: 1512440
description:
Feb  6 06:07:34 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.54.115.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.86
country_id: 6252001
description:
Feb  6 06:07:40 ait sshd[1006991]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-02-06 06:07:36 dovecot_plain authenticator failed for ([84.54.115.46]) [84.54.115.46]:46672: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.18.148.10
country_id: 1814991
description:
Feb  6 06:07:47 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.18.148.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2025-02-06 06:07:49 dovecot_login authenticator failed for (hebei.18.121.in-addr.arpa) [121.18.148.10]:22532: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.148.186.186
country_id: 1814991
description:
2025-02-06 06:07:53 dovecot_plain authenticator failed for ([116.148.186.186]) [116.148.186.186]:49468: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.93.113.138
country_id: 149590
description:
Feb  6 06:07:03 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.93.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.93.113.138
country_id: 149590
description:
2025-02-06 06:07:05 dovecot_plain authenticator failed for ([41.93.113.138]) [41.93.113.138]:50912: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Feb  6 06:08:26 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.84.236.112
country_id: 3469034
description:
[2025-02-06 06:08:50 +0100] info [webmaild] 177.84.236.112 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.189
country_id: 1814991
description:
2025-02-06 06:08:18 dovecot_plain authenticator failed for ([60.167.19.189]) [60.167.19.189]:53413: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.76.127
country_id: 1835841
description:
2025-02-06 06:08:28 dovecot_plain authenticator failed for ([183.107.76.127]) [183.107.76.127]:49655: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.199.99
country_id: 895949
description:
2025-02-06 06:08:42 dovecot_plain authenticator failed for (ppp99-lumwana.zamnet.zm) [196.46.199.99]:33289: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.32.11.3
country_id: 1814991
description:
2025-02-06 06:08:02 dovecot_plain authenticator failed for ([119.32.11.3]) [119.32.11.3]:9691: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.130.116.100
country_id: 953987
description:
Feb  6 06:08:36 ait sshd[1007252]: pam_imunify(sshd:auth): [IM360_RBL] The IP 102.130.116.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.199.99
country_id: 895949
description:
Feb  6 06:08:40 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.199.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.189
country_id: 1814991
description:
Feb  6 06:08:16 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 102.130.116.100
country_id: 953987
description:
Feb  6 06:08:36 ait sshd[1007252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.130.116.100


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.221.246.63
country_id: 1168579
description:
[2025-02-06 06:09:26 +0100] info [webmaild] 103.221.246.63 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.42.80
country_id: 3144096
description:
Feb  6 06:09:35 ait sshd[1007631]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.42.80 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.42.80
country_id: 3144096
description:
Feb  6 06:09:35 ait sshd[1007631]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.42.80


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.178.158.132
country_id: 1269750
description:
2025-02-06 06:09:37 dovecot_login authenticator failed for ([103.178.158.133]) [103.178.158.132]:46026: 535 Incorrect authentication data (set_id=test@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.94.0.159
country_id: 1861060
description:
Feb  6 06:09:52 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.94.0.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 06:09:57 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.178.158.132
country_id: 1269750
description:
Feb  6 06:09:35 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.178.158.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
country_id: 1861060
description:
2025-02-06 06:09:54 dovecot_login authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:25822: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.217.255.171
country_id: 6252001
description:
Feb  6 06:10:47 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.217.255.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 06:10:08 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.198
country_id: 1814991
description:
Feb  6 06:10:37 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.198
country_id: 1814991
description:
2025-02-06 06:10:39 dovecot_login authenticator failed for ([111.61.176.198]) [111.61.176.198]:12256: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 06:10:42 ait sshd[1008184]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.156.198
country_id: 1814991
description:
2025-02-06 06:10:52 dovecot_login authenticator failed for ([116.116.156.198]) [116.116.156.198]:39958: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.156.198
country_id: 1814991
description:
Feb  6 06:10:50 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.156.198 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.125.125.155
country_id: 3469034
description:
[2025-02-06 06:10:50 +0100] info [webmaild] 177.125.125.155 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-02-06 06:11:01 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:41671: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.254.202.30
country_id: 3469034
description:
[2025-02-06 06:10:16 +0100] info [webmaild] 170.254.202.30 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 06:10:42 ait sshd[1008184]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-02-06 06:10:49 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:57092: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
country_id: 2542007
description:
Feb  6 06:10:59 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.104.199.251
country_id: 3865483
description:
Feb  6 06:11:43 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.104.199.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.199.251
country_id: 3865483
description:
2025-02-06 06:11:45 dovecot_login authenticator failed for ([190.104.199.251]) [190.104.199.251]:52099: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.217.1.27
country_id: 597427
description:
2025-02-06 06:11:52 dovecot_login authenticator failed for static-193-217-1-27.cust.tele2.lt [193.217.1.27]:58086: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.174.189.52
country_id: 1835841
description:
2025-02-06 06:11:22 dovecot_plain authenticator failed for ([121.174.189.52]) [121.174.189.52]:59642: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
country_id: 2017370
description:
2025-02-06 06:11:28 dovecot_login authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:59302: 535 Incorrect authentication data (set_id=test@ait-open.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.201.121.23
country_id: 3469034
description:
[2025-02-06 06:11:39 +0100] info [webmaild] 191.201.121.23 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.174.189.52
country_id: 1835841
description:
Feb  6 06:11:20 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.174.189.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
country_id: 2017370
description:
Feb  6 06:11:26 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.85.251.16
country_id: 1835841
description:
Feb  6 06:11:31 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.85.251.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.85.251.16
country_id: 1835841
description:
2025-02-06 06:11:33 dovecot_plain authenticator failed for ([220.85.251.16]) [220.85.251.16]:54844: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.217.1.27
country_id: 597427
description:
Feb  6 06:11:50 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.217.1.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.24.191.250
country_id: 3469034
description:
[2025-02-06 06:12:12 +0100] info [webmaild] 201.24.191.250 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 06:12:30 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.170.225.80
country_id: 1269750
description:
Feb  6 06:12:01 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.170.225.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.170.225.80
country_id: 1269750
description:
2025-02-06 06:12:03 dovecot_login authenticator failed for ([103.170.225.80]) [103.170.225.80]:41058: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 06:13:08 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.0.147.34
country_id: 3469034
description:
[2025-02-06 06:13:39 +0100] info [webmaild] 138.0.147.34 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.149.126
country_id: 3469034
description:
[2025-02-06 06:13:02 +0100] info [webmaild] 177.37.149.126 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.198.56
country_id: 1814991
description:
2025-02-06 06:14:37 dovecot_plain authenticator failed for ([157.122.198.56]) [157.122.198.56]:60460: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.0.130
country_id: 1835841
description:
2025-02-06 06:14:50 dovecot_plain authenticator failed for ([123.212.0.130]) [123.212.0.130]:53466: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.215.199.37
country_id: 1819730
description:
2025-02-06 06:14:19 dovecot_plain authenticator failed for ([125.215.199.37]) [125.215.199.37]:53708: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.189.19.186
country_id: 2542007
description:
[2025-02-06 06:14:20 +0100] info [webmaild] 105.189.19.186 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
country_id: 3469034
description:
2025-02-06 06:14:33 dovecot_plain authenticator failed for (18776174254.telemar.net.br) [187.76.174.254]:34166: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.72
country_id: 1269750
description:
2025-02-06 06:14:51 dovecot_plain authenticator failed for ([144.48.49.72]) [144.48.49.72]:58595: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.66.99.100
country_id: 2782113
description:
[2025-02-06 06:14:56 +0100] info [webmaild] 41.66.99.100 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.65.160.234
country_id: 1814991
description:
Feb  6 06:14:37 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.65.160.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.0.130
country_id: 1835841
description:
Feb  6 06:14:48 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.0.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.72
country_id: 1269750
description:
Feb  6 06:14:49 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.65.160.234
country_id: 1814991
description:
2025-02-06 06:14:39 dovecot_plain authenticator failed for ([124.65.160.234]) [124.65.160.234]:54021: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.215.199.37
country_id: 1819730
description:
Feb  6 06:14:17 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.215.199.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
country_id: 3469034
description:
Feb  6 06:14:31 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.122.198.56
country_id: 1814991
description:
Feb  6 06:14:35 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.122.198.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
country_id: 3017382
description:
2025-02-06 06:15:04 dovecot_plain authenticator failed for 51.174.157.77.rev.sfr.net (dersyncea) [77.157.174.51]:36066: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 06:15:20 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.122.139.17
country_id: 298795
description:
[2025-02-06 06:15:50 +0100] info [webmaild] 94.122.139.17 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.234
country_id: 1562822
description:
Feb  6 06:15:37 ait sshd[1010127]: pam_imunify(sshd:auth): [IM360_RBL] The IP 27.71.27.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 27.71.27.234
country_id: 1562822
description:
Feb  6 06:15:37 ait sshd[1010127]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.71.27.234


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.127.97
country_id: 1814991
description:
Feb  6 06:16:49 ait sshd[1010693]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.127.97


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.249.167.45
country_id: 6252001
description:
Feb  6 06:16:54 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.249.167.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.249.167.45
country_id: 6252001
description:
2025-02-06 06:16:56 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:58674: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 119.73.103.52
country_id: 1168579
description:
[2025-02-06 06:17:01 +0100] info [webmaild] 119.73.103.52 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.248.116.230
country_id: 2017370
description:
Feb  6 06:17:08 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.248.116.230 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 31.24.159.135
country_id: 2510769
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-17.31.24.159.135


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.127.97
country_id: 1814991
description:
Feb  6 06:16:49 ait sshd[1010693]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.127.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.238.213
country_id: 3017382
description:
Feb  6 06:17:07 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.238.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.36.238.213
country_id: 3017382
description:
2025-02-06 06:17:09 dovecot_plain authenticator failed for ip213.ip-54-36-238.eu [54.36.238.213]:35426: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.248.116.230
country_id: 2017370
description:
2025-02-06 06:17:10 dovecot_plain authenticator failed for data.autofrant.ru (praddy) [151.248.116.230]:35382: 535 Incorrect authentication data (set_id=ads76a66686y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.106.239.84
country_id: 2017370
description:
[2025-02-06 06:17:37 +0100] info [webmaild] 95.106.239.84 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.121.69
country_id: 1814991
description:
Feb  6 06:18:15 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.121.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 06:17:44 ait sshd[1011218]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.121.69
country_id: 1814991
description:
2025-02-06 06:18:17 dovecot_plain authenticator failed for ([183.238.121.69]) [183.238.121.69]:50049: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.62.165.36
country_id: 2464461
description:
[2025-02-06 06:18:34 +0100] info [webmaild] 41.62.165.36 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.29.208.26
country_id: 953987
description:
Feb  6 06:18:04 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.29.208.26 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 06:17:44 ait sshd[1011218]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.208.26
country_id: 953987
description:
2025-02-06 06:18:06 dovecot_plain authenticator failed for ([217.29.208.26]) [217.29.208.26]:50440: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.44.184
country_id: 1880251
description:
47.128.44.184 - - [06/Feb/2025:06:18:53 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13999421 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/2/?duration=short%2CextraLong&filtering=1&instructor=2&level=beginner%2Cintermediate" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.44.184


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.20.170
country_id: 6252001
description:
Feb  6 06:19:08 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.20.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
country_id: 6252001
description:
2025-02-06 06:19:10 dovecot_plain authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:57573: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.238.213
country_id: 3017382
description:
Feb  6 06:19:35 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.238.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.36.238.213
country_id: 3017382
description:
2025-02-06 06:19:37 dovecot_plain authenticator failed for ip213.ip-54-36-238.eu [54.36.238.213]:37796: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-18.80.76.51.123


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.98.103
country_id: 1880251
description:
47.128.98.103 - - [06/Feb/2025:06:19:04 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15050904 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=205%2C30%2C106" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.98.103


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.39.123.178
country_id: 3469034
description:
[2025-02-06 06:19:08 +0100] info [webmaild] 177.39.123.178 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.138.69
country_id: 1819730
description:
Feb  6 06:19:50 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.138.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-02-06 06:20:05 dovecot_login authenticator failed for ([216.194.174.103]) [216.194.174.27]:57623: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.140
country_id: 1835841
description:
Feb  6 06:20:10 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.151.45.136
country_id: 1814991
description:
Feb  6 06:20:22 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.151.45.136 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.143.3.132
country_id: 2510769
description:
Feb  6 06:20:05 ait sshd[1012009]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.143.3.132  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.84.38.246
country_id: 3469034
description:
2025-02-06 06:20:19 dovecot_login authenticator failed for 206.84.38.246.assistemas.net.br [206.84.38.246]:3979: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.151.45.136
country_id: 1814991
description:
2025-02-06 06:20:24 dovecot_plain authenticator failed for ([182.151.45.136]) [182.151.45.136]:49158: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.86
country_id: 6252001
description:
Feb  6 06:19:44 ait sshd[1011770]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.86


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.111.34
country_id: 1814991
description:
2025-02-06 06:20:03 dovecot_plain authenticator failed for ([180.168.111.34]) [180.168.111.34]:38526: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.232.39.165
country_id: 2510769
description:
Feb  6 06:20:22 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.232.39.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.198.138.185
country_id: 1814991
description:
2025-02-06 06:20:16 dovecot_plain authenticator failed for ([120.198.138.185]) [120.198.138.185]:58008: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.232.39.165
country_id: 2510769
description:
2025-02-06 06:20:24 dovecot_plain authenticator failed for ([185.232.39.165]) [185.232.39.165]:48624: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.40.72.101
country_id: 798549
description:
Feb  6 06:20:32 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.40.72.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.86
country_id: 6252001
description:
Feb  6 06:19:44 ait sshd[1011770]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.86 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.230.214.130
country_id: 3469034
description:
[2025-02-06 06:19:59 +0100] info [webmaild] 45.230.214.130 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.111.34
country_id: 1814991
description:
Feb  6 06:20:01 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.111.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.198.138.185
country_id: 1814991
description:
Feb  6 06:20:14 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.198.138.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
country_id: 6252001
description:
Feb  6 06:20:03 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.3.132
country_id: 2510769
description:
Feb  6 06:20:05 ait sshd[1012009]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.143.3.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
country_id: 1835841
description:
2025-02-06 06:20:12 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:54812: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.226.241.177
country_id: 2017370
description:
Feb  6 06:20:38 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.226.241.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.40.72.101
country_id: 798549
description:
2025-02-06 06:20:34 dovecot_plain authenticator failed for ([89.40.72.101]) [89.40.72.101]:59760: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2025-02-06 06:19:52 dovecot_plain authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:57072: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2025-02-06 06:21:09 dovecot_plain authenticator failed for ([196.28.226.66]) [196.28.226.66]:54921: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.96.5.124
country_id: 3996063
description:
[2025-02-06 06:20:38 +0100] info [webmaild] 186.96.5.124 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.90
country_id: 1814991
description:
Feb  6 06:21:21 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.90 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.7.120.12
country_id: 1210997
description:
[2025-02-06 06:21:25 +0100] info [webmaild] 103.7.120.12 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.148.173.150
country_id: 3469034
description:
2025-02-06 06:20:50 dovecot_plain authenticator failed for ([189.108.24.17]) [200.148.173.150]:39112: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.124.221.2
country_id: 2750405
description:
Feb  6 06:21:15 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.124.221.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.226.241.177
country_id: 2017370
description:
2025-02-06 06:20:40 dovecot_plain authenticator failed for (pool-176-226-241-177.is74.ru) [176.226.241.177]:34572: 535 Incorrect authentication data (set_id=eng19a00097y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.235.148.73
country_id: 1562822
description:
Feb  6 06:21:11 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.235.148.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.66
country_id: 1036973
description:
Feb  6 06:21:07 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.235.148.73
country_id: 1562822
description:
2025-02-06 06:21:13 dovecot_login authenticator failed for ([171.235.148.73]) [171.235.148.73]:56706: 535 Incorrect authentication data (set_id=mail@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.90
country_id: 1814991
description:
2025-02-06 06:21:23 dovecot_login authenticator failed for ([27.24.141.90]) [27.24.141.90]:35270: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.127.195
country_id: 1814991
description:
Feb  6 06:21:28 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.127.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
country_id: 294640
description:
Feb  6 06:20:49 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.223.49
country_id: 1835841
description:
2025-02-06 06:20:55 dovecot_login authenticator failed for ([211.105.223.49]) [211.105.223.49]:36206: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.143.123
country_id: 3374766
description:
Feb  6 06:21:02 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.143.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.143.123
country_id: 3374766
description:
2025-02-06 06:21:04 dovecot_login authenticator failed for ([197.255.143.123]) [197.255.143.123]:36652: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2025-02-06 06:21:17 dovecot_plain authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:38126: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.223.49
country_id: 1835841
description:
Feb  6 06:20:53 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.223.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.121.193.126
country_id: 3595528
description:
Feb  6 06:21:17 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.121.193.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-02-06 06:21:19 dovecot_login authenticator failed for ([190.121.193.126]) [190.121.193.126]:55830: 535 Incorrect authentication data (set_id=mail@lemsas.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.127.195
country_id: 1814991
description:
2025-02-06 06:21:30 dovecot_login authenticator failed for ([39.164.127.195]) [39.164.127.195]:42202: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.148.173.150
country_id: 3469034
description:
Feb  6 06:20:48 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.148.173.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
country_id: 294640
description:
2025-02-06 06:20:51 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (coadde) [109.67.154.24]:60394: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.150.37.249
country_id: 2017370
description:
Feb  6 06:21:39 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.150.37.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2025-02-06 06:21:43 dovecot_plain authenticator failed for ([218.149.235.152]) [218.149.235.152]:41672: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.150.37.249
country_id: 2017370
description:
2025-02-06 06:21:41 dovecot_plain authenticator failed for ([217.150.37.249]) [217.150.37.249]:49382: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.63.165.16
country_id: 1835841
description:
Feb  6 06:21:44 ait sshd[1012422]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.165.16


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.219.170.50
country_id: 953987
description:
[2025-02-06 06:22:00 +0100] info [webmaild] 102.219.170.50 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.236.102.6
country_id: 99237
description:
[2025-02-06 06:22:36 +0100] info [webmaild] 37.236.102.6 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
country_id: 1835841
description:
Feb  6 06:21:41 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.129.195
country_id: 6251999
description:
Feb  6 06:21:49 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.129.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.129.195
country_id: 6251999
description:
2025-02-06 06:21:51 dovecot_plain authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:43274: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.87.38
country_id: 1814991
description:
Feb  6 06:21:57 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.87.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.63.165.16
country_id: 1835841
description:
Feb  6 06:21:44 ait sshd[1012422]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.63.165.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.87.38
country_id: 1814991
description:
2025-02-06 06:21:59 dovecot_plain authenticator failed for ([1.28.87.38]) [1.28.87.38]:38243: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.233.57.113
country_id: 3996063
description:
[2025-02-06 06:23:10 +0100] info [webmaild] 187.233.57.113 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 122.155.223.159
country_id: 1605651
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-22.122.155.223.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.51.122.230
country_id: 1814991
description:
2025-02-06 06:23:23 dovecot_plain authenticator failed for ([58.51.122.230]) [58.51.122.230]:36822: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.204.158.2
country_id: 3996063
description:
Feb  6 06:23:24 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.204.158.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 06:22:59 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.152.108.61
country_id: 6252001
description:
Feb  6 06:23:15 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.152.108.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.51.122.230
country_id: 1814991
description:
Feb  6 06:23:21 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.51.122.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 06:23:32 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.152.108.61
country_id: 6252001
description:
2025-02-06 06:23:17 dovecot_plain authenticator failed for syn-098-152-108-061.biz.spectrum.com [98.152.108.61]:48319: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.204.158.2
country_id: 3996063
description:
2025-02-06 06:23:26 dovecot_plain authenticator failed for 2.189-204-158.bestelclientes.com.mx [189.204.158.2]:49789: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.76.194.159
country_id: 6252001
description:
Feb  6 06:23:04 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.76.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-02-06 06:23:06 dovecot_plain authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:58100: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.67.18
country_id: 1814991
description:
2025-02-06 06:23:40 dovecot_plain authenticator failed for ([112.91.67.18]) [112.91.67.18]:43614: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.205.203.246
country_id: 2750405
description:
Feb  6 06:24:00 ait sshd[1013353]: pam_imunify(sshd:auth): [IM360_RBL] The IP 172.205.203.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 172.205.203.246
country_id: 2750405
description:
Feb  6 06:24:00 ait sshd[1013353]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.205.203.246  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.67.18
country_id: 1814991
description:
Feb  6 06:23:38 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.67.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2025-02-06 06:23:57 dovecot_plain authenticator failed for ([61.72.59.106]) [61.72.59.106]:52947: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.248.65.30
country_id: 1835841
description:
Feb  6 06:24:02 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.248.65.30 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.225.230.151
country_id: 3469034
description:
[2025-02-06 06:24:13 +0100] info [webmaild] 179.225.230.151 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.172.46.10
country_id: 6252001
description:
Feb  6 06:24:20 ait sshd[1013403]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.172.46.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
country_id: 1835841
description:
2025-02-06 06:24:04 dovecot_plain authenticator failed for ([219.248.65.30]) [219.248.65.30]:47593: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.172.46.10
country_id: 6252001
description:
Feb  6 06:24:20 ait sshd[1013403]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.172.46.10


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
country_id: 1269750
description:
Feb  6 06:24:43 ait sshd[1013459]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 148.0.95.64
country_id: 3508796
description:
[2025-02-06 06:24:46 +0100] info [webmaild] 148.0.95.64 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.99.13.82
country_id: 6251999
description:
Feb  6 06:24:50 ait sshd[1013588]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.99.13.82


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
country_id: 1269750
description:
Feb  6 06:24:43 ait sshd[1013459]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.99.13.82
country_id: 6251999
description:
Feb  6 06:24:50 ait sshd[1013588]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.99.13.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 06:26:00 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.239
country_id: 1668284
description:
2025-02-06 06:26:23 dovecot_plain authenticator failed for 111-70-23-239.emome-ip.hinet.net [111.70.23.239]:47210: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.31.8.202
country_id: 1210997
description:
2025-02-06 06:26:34 dovecot_plain authenticator failed for (113-11-34-221-smile.com.bd) [114.31.8.202]:46288: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.239
country_id: 1668284
description:
Feb  6 06:26:21 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.31.8.202
country_id: 1210997
description:
Feb  6 06:26:32 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.31.8.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
country_id: 1269750
description:
Feb  6 06:26:37 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.248.130.142
country_id: 690791
description:
[2025-02-06 06:25:49 +0100] info [webmaild] 185.248.130.142 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.78.233.50
country_id: 1522867
description:
[2025-02-06 06:26:11 +0100] info [webmaild] 185.78.233.50 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.228.105.192
country_id: 1835841
description:
Feb  6 06:26:18 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.228.105.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.228.105.192
country_id: 1835841
description:
2025-02-06 06:26:20 dovecot_plain authenticator failed for ([58.228.105.192]) [58.228.105.192]:47104: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.158.72.138
country_id: 6251999
description:
Feb  6 06:27:35 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.158.72.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.246.49.99
country_id: 1269750
description:
Feb  6 06:27:24 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.246.49.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.167.55.230
country_id: 933860
description:
Feb  6 06:27:29 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.167.55.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
country_id: 933860
description:
2025-02-06 06:27:31 dovecot_plain authenticator failed for ([168.167.55.230]) [168.167.55.230]:42157: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.248.110.43
country_id: 192950
description:
[2025-02-06 06:27:09 +0100] info [webmaild] 197.248.110.43 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.133.203.228
country_id: 1210997
description:
[2025-02-06 06:27:11 +0100] info [webmaild] 103.133.203.228 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.86.87
country_id: 6252001
description:
2025-02-06 06:27:18 dovecot_plain authenticator failed for c-73-199-86-87.hsd1.nj.comcast.net (comisphae) [73.199.86.87]:40546: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.158.72.138
country_id: 6251999
description:
2025-02-06 06:27:37 dovecot_plain authenticator failed for 67-158-72-138.dhcp.execulink.com [67.158.72.138]:39074: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
country_id: 1269750
description:
2025-02-06 06:26:39 dovecot_plain authenticator failed for (abts-north-static-046.68.160.122.airtelbroadband.in) [122.160.68.46]:60042: 535 Incorrect authentication data (set_id=abs18a00023y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.199.86.87
country_id: 6252001
description:
Feb  6 06:27:16 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.199.86.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.246.49.99
country_id: 1269750
description:
2025-02-06 06:27:26 dovecot_plain authenticator failed for (abts-mp-static-185.120.168.122.airtelbroadband.in) [115.246.49.99]:56916: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 8.219.139.55
country_id: 1880251
description:
[2025-02-06 06:27:47 +0100] info [webmaild] 8.219.139.55 - ads19a00020y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user ads19a00020y (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
country_id: 3469034
description:
2025-02-06 06:27:48 dovecot_plain authenticator failed for ([177.6.235.62]) [177.6.235.62]:53409: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.114.194.46
country_id: 1814991
description:
Feb  6 06:28:28 ait sshd[1014971]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.114.194.46  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.114.194.46
country_id: 1814991
description:
Feb  6 06:28:28 ait sshd[1014971]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.114.194.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.179.102.182
country_id: 1814991
description:
Feb  6 06:27:45 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.179.102.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.118.26.100
country_id: 1668284
description:
Feb  6 06:27:48 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.118.26.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.229.1.186
country_id: 6252001
description:
Feb  6 06:27:53 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.229.1.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.108.165
country_id: 1814991
description:
Feb  6 06:27:58 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.108.165 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.98.130.137
country_id: 1282988
description:
[2025-02-06 06:28:12 +0100] info [webmaild] 103.98.130.137 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Feb  6 06:28:25 ait sshd[1014947]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.224.223.44
country_id: 2464461
description:
[2025-02-06 06:27:44 +0100] info [webmaild] 196.224.223.44 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2025-02-06 06:27:55 dovecot_plain authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:39146: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.179.102.182
country_id: 1814991
description:
2025-02-06 06:27:47 dovecot_plain authenticator failed for ([163.179.102.182]) [163.179.102.182]:54276: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.108.165
country_id: 1814991
description:
2025-02-06 06:28:00 dovecot_plain authenticator failed for ([116.116.108.165]) [116.116.108.165]:33815: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.136.192.106
country_id: 1733045
description:
Feb  6 06:28:11 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.136.192.106 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.109.27.194
country_id: 2017370
description:
Feb  6 06:28:14 ait sshd[1014927]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.109.27.194  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.136.192.106
country_id: 1733045
description:
2025-02-06 06:28:13 dovecot_plain authenticator failed for ([175.136.192.106]) [175.136.192.106]:42298: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.168.173.87
country_id: 3175395
description:
Feb  6 06:28:15 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.168.173.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.45.218.48
country_id: 2017370
description:
2025-02-06 06:28:25 dovecot_plain authenticator failed for ([46.45.218.48]) [46.45.218.48]:54386: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.235.62
country_id: 3469034
description:
Feb  6 06:27:46 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.235.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
country_id: 2017370
description:
2025-02-06 06:28:00 dovecot_plain authenticator failed for ([212.120.163.110]) [212.120.163.110]:34563: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.45.218.48
country_id: 2017370
description:
Feb  6 06:28:23 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.45.218.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.120.163.110
country_id: 2017370
description:
Feb  6 06:27:58 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.120.163.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.109.27.194
country_id: 2017370
description:
Feb  6 06:28:14 ait sshd[1014927]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.109.27.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.168.173.87
country_id: 3175395
description:
2025-02-06 06:28:17 dovecot_plain authenticator failed for (witabilles) [185.168.173.87]:45096: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.52.238
country_id: 1880251
description:
47.128.52.238 - - [06/Feb/2025:06:28:58 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11780149 HTTP/2.0" 302 0 ait-edu.us "https://ait-edu.us/ait/quickLink.php?menu=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.52.238


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 06:28:43 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.62.19.228
country_id: 3585968
description:
[2025-02-06 06:28:49 +0100] info [webmaild] 190.62.19.228 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.216.176.90
country_id: 6252001
description:
Feb  6 06:30:28 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.216.176.90 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.76.250.194
country_id: 1269750
description:
Feb  6 06:29:43 ait sshd[1015316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.250.194


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.245.199.205
country_id: 290557
description:
[2025-02-06 06:29:52 +0100] info [webmaild] 37.245.199.205 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.76.250.194
country_id: 1269750
description:
Feb  6 06:29:43 ait sshd[1015316]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.76.250.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.216.176.90
country_id: 6252001
description:
2025-02-06 06:30:30 dovecot_login authenticator failed for 32-216-176-90.bng02.brpt.ct.frontiernet.net [32.216.176.90]:64678: 535 Incorrect authentication data (set_id=iric)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.165.251
country_id: 1835841
description:
2025-02-06 06:30:08 dovecot_login authenticator failed for ([211.178.165.251]) [211.178.165.251]:34344: 535 Incorrect authentication data (set_id=iric@aitopen.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.49.30.13
country_id: 3658394
description:
[2025-02-06 06:30:28 +0100] info [webmaild] 179.49.30.13 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.114.166
country_id: 1880251
description:
47.128.114.166 - - [06/Feb/2025:06:29:44 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17196508 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/3/?duration=short%2Clong&filtering=1&instructor=2&level=beginner%2Cintermediate%2Cexpert" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.114.166


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.110.77
country_id: 6252001
description:
Feb  6 06:30:53 ait sshd[1015721]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.110.77  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.183.167.41
country_id: 1605651
description:
Feb  6 06:31:25 ait sshd[1015985]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.183.167.41


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.212.54
country_id: 2921044
description:
Feb  6 06:31:38 ait sshd[1016022]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.212.54  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.101.36.159
country_id: 2963597
description:
Feb  6 06:31:17 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.101.36.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-02-06 06:31:19 dovecot_plain authenticator failed for (089-101-036159.ntlworld.ie) [89.101.36.159]:38721: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.74.208.2
country_id: 298795
description:
[2025-02-06 06:31:26 +0100] info [webmaild] 213.74.208.2 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.108.165
country_id: 1814991
description:
Feb  6 06:30:43 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.108.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.110.77
country_id: 6252001
description:
Feb  6 06:30:53 ait sshd[1015721]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.110.77 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.224.170.24
country_id: 298795
description:
[2025-02-06 06:30:57 +0100] info [webmaild] 91.224.170.24 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.170.98.139
country_id: 1269750
description:
Feb  6 06:30:59 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.170.98.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.108.165
country_id: 1814991
description:
2025-02-06 06:30:45 dovecot_plain authenticator failed for ([116.116.108.165]) [116.116.108.165]:46185: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.241.150
country_id: 1814991
description:
2025-02-06 06:31:18 dovecot_plain authenticator failed for ([61.143.241.150]) [61.143.241.150]:43293: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 06:31:24 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.212.54
country_id: 2921044
description:
Feb  6 06:31:38 ait sshd[1016022]: pam_imunify(sshd:auth): [IM360_RBL] The IP 139.59.212.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.98.139
country_id: 1269750
description:
2025-02-06 06:31:01 dovecot_plain authenticator failed for (abts-mum-static-139.98.170.122.airtelbroadband.in) [122.170.98.139]:59770: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.36.64.247
country_id: 3175395
description:
Feb  6 06:31:11 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.36.64.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.36.64.247
country_id: 3175395
description:
2025-02-06 06:31:13 dovecot_plain authenticator failed for net-2-36-64-247.cust.vodafonedsl.it (lilippet) [2.36.64.247]:39665: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.241.150
country_id: 1814991
description:
Feb  6 06:31:16 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.241.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.183.167.41
country_id: 1605651
description:
Feb  6 06:31:25 ait sshd[1015985]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.183.167.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 06:32:05 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.165.203
country_id: 1814991
description:
2025-02-06 06:32:12 dovecot_plain authenticator failed for ([183.236.165.203]) [183.236.165.203]:38135: 535 Incorrect authentication data (set_id=ads19b00188y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.48.194.21
country_id: 1562822
description:
Feb  6 06:32:16 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.48.194.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.178.174.118
country_id: 3469034
description:
[2025-02-06 06:32:31 +0100] info [webmaild] 191.178.174.118 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.255.34.171
country_id: 2017370
description:
Feb  6 06:31:46 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.255.34.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 06:31:47 ait sshd[1016051]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.255.34.171
country_id: 2017370
description:
2025-02-06 06:31:48 dovecot_plain authenticator failed for broadband-188-255-34-171.ip.moscow.rt.ru [188.255.34.171]:52674: 535 Incorrect authentication data (set_id=ads19b00188y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.194.21
country_id: 1562822
description:
2025-02-06 06:32:18 dovecot_plain authenticator failed for ([103.48.194.21]) [103.48.194.21]:60522: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.90.141.147
country_id: 1814991
description:
Feb  6 06:32:36 ait sshd[1016396]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.90.141.147 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.90.141.147
country_id: 1814991
description:
Feb  6 06:32:36 ait sshd[1016396]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.90.141.147  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 06:31:47 ait sshd[1016051]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.165.203
country_id: 1814991
description:
Feb  6 06:32:10 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.165.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.144.100.159
country_id: 6252001
description:
Feb  6 06:32:29 ait sshd[1016390]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.144.100.159 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.144.100.159
country_id: 6252001
description:
Feb  6 06:32:29 ait sshd[1016390]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.144.100.159  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.29.24.171
country_id: 1527747
description:
[2025-02-06 06:33:06 +0100] info [webmaild] 217.29.24.171 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.43.231.186
country_id: 3175395
description:
Feb  6 06:32:41 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.43.231.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.250.93.159
country_id: 1814991
description:
Feb  6 06:33:18 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.250.93.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.125.43
country_id: 1835841
description:
Feb  6 06:33:28 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.125.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.174.233.64
country_id: 2661886
description:
2025-02-06 06:32:45 dovecot_plain authenticator failed for h-158-174-233-64.a192.priv.bahnhof.se [158.174.233.64]:60811: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-32.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.91.84.89
country_id: 3469034
description:
2025-02-06 06:32:57 dovecot_plain authenticator failed for ([187.92.76.49]) [201.91.84.89]:58974: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.250.93.159
country_id: 1814991
description:
2025-02-06 06:33:20 dovecot_plain authenticator failed for ([114.250.93.159]) [114.250.93.159]:5894: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.230.252.103
country_id: 1814991
description:
2025-02-06 06:33:21 dovecot_plain authenticator failed for ([183.230.252.103]) [183.230.252.103]:45094: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.174.233.64
country_id: 2661886
description:
Feb  6 06:32:43 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.174.233.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.224.55.22
country_id: 1835841
description:
Feb  6 06:32:47 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.224.55.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.224.55.22
country_id: 1835841
description:
2025-02-06 06:32:49 dovecot_plain authenticator failed for ([58.224.55.22]) [58.224.55.22]:52558: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.84.89
country_id: 3469034
description:
Feb  6 06:32:55 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.84.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.77.136
country_id: 2963597
description:
2025-02-06 06:33:00 dovecot_plain authenticator failed for ([80.233.77.136]) [80.233.77.136]:3336: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.125.43
country_id: 1835841
description:
2025-02-06 06:33:30 dovecot_plain authenticator failed for ([14.37.125.43]) [14.37.125.43]:36573: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.147.184
country_id: 3469034
description:
2025-02-06 06:32:42 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.147.184]:55214: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.22.166
country_id: 1880251
description:
47.128.22.166 - - [06/Feb/2025:06:33:00 +0100] "GET /images/facebook.png HTTP/2.0" 415 176 mail.ait-edu.us "https://mail.ait-edu.us/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7180761" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.22.166


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.26.63.158
country_id: 1814991
description:
2025-02-06 06:33:03 dovecot_plain authenticator failed for ([36.26.63.158]) [36.26.63.158]:36284: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.129.114.190
country_id: 798544
description:
2025-02-06 06:32:48 dovecot_plain authenticator failed for ([185.129.114.190]) [185.129.114.190]:47156: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.43.231.186
country_id: 3175395
description:
2025-02-06 06:32:43 dovecot_plain authenticator failed for host-88-43-231-186.business.telecomitalia.it ([88.43.231.188]) [88.43.231.186]:58942: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.129.114.190
country_id: 798544
description:
Feb  6 06:32:46 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.129.114.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 06:32:53 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.63
country_id: 1819730
description:
Feb  6 06:32:57 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.233.77.136
country_id: 2963597
description:
Feb  6 06:32:58 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.233.77.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.63
country_id: 1819730
description:
2025-02-06 06:32:59 dovecot_plain authenticator failed for (m121-202-154-63.smartone.com) [121.202.154.63]:18922: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.26.63.158
country_id: 1814991
description:
Feb  6 06:33:01 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.26.63.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.147.184
country_id: 3469034
description:
Feb  6 06:32:40 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.147.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.230.252.103
country_id: 1814991
description:
Feb  6 06:33:19 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.230.252.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.235.203.63
country_id: 6252001
description:
2025-02-06 06:33:41 dovecot_plain authenticator failed for 108-235-203-63.lightspeed.chrlnc.sbcglobal.net [108.235.203.63]:64443: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.68.22.140
country_id: 1269750
description:
Feb  6 06:34:34 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.68.22.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.10.53.109
country_id: 1562822
description:
Feb  6 06:33:40 ait sshd[1016644]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.10.53.109 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.66.225.150
country_id: 3469034
description:
[2025-02-06 06:33:44 +0100] info [webmaild] 187.66.225.150 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.233.41.172
country_id: 3865483
description:
[2025-02-06 06:34:16 +0100] info [webmaild] 181.233.41.172 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.107.135.197
country_id: 1814991
description:
Feb  6 06:34:32 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.107.135.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.235.203.63
country_id: 6252001
description:
Feb  6 06:33:39 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.235.203.63 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.10.53.109
country_id: 1562822
description:
Feb  6 06:33:40 ait sshd[1016644]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.10.53.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.221.65.24
country_id: 2413451
description:
Feb  6 06:34:53 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.221.65.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.71.254.162
country_id: 1814991
description:
2025-02-06 06:35:20 dovecot_plain authenticator failed for ([223.71.254.162]) [223.71.254.162]:41934: 535 Incorrect authentication data (set_id=paakow2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.143.206
country_id: 1814991
description:
Feb  6 06:35:10 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.143.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.154.175
country_id: 3469034
description:
Feb  6 06:35:21 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.154.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.22.116.38
country_id: 6252001
description:
2025-02-06 06:35:17 dovecot_plain authenticator failed for ([134.22.116.38]) [134.22.116.38]:39828: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.34
country_id: 1269750
description:
Feb  6 06:35:18 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.67
country_id: 1814991
description:
Feb  6 06:35:19 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
country_id: 690791
description:
2025-02-06 06:34:41 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (tamed) [92.244.126.105]:48947: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-02-06 06:34:44 dovecot_plain authenticator failed for (189-56-191-126.customer.tdatabrasil.net.br) [189.44.133.238]:35679: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.65.24
country_id: 2413451
description:
2025-02-06 06:34:55 dovecot_plain authenticator failed for ([102.221.65.24]) [102.221.65.24]:47214: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.203.245.102
country_id: 1835841
description:
Feb  6 06:35:05 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.203.245.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-02-06 06:35:29 dovecot_plain authenticator failed for ([194.31.8.12]) [194.31.8.12]:58742: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.133.238
country_id: 3469034
description:
Feb  6 06:34:42 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.74
country_id: 2077456
description:
Feb  6 06:34:51 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.22.116.38
country_id: 6252001
description:
Feb  6 06:35:15 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.22.116.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.244.126.105
country_id: 690791
description:
Feb  6 06:34:39 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.244.126.105 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 35.200.168.8
country_id: 1269750
description:
Feb  6 06:35:13 ait sshd[1017209]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.200.168.8


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.71.254.162
country_id: 1814991
description:
Feb  6 06:35:18 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.71.254.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.16.85.102
country_id: 718075
description:
Feb  6 06:35:23 ait sshd[1017222]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.16.85.102 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.16.85.102
country_id: 718075
description:
Feb  6 06:35:23 ait sshd[1017222]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.16.85.102


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.74
country_id: 2077456
description:
2025-02-06 06:34:53 dovecot_plain authenticator failed for ([203.189.124.74]) [203.189.124.74]:49725: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
country_id: 1269750
description:
2025-02-06 06:35:20 dovecot_plain authenticator failed for (nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:55439: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
country_id: 3469034
description:
2025-02-06 06:35:23 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.154.175]:42112: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.31.8.12
country_id: 614540
description:
Feb  6 06:35:27 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.31.8.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.200.168.8
country_id: 1269750
description:
Feb  6 06:35:13 ait sshd[1017209]: pam_imunify(sshd:auth): [IM360_RBL] The IP 35.200.168.8 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.160.72.124
country_id: 3996063
description:
[2025-02-06 06:35:23 +0100] info [webmaild] 189.160.72.124 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.114.206
country_id: 1814991
description:
2025-02-06 06:36:00 dovecot_plain authenticator failed for ([39.152.114.206]) [39.152.114.206]:36946: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.156.198
country_id: 1814991
description:
Feb  6 06:35:50 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.156.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
country_id: 294640
description:
Feb  6 06:35:50 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.194.181.238
country_id: 1835841
description:
2025-02-06 06:35:50 dovecot_plain authenticator failed for ([175.194.181.238]) [175.194.181.238]:63218: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
country_id: 294640
description:
2025-02-06 06:35:52 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (pecarce) [109.67.154.24]:35424: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.114.206
country_id: 1814991
description:
Feb  6 06:35:58 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.114.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.246.43
country_id: 1814991
description:
Feb  6 06:36:01 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.246.43 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 06:36:02 ait sshd[1017511]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.29
country_id: 1814991
description:
Feb  6 06:35:39 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.29 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.222.242.37
country_id: 953987
description:
[2025-02-06 06:36:02 +0100] info [webmaild] 102.222.242.37 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.189.234.28
country_id: 6252001
description:
Feb  6 06:35:43 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.189.234.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.97
country_id: 3469034
description:
2025-02-06 06:35:46 dovecot_plain authenticator failed for ([179.185.1.97]) [179.185.1.97]:44612: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.194.181.238
country_id: 1835841
description:
Feb  6 06:35:48 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.194.181.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 06:36:02 ait sshd[1017511]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.236.45.77
country_id: 783754
description:
[2025-02-06 06:36:06 +0100] info [webmaild] 109.236.45.77 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.29
country_id: 1814991
description:
2025-02-06 06:35:41 dovecot_plain authenticator failed for ([117.175.160.29]) [117.175.160.29]:52590: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.1.97
country_id: 3469034
description:
Feb  6 06:35:44 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.1.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
country_id: 1814991
description:
2025-02-06 06:36:03 dovecot_plain authenticator failed for ([220.178.246.43]) [220.178.246.43]:53162: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.134.141.43
country_id: 1227603
description:
2025-02-06 06:35:42 dovecot_plain authenticator failed for ([124.43.78.147]) [112.134.141.43]:48508: 535 Incorrect authentication data (set_id=paakow2)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 172.104.137.177
country_id: 2921044
description:
Feb  6 06:36:40 ait sshd[1017584]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.104.137.177  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.75.30.6
country_id: 1814991
description:
Feb  6 06:37:30 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.75.30.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.75.30.6
country_id: 1814991
description:
2025-02-06 06:37:32 dovecot_plain authenticator failed for ([218.75.30.6]) [218.75.30.6]:35484: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
country_id: 6252001
description:
Feb  6 06:37:03 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
country_id: 6252001
description:
2025-02-06 06:37:05 dovecot_login authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:47234: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.22.214.214
country_id: 1269750
description:
Feb  6 06:36:53 ait sshd[1017712]: pam_imunify(sshd:auth): [IM360_RBL] The IP 165.22.214.214 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.53.165
country_id: 1880251
description:
47.128.53.165 - - [06/Feb/2025:06:36:58 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=8675597 HTTP/2.0" 302 0 www.ait-edu.us "https://www.ait-edu.us/admissionlist.php" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.53.165


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.104.137.177
country_id: 2921044
description:
Feb  6 06:36:40 ait sshd[1017584]: pam_imunify(sshd:auth): [IM360_RBL] The IP 172.104.137.177 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.125.204
country_id: 3469034
description:
[2025-02-06 06:36:43 +0100] info [webmaild] 45.70.125.204 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.159
country_id: 1861060
description:
Feb  6 06:36:51 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.159 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.22.214.214
country_id: 1269750
description:
Feb  6 06:36:53 ait sshd[1017712]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.214.214  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.159
country_id: 1861060
description:
2025-02-06 06:36:53 dovecot_login authenticator failed for p7001160-ipoefx.ipoe.ocn.ne.jp [118.3.227.159]:33302: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
country_id: 1562822
description:
2025-02-06 06:38:04 dovecot_login authenticator failed for ([171.244.40.236]) [171.244.40.236]:51121: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
country_id: 1814991
description:
Feb  6 06:38:21 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.46.163.64
country_id: 2017370
description:
2025-02-06 06:37:43 dovecot_plain authenticator failed for ([178.46.163.64]) [178.46.163.64]:39667: 535 Incorrect authentication data (set_id=adams@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
country_id: 1835841
description:
2025-02-06 06:37:49 dovecot_login authenticator failed for ([175.202.82.16]) [175.202.82.16]:57404: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.206.91.51
country_id: 597427
description:
Feb  6 06:37:52 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.206.91.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.206
country_id: 1835841
description:
Feb  6 06:37:54 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.206.91.51
country_id: 597427
description:
2025-02-06 06:37:54 dovecot_plain authenticator failed for (85-206-91-51.static.zebra.lt) [85.206.91.51]:41548: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.229.51.206
country_id: 1835841
description:
2025-02-06 06:37:56 dovecot_plain authenticator failed for ([58.229.51.206]) [58.229.51.206]:60896: 535 Incorrect authentication data (set_id=adams)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.146.112.95
country_id: 587116
description:
[2025-02-06 06:38:09 +0100] info [webmaild] 185.146.112.95 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.46.163.64
country_id: 2017370
description:
Feb  6 06:37:41 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.46.163.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
country_id: 1835841
description:
Feb  6 06:37:47 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
country_id: 1562822
description:
Feb  6 06:38:02 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
country_id: 1814991
description:
2025-02-06 06:38:23 dovecot_plain authenticator failed for ([218.98.26.226]) [58.216.101.162]:52951: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.161.166.113
country_id: 3017382
description:
Feb  6 06:38:51 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.161.166.113 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.168.58.245
country_id: 1562822
description:
Feb  6 06:38:54 ait sshd[1018327]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.168.58.245  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.226.246
country_id: 99237
description:
2025-02-06 06:38:57 dovecot_plain authenticator failed for (ourism) [65.20.226.246]:59951: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.232.218.168
country_id: 3469034
description:
[2025-02-06 06:39:02 +0100] info [webmaild] 45.232.218.168 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.161.166.113
country_id: 3017382
description:
2025-02-06 06:38:53 dovecot_plain authenticator failed for static-css-csu-166113.business.bouyguestelecom.com [176.161.166.113]:40692: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 06:39:26 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.93
country_id: 1819730
description:
Feb  6 06:39:03 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.93 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.38.166.102
country_id: 3469034
description:
[2025-02-06 06:39:36 +0100] info [webmaild] 189.38.166.102 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.69.181.25
country_id: 3658394
description:
[2025-02-06 06:38:45 +0100] info [webmaild] 186.69.181.25 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.23.227
country_id: 1880251
description:
47.128.23.227 - - [06/Feb/2025:06:39:31 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23693869 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/main/index.php?Itemid=259&id=198&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.23.227


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.168.58.245
country_id: 1562822
description:
Feb  6 06:38:54 ait sshd[1018327]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.168.58.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.226.246
country_id: 99237
description:
Feb  6 06:38:55 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.226.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.93
country_id: 1819730
description:
2025-02-06 06:39:05 dovecot_plain authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:32262: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.202.139.244
country_id: 1835841
description:
2025-02-06 06:40:08 dovecot_login authenticator failed for ([119.202.139.244]) [119.202.139.244]:37893: 535 Incorrect authentication data (set_id=mail@aitlemass.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.96
country_id: 1814991
description:
Feb  6 06:40:28 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.165.182.203
country_id: 6252001
description:
2025-02-06 06:40:06 dovecot_plain authenticator failed for (173-165-182-203-atlanta.hfc.comcastbusiness.net) [173.165.182.203]:34413: 535 Incorrect authentication data (set_id=abio17@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.253
country_id: 99237
description:
2025-02-06 06:39:59 dovecot_plain authenticator failed for (asatendull) [65.20.129.253]:48156: 535 Incorrect authentication data (set_id=eng20a00070y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.176.149.10
country_id: 1269750
description:
Feb  6 06:40:18 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.176.149.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.96
country_id: 1814991
description:
2025-02-06 06:40:30 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:46684: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.253
country_id: 99237
description:
Feb  6 06:39:57 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.165.182.203
country_id: 6252001
description:
Feb  6 06:40:04 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.165.182.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2025-02-06 06:40:27 dovecot_login authenticator failed for ([220.80.223.144]) [220.80.223.144]:58080: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.150.40.63
country_id: 2661886
description:
2025-02-06 06:39:56 dovecot_plain authenticator failed for c188-150-40-63.bredband.tele2.se (adelarre) [188.150.40.63]:42628: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.202.139.244
country_id: 1835841
description:
Feb  6 06:40:06 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.202.139.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.149.10
country_id: 1269750
description:
2025-02-06 06:40:20 dovecot_plain authenticator failed for (abts-north-dynamic-010.149.176.122.airtelbroadband.in) [122.176.149.10]:40671: 535 Incorrect authentication data (set_id=abio17)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
country_id: 1835841
description:
Feb  6 06:40:25 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.150.40.63
country_id: 2661886
description:
Feb  6 06:39:54 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.150.40.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.146.121.12
country_id: 1814991
description:
Feb  6 06:40:43 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.146.121.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.113.3.87
country_id: 1269750
description:
Feb  6 06:41:28 ait sshd[1019236]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.113.3.87 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.113.3.87
country_id: 1269750
description:
Feb  6 06:41:28 ait sshd[1019236]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.113.3.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.146.121.12
country_id: 1814991
description:
2025-02-06 06:40:45 dovecot_plain authenticator failed for ([61.146.121.12]) [61.146.121.12]:32848: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.219.165.250
country_id: 3469034
description:
[2025-02-06 06:40:58 +0100] info [webmaild] 138.219.165.250 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.129.191.25
country_id: 3469034
description:
[2025-02-06 06:41:36 +0100] info [webmaild] 177.129.191.25 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.248.27.95
country_id: 2921044
description:
Feb  6 06:41:44 ait sshd[1019263]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.27.95  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.157.107.67
country_id: 2921044
description:
Feb  6 06:41:51 ait sshd[1019269]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.157.107.67  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.90.141.147
country_id: 1814991
description:
Feb  6 06:42:27 ait sshd[1019542]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.90.141.147


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.157.107.67
country_id: 2921044
description:
Feb  6 06:41:51 ait sshd[1019269]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.157.107.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.90.141.147
country_id: 1814991
description:
Feb  6 06:42:27 ait sshd[1019542]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.90.141.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.5.250.68
country_id: 3469034
description:
[2025-02-06 06:41:45 +0100] info [webmaild] 45.5.250.68 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.108.61.83
country_id: 3469034
description:
[2025-02-06 06:42:16 +0100] info [webmaild] 179.108.61.83 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.248.27.95
country_id: 2921044
description:
Feb  6 06:41:44 ait sshd[1019263]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.248.27.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.98
country_id: 290557
description:
Feb  6 06:43:33 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.98 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.150.203.154
country_id: 3469034
description:
[2025-02-06 06:43:35 +0100] info [webmaild] 170.150.203.154 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.98
country_id: 290557
description:
2025-02-06 06:43:35 dovecot_login authenticator failed for ([5.32.107.98]) [5.32.107.98]:42982: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.17.133.112
country_id: 3469034
description:
[2025-02-06 06:44:24 +0100] info [webmaild] 191.17.133.112 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.192.69.10
country_id: 1835841
description:
Feb  6 06:43:59 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.192.69.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.135.250.242
country_id: 6252001
description:
2025-02-06 06:43:47 dovecot_login authenticator failed for syn-035-135-250-242.res.spectrum.com [35.135.250.242]:41210: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.254.158
country_id: 1210997
description:
Feb  6 06:44:24 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.254.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.254.158
country_id: 1210997
description:
2025-02-06 06:44:26 dovecot_plain authenticator failed for ([103.115.254.158]) [103.115.254.158]:38139: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.73.47.13
country_id: 3469034
description:
[2025-02-06 06:44:11 +0100] info [webmaild] 177.73.47.13 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.135.250.242
country_id: 6252001
description:
Feb  6 06:43:45 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.135.250.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.139.88.148
country_id: 2510769
description:
Feb  6 06:43:50 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.139.88.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.88.148
country_id: 2510769
description:
2025-02-06 06:43:52 dovecot_plain authenticator failed for 148.red-2-139-88.dynamicip.rima-tde.net (nestion) [2.139.88.148]:50926: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.192.69.10
country_id: 1835841
description:
2025-02-06 06:44:01 dovecot_plain authenticator failed for ([113.192.69.10]) [113.192.69.10]:52282: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.7.109.160
country_id: 6252001
description:
Feb  6 06:45:20 ait sshd[1020411]: pam_imunify(sshd:auth): [IM360_RBL] The IP 200.7.109.160 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 200.7.109.160
country_id: 6252001
description:
Feb  6 06:45:20 ait sshd[1020411]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.7.109.160


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
country_id: 1835841
description:
Feb  6 06:45:23 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.249.163.4
country_id: 6251999
description:
2025-02-06 06:44:42 dovecot_plain authenticator failed for ([162.249.163.4]) [162.249.163.4]:56379: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-02-06 06:45:11 dovecot_login authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:51691: 535 Incorrect authentication data (set_id=mail@ait-edu.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.129.236.174
country_id: 1814991
description:
2025-02-06 06:45:05 dovecot_plain authenticator failed for ([219.129.236.174]) [219.129.236.174]:42245: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.182.119.202
country_id: 3658394
description:
Feb  6 06:45:32 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.182.119.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.156.230.74
country_id: 3686110
description:
[2025-02-06 06:44:54 +0100] info [webmaild] 38.156.230.74 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.129.236.174
country_id: 1814991
description:
Feb  6 06:45:03 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.129.236.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
country_id: 1835841
description:
2025-02-06 06:45:25 dovecot_login authenticator failed for ([175.202.82.16]) [175.202.82.16]:45174: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.182.119.202
country_id: 3658394
description:
2025-02-06 06:45:34 dovecot_plain authenticator failed for ([45.182.119.202]) [45.182.119.202]:36338: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.249.163.4
country_id: 6251999
description:
Feb  6 06:44:40 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.249.163.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.227
country_id: 1819730
description:
Feb  6 06:45:09 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.232.117
country_id: 6252001
description:
Feb  6 06:46:24 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.232.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.40.155
country_id: 1814991
description:
Feb  6 06:45:46 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.40.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.247.54
country_id: 630336
description:
2025-02-06 06:45:50 dovecot_plain authenticator failed for (mm-54-247-209-82.adsl.mgts.by) [82.209.247.54]:37224: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.122.98.135
country_id: 1835841
description:
Feb  6 06:46:06 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.122.98.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.138.69
country_id: 1819730
description:
Feb  6 06:46:17 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.138.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2025-02-06 06:46:19 dovecot_plain authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:52367: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.34.158.19
country_id: 3144096
description:
Feb  6 06:45:55 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.34.158.19 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 66.181.185.227
country_id: 2029969
description:
[2025-02-06 06:46:05 +0100] info [webmaild] 66.181.185.227 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.247.227.109
country_id: 1814991
description:
2025-02-06 06:46:26 dovecot_plain authenticator failed for ([223.247.227.109]) [223.247.227.109]:46834: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.174.3.182
country_id: 2658434
description:
2025-02-06 06:46:34 dovecot_plain authenticator failed for 182.3.174.178.static.wline.lns.sme.cust.swisscom.ch [178.174.3.182]:46295: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.40.155
country_id: 1814991
description:
2025-02-06 06:45:48 dovecot_plain authenticator failed for ([60.174.40.155]) [60.174.40.155]:47123: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.34.158.19
country_id: 3144096
description:
2025-02-06 06:45:57 dovecot_plain authenticator failed for ti0004q160-7861.bb.online.no [95.34.158.19]:47874: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.122.98.135
country_id: 1835841
description:
2025-02-06 06:46:08 dovecot_plain authenticator failed for ([222.122.98.135]) [222.122.98.135]:54802: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.209.247.54
country_id: 630336
description:
Feb  6 06:45:48 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.209.247.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.247.227.109
country_id: 1814991
description:
Feb  6 06:46:24 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.247.227.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.232.117
country_id: 6252001
description:
2025-02-06 06:46:26 dovecot_login authenticator failed for ([104.241.232.117]) [104.241.232.117]:52481: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.174.3.182
country_id: 2658434
description:
Feb  6 06:46:32 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.174.3.182 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.54.89.232
country_id: 3469034
description:
[2025-02-06 06:46:42 +0100] info [webmaild] 177.54.89.232 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.134.109.253
country_id: 1814991
description:
Feb  6 06:46:55 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.134.109.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.134.109.253
country_id: 1814991
description:
2025-02-06 06:46:57 dovecot_plain authenticator failed for ([124.134.109.253]) [124.134.109.253]:45756: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.15.33.249
country_id: 3686110
description:
[2025-02-06 06:47:01 +0100] info [webmaild] 179.15.33.249 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.235.82.88
country_id: 1835841
description:
2025-02-06 06:47:06 dovecot_plain authenticator failed for ([222.235.82.88]) [222.235.82.88]:42156: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.0.186.121
country_id: 1814991
description:
Feb  6 06:47:06 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.0.186.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.0.127.202
country_id: 1814991
description:
2025-02-06 06:46:42 dovecot_login authenticator failed for ([111.0.127.202]) [111.0.127.202]:44944: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.21.191.178
country_id: 3175395
description:
Feb  6 06:47:31 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.21.191.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.21.191.178
country_id: 3175395
description:
2025-02-06 06:47:33 dovecot_plain authenticator failed for host-79-21-191-178.retail.telecomitalia.it [79.21.191.178]:56218: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.65.68.104
country_id: 732800
description:
2025-02-06 06:47:10 dovecot_plain authenticator failed for ([45.65.68.104]) [45.65.68.104]:35070: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.196.67
country_id: 2510769
description:
Feb  6 06:46:53 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.126.196.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.192.247.84
country_id: 1269750
description:
Feb  6 06:47:05 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.192.247.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.65.68.104
country_id: 732800
description:
Feb  6 06:47:08 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.65.68.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.29.232.113
country_id: 1605651
description:
Feb  6 06:46:43 ait sshd[1020836]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.29.232.113  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.196.67
country_id: 2510769
description:
2025-02-06 06:46:55 dovecot_plain authenticator failed for (cli-5b7ec443.ast.adamo.es) [91.126.196.67]:33326: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.247.84
country_id: 1269750
description:
2025-02-06 06:47:07 dovecot_plain authenticator failed for ([203.192.247.84]) [203.192.247.84]:47002: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.124.232.202
country_id: 1522867
description:
[2025-02-06 06:47:32 +0100] info [webmaild] 188.124.232.202 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-46.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.29.232.113
country_id: 1605651
description:
Feb  6 06:46:43 ait sshd[1020836]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.29.232.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.235.82.88
country_id: 1835841
description:
Feb  6 06:47:04 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.235.82.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.0.186.121
country_id: 1814991
description:
2025-02-06 06:47:08 dovecot_plain authenticator failed for ([153.0.186.121]) [153.0.186.121]:34114: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.39.230.40
country_id: 1835841
description:
Feb  6 06:47:15 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.39.230.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.39.230.40
country_id: 1835841
description:
2025-02-06 06:47:17 dovecot_plain authenticator failed for ([118.39.230.40]) [118.39.230.40]:4203: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.0.127.202
country_id: 1814991
description:
Feb  6 06:46:40 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.0.127.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.84.62.149
country_id: 3996063
description:
Feb  6 06:47:57 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.84.62.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.112.154.174
country_id: 1269750
description:
Feb  6 06:48:13 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.112.154.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.112.154.174
country_id: 1269750
description:
2025-02-06 06:48:15 dovecot_login authenticator failed for ([203.112.154.174]) [203.112.154.174]:50264: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.4.255.205
country_id: 1835841
description:
Feb  6 06:47:55 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.4.255.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.4.255.205
country_id: 1835841
description:
2025-02-06 06:47:57 dovecot_plain authenticator failed for ([59.4.255.205]) [59.4.255.205]:51772: 535 Incorrect authentication data (set_id=nyarko@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.84.62.149
country_id: 3996063
description:
2025-02-06 06:47:59 dovecot_login authenticator failed for ([187.218.57.50]) [138.84.62.149]:40308: 535 Incorrect authentication data (set_id=mail@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.234
country_id: 1814991
description:
Feb  6 06:48:08 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.234
country_id: 1814991
description:
2025-02-06 06:48:10 dovecot_plain authenticator failed for ([116.114.84.234]) [116.114.84.234]:37514: 535 Incorrect authentication data (set_id=nyarko)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.232.19.79
country_id: 2750405
description:
Feb  6 06:48:50 ait sshd[1021426]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.232.19.79 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.115.125
country_id: 6252001
description:
Feb  6 06:48:51 ait sshd[1021428]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.115.125  user=root


