# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.6.250.109
country_id: 2635167
description:
Feb  7 08:12:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.6.250.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
country_id: 6252001
description:
Feb  7 08:11:35 ait sshd[1669142]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
country_id: 6252001
description:
Feb  7 08:11:35 ait sshd[1669142]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.6.250.109
country_id: 2635167
description:
2025-02-07 08:12:18 dovecot_login authenticator failed for 109.250.6.51.dyn.plus.net [51.6.250.109]:46378: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.4.150
country_id: 1814991
description:
2025-02-07 08:11:31 dovecot_plain authenticator failed for ([222.180.4.150]) [222.180.4.150]:39415: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.96.211.53
country_id: 298795
description:
2025-02-07 08:11:47 dovecot_plain authenticator failed for (WIN-BGU86CDI74S) [85.96.211.53]:55522: 535 Incorrect authentication data (set_id=eng22b00200y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.160.123.6
country_id: 732800
description:
Feb  7 08:12:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.160.123.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.160.123.6
country_id: 732800
description:
2025-02-07 08:12:08 dovecot_plain authenticator failed for (mulate) [109.160.123.6]:41056: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.255.135.74
country_id: 3469034
description:
Feb  7 08:12:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.255.135.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.255.135.74
country_id: 3469034
description:
2025-02-07 08:12:32 dovecot_login authenticator failed for (131-255-135-74.otinternet.com.br) [131.255.135.74]:37832: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.206.37
country_id: 1819730
description:
Feb  7 08:13:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.206.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.37
country_id: 1819730
description:
2025-02-07 08:13:18 dovecot_plain authenticator failed for (m121-202-206-37.smartone.com) [121.202.206.37]:9466: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.212.219
country_id: 3175395
description:
Feb  7 08:13:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.212.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.241.161
country_id: 1835841
description:
Feb  7 08:13:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.241.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.241.161
country_id: 1835841
description:
2025-02-07 08:13:16 dovecot_login authenticator failed for ([115.23.241.161]) [115.23.241.161]:34654: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
country_id: 3175395
description:
2025-02-07 08:13:16 dovecot_plain authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:51756: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.238.94
country_id: 3469034
description:
Feb  7 08:13:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.238.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.136.29.20
country_id: 1835841
description:
2025-02-07 08:13:33 dovecot_login authenticator failed for ([124.136.29.20]) [124.136.29.20]:35852: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.35.199.239
country_id: 2635167
description:
Feb  7 08:13:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.35.199.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.153.108
country_id: 1814991
description:
Feb  7 08:13:59 ait sshd[1670018]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.12.153.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2025-02-07 08:13:26 dovecot_plain authenticator failed for ([186.239.41.74]) [186.239.41.74]:60640: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.136.29.20
country_id: 1835841
description:
Feb  7 08:13:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.136.29.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.71.254.162
country_id: 1814991
description:
2025-02-07 08:13:36 dovecot_plain authenticator failed for ([223.71.254.162]) [223.71.254.162]:53661: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.35.199.239
country_id: 2635167
description:
2025-02-07 08:13:40 dovecot_plain authenticator failed for (199.35.89.239.bcube.co.uk) [89.35.199.239]:52620: 535 Incorrect authentication data (set_id=jpomador)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 173.249.147.129
country_id: 6252001
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:08-13.173.249.147.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.71.254.162
country_id: 1814991
description:
Feb  7 08:13:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.71.254.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.235.246
country_id: 2661886
description:
2025-02-07 08:14:08 dovecot_plain authenticator failed for h77-53-235-246.cust.bredband2.com [77.53.235.246]:35346: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
country_id: 1835841
description:
2025-02-07 08:14:21 dovecot_plain authenticator failed for ([211.105.213.144]) [211.105.213.144]:46938: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.235.246
country_id: 2661886
description:
Feb  7 08:14:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.235.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
country_id: 1835841
description:
Feb  7 08:14:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.74
country_id: 3469034
description:
Feb  7 08:13:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.238.94
country_id: 3469034
description:
2025-02-07 08:13:26 dovecot_plain authenticator failed for 186-247-238-94.user.veloxzone.com.br (186-247-238-241.user.veloxzone.com.br) [186.247.238.94]:53130: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 81.163.218.60
country_id: 690791
description:
[2025-02-07 08:13:59 +0100] info [webmaild] 81.163.218.60 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.12.153.108
country_id: 1814991
description:
Feb  7 08:13:59 ait sshd[1670018]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.153.108


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.207.213
country_id: 2413451
description:
2025-02-07 08:14:58 dovecot_login authenticator failed for (197-255-207-213.netpagedns.net) [197.255.207.213]:40322: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.94.242
country_id: 1814991
description:
Feb  7 08:15:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2025-02-07 08:15:13 dovecot_login authenticator failed for ([116.114.94.242]) [116.114.94.242]:34820: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.118.237.30
country_id: 3469034
description:
[2025-02-07 08:14:44 +0100] info [webmaild] 138.118.237.30 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.207.213
country_id: 2413451
description:
Feb  7 08:14:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.207.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.0.61.49
country_id: 1269750
description:
Feb  7 08:16:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.0.61.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.14.31.158
country_id: 3017382
description:
Feb  7 08:15:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.14.31.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 08:15:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.34.165.114
country_id: 6252001
description:
Feb  7 08:16:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.34.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.165.114
country_id: 6252001
description:
2025-02-07 08:16:02 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:50679: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.217.141.77
country_id: 6252001
description:
2025-02-07 08:16:07 dovecot_plain authenticator failed for (206-217-141-77-host.colocrossing.com) [206.217.141.77]:36744: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 08:15:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
country_id: 3017382
description:
2025-02-07 08:15:47 dovecot_plain authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr (feuhawle) [80.14.31.158]:34547: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.80.158
country_id: 1835841
description:
2025-02-07 08:15:49 dovecot_plain authenticator failed for ([222.114.80.158]) [222.114.80.158]:48838: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.223.187.146
country_id: 1814991
description:
Feb  7 08:15:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.223.187.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.80.158
country_id: 1835841
description:
Feb  7 08:15:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.80.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.0.61.49
country_id: 1269750
description:
2025-02-07 08:16:02 dovecot_login authenticator failed for ([27.0.61.49]) [27.0.61.49]:56610: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 08:15:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.223.187.146
country_id: 1814991
description:
2025-02-07 08:15:47 dovecot_login authenticator failed for ([222.223.187.146]) [222.223.187.146]:35332: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.217.141.77
country_id: 6252001
description:
Feb  7 08:16:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.217.141.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.124.180
country_id: 1819730
description:
2025-02-07 08:16:24 dovecot_plain authenticator failed for 180.124.103.218.static.netvigator.com [218.103.124.180]:61503: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
country_id: 1835841
description:
2025-02-07 08:16:48 dovecot_plain authenticator failed for ([219.248.65.30]) [219.248.65.30]:54921: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.213
country_id: 1819730
description:
Feb  7 08:17:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.213
country_id: 1819730
description:
2025-02-07 08:17:05 dovecot_plain authenticator failed for (m121-202-154-213.smartone.com) [121.202.154.213]:5303: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 08:16:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.103.124.180
country_id: 1819730
description:
Feb  7 08:16:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.103.124.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 08:16:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.32.102.90
country_id: 1814991
description:
2025-02-07 08:16:50 dovecot_plain authenticator failed for ([117.32.102.90]) [117.32.102.90]:48531: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.254.225.100
country_id: 2017370
description:
2025-02-07 08:16:59 dovecot_plain authenticator failed for 100.225.254.193.infosys.su [193.254.225.100]:49731: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.106.126.27
country_id: 1835841
description:
Feb  7 08:17:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.106.126.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
country_id: 6252001
description:
Feb  7 08:16:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
country_id: 6252001
description:
2025-02-07 08:16:45 dovecot_plain authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:42432: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.248.65.30
country_id: 1835841
description:
Feb  7 08:16:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.248.65.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.32.102.90
country_id: 1814991
description:
Feb  7 08:16:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.32.102.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
country_id: 1835841
description:
2025-02-07 08:17:15 dovecot_plain authenticator failed for ([211.106.126.27]) [211.106.126.27]:58403: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-02-07 08:17:25 dovecot_plain authenticator failed for ([185.134.179.106]) [185.101.16.250]:47911: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.202.11
country_id: 1880251
description:
Feb  7 08:17:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.199.202.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.202.11
country_id: 1880251
description:
2025-02-07 08:17:30 dovecot_plain authenticator failed for (381859.cloudwaysapps.com) [128.199.202.11]:43266: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.184.60.138
country_id: 1835841
description:
Feb  7 08:17:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.184.60.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.60.138
country_id: 1835841
description:
2025-02-07 08:17:32 dovecot_plain authenticator failed for ([112.184.60.138]) [112.184.60.138]:42813: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.2.2
country_id: 1814991
description:
Feb  7 08:17:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.2.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.101.16.250
country_id: 272103
description:
Feb  7 08:17:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.101.16.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.233.134
country_id: 1814991
description:
Feb  7 08:17:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.233.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.2.2
country_id: 1814991
description:
2025-02-07 08:17:48 dovecot_plain authenticator failed for ([222.180.2.2]) [222.180.2.2]:55817: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.233.134
country_id: 1814991
description:
2025-02-07 08:17:51 dovecot_plain authenticator failed for ([27.45.233.134]) [27.45.233.134]:60813: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.38.202.60
country_id: 6252001
description:
Feb  7 08:19:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.38.202.60 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 135.148.169.28
country_id: 6252001
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:08-19.135.148.169.28


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.118.157
country_id: 1562822
description:
2025-02-07 08:19:19 dovecot_login authenticator failed for ([118.70.118.157]) [118.70.118.157]:37681: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.34
country_id: 99237
description:
2025-02-07 08:19:20 dovecot_plain authenticator failed for ([65.20.204.34]) [65.20.204.34]:47410: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.243.62
country_id: 1814991
description:
Feb  7 08:18:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.243.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.243.62
country_id: 1814991
description:
2025-02-07 08:18:31 dovecot_plain authenticator failed for ([183.220.243.62]) [183.220.243.62]:57754: 535 Incorrect authentication data (set_id=adams@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.86.48
country_id: 290557
description:
Feb  7 08:18:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.86.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.38.202.60
country_id: 6252001
description:
2025-02-07 08:19:07 dovecot_plain authenticator failed for ([136.38.202.60]) [136.38.202.60]:49611: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.118.157
country_id: 1562822
description:
Feb  7 08:19:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.118.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.233.183
country_id: 1814991
description:
Feb  7 08:18:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.233.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.233.183
country_id: 1814991
description:
2025-02-07 08:18:42 dovecot_plain authenticator failed for ([27.45.233.183]) [27.45.233.183]:54948: 535 Incorrect authentication data (set_id=adams)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.86.48
country_id: 290557
description:
2025-02-07 08:18:55 dovecot_plain authenticator failed for ([94.205.86.48]) [94.205.86.48]:53963: 535 Incorrect authentication data (set_id=abuse@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.34
country_id: 99237
description:
Feb  7 08:19:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.46.148.53
country_id: 1605651
description:
Feb  7 08:19:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.46.148.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.216.86
country_id: 1814991
description:
Feb  7 08:19:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.216.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.216.86
country_id: 1814991
description:
2025-02-07 08:19:06 dovecot_plain authenticator failed for ([61.185.216.86]) [61.185.216.86]:43637: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.83.78
country_id: 1269750
description:
Feb  7 08:19:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.83.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.83.78
country_id: 1269750
description:
2025-02-07 08:19:32 dovecot_plain authenticator failed for ([182.78.83.78]) [182.78.83.78]:41052: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.204.162.110
country_id: 1814991
description:
Feb  7 08:19:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.204.162.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 08:19:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.252.92.5
country_id: 1821275
description:
2025-02-07 08:19:51 dovecot_login authenticator failed for (ADMIN) [84.252.92.5]:57910: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.46.148.53
country_id: 1605651
description:
2025-02-07 08:19:23 dovecot_plain authenticator failed for 119-46-148-53.static.asianet.co.th [119.46.148.53]:38623: 535 Incorrect authentication data (set_id=abuse@ait-ext.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.204.162.110
country_id: 1814991
description:
2025-02-07 08:19:35 dovecot_login authenticator failed for ([218.204.162.110]) [218.204.162.110]:48534: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
country_id: 3469034
description:
Feb  7 08:19:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
country_id: 3469034
description:
2025-02-07 08:19:48 dovecot_plain authenticator failed for (189-56-79-105.customer.tdatabrasil.net.br) [186.200.249.162]:41947: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.120.227.186
country_id: 1835841
description:
Feb  7 08:20:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.120.227.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.227.186
country_id: 1835841
description:
2025-02-07 08:20:02 dovecot_plain authenticator failed for ([220.120.227.186]) [220.120.227.186]:38540: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.118.9.59
country_id: 1814991
description:
2025-02-07 08:20:45 dovecot_plain authenticator failed for ([123.118.9.75]) [123.118.9.59]:34284: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.248.75.119
country_id: 1861060
description:
Feb  7 08:20:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.248.75.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.248.75.119
country_id: 1861060
description:
2025-02-07 08:21:01 dovecot_plain authenticator failed for st7031.mas4401.y-tokyo.nttpc.ne.jp [160.248.75.119]:57192: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.132.125.226
country_id: 2017370
description:
Feb  7 08:21:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.132.125.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.132.125.226
country_id: 2017370
description:
2025-02-07 08:21:11 dovecot_plain authenticator failed for ip79-132-125-226.ulk.host.ttk.ru [79.132.125.226]:52906: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.118.9.59
country_id: 1814991
description:
Feb  7 08:20:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.118.9.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.190.69
country_id: 2017370
description:
Feb  7 08:22:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.255.190.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.190.69
country_id: 2017370
description:
2025-02-07 08:22:10 dovecot_plain authenticator failed for ([92.255.190.69]) [92.255.190.69]:37590: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.71.173.250
country_id: 1269750
description:
2025-02-07 08:22:10 dovecot_login authenticator failed for ([14.97.143.225]) [182.71.173.250]:46358: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.240.2.38
country_id: 1814991
description:
Feb  7 08:22:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.240.2.38 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-21.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.71.173.250
country_id: 1269750
description:
Feb  7 08:22:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.71.173.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.84.89
country_id: 3469034
description:
Feb  7 08:21:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.84.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.91.84.89
country_id: 3469034
description:
2025-02-07 08:21:27 dovecot_plain authenticator failed for ([187.92.76.49]) [201.91.84.89]:47115: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.39.187.16
country_id: 3469034
description:
Feb  7 08:22:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.39.187.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.119.20.149
country_id: 1835841
description:
2025-02-07 08:23:19 dovecot_plain authenticator failed for ([175.119.20.149]) [175.119.20.149]:40771: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.134.239.97
country_id: 1814991
description:
2025-02-07 08:22:35 dovecot_plain authenticator failed for ([182.134.239.97]) [182.134.239.97]:55320: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.94.0.159
country_id: 1861060
description:
Feb  7 08:23:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.94.0.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.120.163.110
country_id: 2017370
description:
Feb  7 08:22:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.120.163.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.235.154
country_id: 102358
description:
2025-02-07 08:23:10 dovecot_login authenticator failed for (ADMIN) [95.181.235.154]:42591: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.39.187.16
country_id: 3469034
description:
2025-02-07 08:22:56 dovecot_plain authenticator failed for ([189.39.187.16]) [189.39.187.16]:47121: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.134.239.97
country_id: 1814991
description:
Feb  7 08:22:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.134.239.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
country_id: 2017370
description:
2025-02-07 08:22:45 dovecot_plain authenticator failed for ([212.120.163.110]) [212.120.163.110]:44706: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.119.20.149
country_id: 1835841
description:
Feb  7 08:23:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.119.20.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
country_id: 1861060
description:
2025-02-07 08:23:19 dovecot_plain authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:24979: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.240.2.38
country_id: 1814991
description:
2025-02-07 08:22:23 dovecot_login authenticator failed for ([58.240.2.38]) [58.240.2.38]:59166: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.255.112.6
country_id: 6252001
description:
2025-02-07 08:24:15 dovecot_plain authenticator failed for 6.112.255.173.bc.googleusercontent.com [173.255.112.6]:36550: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.94.219
country_id: 1880251
description:
2025-02-07 08:23:40 dovecot_plain authenticator failed for ([124.246.94.219]) [124.246.94.219]:54864: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.7.203.177
country_id: 1835841
description:
Feb  7 08:23:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.7.203.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.40.10
country_id: 1814991
description:
Feb  7 08:23:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.40.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.238.92.245
country_id: 2623032
description:
Feb  7 08:23:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.238.92.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2025-02-07 08:23:36 dovecot_plain authenticator failed for (84-238-92-245.ptr.bnaa.dk) [84.238.92.245]:34088: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.187.66
country_id: 1814991
description:
Feb  7 08:23:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.187.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.251.95
country_id: 3469034
description:
2025-02-07 08:23:59 dovecot_plain authenticator failed for ([191.59.251.95]) [191.59.251.95]:47680: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.136.195.32
country_id: 1814991
description:
2025-02-07 08:24:16 dovecot_plain authenticator failed for (32.195.136.122.adsl-pool.jlccptt.net.cn) [122.136.195.32]:40286: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.76.248.54
country_id: 1814991
description:
Feb  7 08:23:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.76.248.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.93
country_id: 1819730
description:
Feb  7 08:23:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.67.114
country_id: 3469034
description:
2025-02-07 08:24:04 dovecot_plain authenticator failed for (187-93-74-213.customer.tdatabrasil.net.br) [187.50.67.114]:60720: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.136.195.32
country_id: 1814991
description:
Feb  7 08:24:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.136.195.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.7.203.177
country_id: 1835841
description:
2025-02-07 08:23:43 dovecot_plain authenticator failed for ([59.7.203.177]) [59.7.203.177]:54576: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
country_id: 1814991
description:
2025-02-07 08:23:49 dovecot_plain authenticator failed for ([218.22.187.68]) [218.22.187.66]:44232: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.115.211
country_id: 1880251
description:
Feb  7 08:23:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.115.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
country_id: 1269750
description:
2025-02-07 08:23:42 dovecot_plain authenticator failed for ([106.51.120.94]) [106.51.220.33]:27540: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.210.27.53
country_id: 1814991
description:
Feb  7 08:23:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.210.27.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
country_id: 1694008
description:
2025-02-07 08:23:58 dovecot_plain authenticator failed for (58.69.17.18.pldt.net) [58.69.17.18]:47430: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.136.29.20
country_id: 1835841
description:
2025-02-07 08:24:07 dovecot_plain authenticator failed for ([114.53.252.246]) [124.136.29.20]:19947: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.11.144.206
country_id: 1814991
description:
2025-02-07 08:24:07 dovecot_plain authenticator failed for ([121.11.144.206]) [121.11.144.206]:38682: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.90.195.68
country_id: 953987
description:
2025-02-07 08:23:39 dovecot_plain authenticator failed for (197-90-195-68.dyn.mweb.co.za) [197.90.195.68]:50506: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.251.95
country_id: 3469034
description:
Feb  7 08:23:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.251.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.115.211
country_id: 1880251
description:
2025-02-07 08:24:01 dovecot_plain authenticator failed for (211.115.156.175.unknown.m1.com.sg) [175.156.115.211]:45438: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.136.29.20
country_id: 1835841
description:
Feb  7 08:24:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.136.29.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.93
country_id: 1819730
description:
2025-02-07 08:24:00 dovecot_plain authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:20948: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.179.85.98
country_id: 1269750
description:
2025-02-07 08:24:08 dovecot_plain authenticator failed for ([202.179.85.98]) [202.179.85.98]:40037: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.117.200
country_id: 1814991
description:
Feb  7 08:24:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.117.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.155.40.158
country_id: 1835841
description:
Feb  7 08:23:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.155.40.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.127.188
country_id: 1835841
description:
Feb  7 08:23:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.127.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.155.40.158
country_id: 1835841
description:
2025-02-07 08:23:43 dovecot_plain authenticator failed for ([218.155.40.158]) [218.155.40.158]:43496: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.199.29.111
country_id: 1835841
description:
Feb  7 08:23:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.199.29.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.183.247
country_id: 2510769
description:
2025-02-07 08:23:35 dovecot_plain authenticator failed for ([207.188.183.247]) [207.188.183.247]:40314: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.246.94.219
country_id: 1880251
description:
Feb  7 08:23:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.246.94.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.90.195.68
country_id: 953987
description:
Feb  7 08:23:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.90.195.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.25
country_id: 1819730
description:
2025-02-07 08:23:37 dovecot_plain authenticator failed for ([121.202.154.25]) [121.202.154.25]:19237: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.220.33
country_id: 1269750
description:
Feb  7 08:23:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.220.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.210.27.53
country_id: 1814991
description:
2025-02-07 08:23:49 dovecot_plain authenticator failed for ([223.210.27.53]) [223.210.27.53]:45464: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.216.2.74
country_id: 1814991
description:
2025-02-07 08:23:34 dovecot_plain authenticator failed for ([222.216.2.74]) [222.216.2.74]:51157: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.51.129.5
country_id: 6252001
description:
2025-02-07 08:23:47 dovecot_plain authenticator failed for 206-51-129-5.nktelco.net [206.51.129.5]:37411: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.168.106
country_id: 1814991
description:
Feb  7 08:23:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.168.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.50.67.114
country_id: 3469034
description:
Feb  7 08:24:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.50.67.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.24.215.70
country_id: 2233387
description:
2025-02-07 08:24:01 dovecot_plain authenticator failed for ([195.24.215.70]) [195.24.215.70]:42282: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.117.200
country_id: 1814991
description:
2025-02-07 08:24:16 dovecot_plain authenticator failed for ([112.15.117.200]) [112.15.117.200]:16042: 535 Incorrect authentication data (set_id=baah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.24.215.70
country_id: 2233387
description:
Feb  7 08:23:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.24.215.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.202.159.233
country_id: 6252001
description:
Feb  7 08:23:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 52.202.159.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.216.2.74
country_id: 1814991
description:
Feb  7 08:23:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.216.2.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
country_id: 1814991
description:
2025-02-07 08:23:40 dovecot_plain authenticator failed for ([222.76.248.54]) [222.76.248.54]:53052: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
country_id: 1694008
description:
Feb  7 08:23:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.113.91
country_id: 1835841
description:
Feb  7 08:24:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.113.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 52.202.159.233
country_id: 6252001
description:
2025-02-07 08:23:30 dovecot_plain authenticator failed for ec2-52-202-159-233.compute-1.amazonaws.com [52.202.159.233]:59772: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.183.247
country_id: 2510769
description:
Feb  7 08:23:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.183.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 08:23:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.199.29.111
country_id: 1835841
description:
2025-02-07 08:24:01 dovecot_plain authenticator failed for ([124.199.29.111]) [124.199.29.111]:33024: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.25
country_id: 1819730
description:
Feb  7 08:23:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.168.106
country_id: 1814991
description:
2025-02-07 08:23:57 dovecot_plain authenticator failed for ([124.115.168.106]) [124.115.168.106]:50813: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.11.144.206
country_id: 1814991
description:
Feb  7 08:24:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.11.144.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2025-02-07 08:24:11 dovecot_plain authenticator failed for ([175.206.113.91]) [175.206.113.91]:38350: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.255.112.6
country_id: 6252001
description:
Feb  7 08:24:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.255.112.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.51.129.5
country_id: 6252001
description:
Feb  7 08:23:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.51.129.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.127.188
country_id: 1835841
description:
2025-02-07 08:23:46 dovecot_plain authenticator failed for ([114.108.127.188]) [114.108.127.188]:58838: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.40.10
country_id: 1814991
description:
2025-02-07 08:23:55 dovecot_plain authenticator failed for ([112.6.73.140]) [221.2.40.10]:40911: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.179.85.98
country_id: 1269750
description:
Feb  7 08:24:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.179.85.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.122.138
country_id: 1269750
description:
2025-02-07 08:25:12 dovecot_plain authenticator failed for (abts-north-static-x.138.122.163.122.airtelbroadband.in) [122.163.122.138]:54104: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.70.142
country_id: 1835841
description:
2025-02-07 08:24:25 dovecot_plain authenticator failed for ([218.149.70.142]) [218.149.70.142]:59854: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.254.165.100
country_id: 732800
description:
Feb  7 08:24:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.254.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.104.221.252
country_id: 1835841
description:
Feb  7 08:24:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.104.221.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.254.165.100
country_id: 732800
description:
2025-02-07 08:24:58 dovecot_plain authenticator failed for 9498.telnet.bg (schhemic) [87.254.165.100]:55042: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.112.154.174
country_id: 1269750
description:
Feb  7 08:24:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.112.154.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.112.154.174
country_id: 1269750
description:
2025-02-07 08:24:27 dovecot_plain authenticator failed for ([203.112.154.174]) [203.112.154.174]:59314: 535 Incorrect authentication data (set_id=baah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.104.221.252
country_id: 1835841
description:
2025-02-07 08:25:00 dovecot_plain authenticator failed for ([210.104.221.252]) [210.104.221.252]:43216: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-02-07 08:25:01 dovecot_plain authenticator failed for (rufforian) [65.20.174.63]:38872: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
country_id: 1819730
description:
Feb  7 08:25:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 08:25:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.70.142
country_id: 1835841
description:
Feb  7 08:24:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.70.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.174.63
country_id: 99237
description:
Feb  7 08:24:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.174.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.163.122.138
country_id: 1269750
description:
Feb  7 08:25:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.163.122.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
country_id: 1819730
description:
2025-02-07 08:25:12 dovecot_login authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:36828: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.115.76.186
country_id: 6252001
description:
2025-02-07 08:25:41 dovecot_plain authenticator failed for ool-45734cba.dyn.optonline.net [69.115.76.186]:57540: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 175.107.212.0
country_id: 1168579
description:
[2025-02-07 08:26:18 +0100] info [webmaild] 175.107.212.0 - info@lemsas.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.181.133.153
country_id: 3469034
description:
Feb  7 08:25:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.181.133.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.47
country_id: 1835841
description:
2025-02-07 08:25:26 dovecot_login authenticator failed for ([121.154.90.47]) [121.154.90.47]:53974: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2025-02-07 08:25:31 dovecot_plain authenticator failed for ([179.181.133.153]) [179.181.133.153]:47678: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.115.76.186
country_id: 6252001
description:
Feb  7 08:25:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.115.76.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.154.90.47
country_id: 1835841
description:
Feb  7 08:25:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.154.90.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.1.239.146
country_id: 1814991
description:
Feb  7 08:27:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.1.239.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.239.146
country_id: 1814991
description:
2025-02-07 08:27:02 dovecot_plain authenticator failed for ([218.1.239.146]) [218.1.239.146]:31058: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.208.71.101
country_id: 2017370
description:
Feb  7 08:26:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.208.71.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.88.186.142
country_id: 3469034
description:
2025-02-07 08:26:41 dovecot_plain authenticator failed for ([201.88.186.142]) [201.88.186.142]:56576: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.11.130.37
country_id: 1668284
description:
2025-02-07 08:26:53 dovecot_plain authenticator failed for 124-11-130-37.static.tfn.net.tw [124.11.130.37]:51143: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.161.196.5
country_id: 99237
description:
Feb  7 08:26:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.161.196.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.221.59
country_id: 1269750
description:
Feb  7 08:26:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.221.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.221.59
country_id: 1269750
description:
2025-02-07 08:26:36 dovecot_plain authenticator failed for (abts-north-static-059.221.160.122.airtelbroadband.in) [122.160.221.59]:59820: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
country_id: 337996
description:
Feb  7 08:26:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.11.130.37
country_id: 1668284
description:
Feb  7 08:26:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.11.130.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2025-02-07 08:26:54 dovecot_plain authenticator failed for ([46.161.196.5]) [46.161.196.5]:59400: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.84.175
country_id: 1835841
description:
Feb  7 08:26:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.84.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.84.175
country_id: 1835841
description:
2025-02-07 08:26:47 dovecot_plain authenticator failed for ([222.114.84.175]) [222.114.84.175]:37816: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.104.180
country_id: 1814991
description:
2025-02-07 08:26:43 dovecot_plain authenticator failed for ([218.94.104.181]) [218.94.104.180]:40693: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-02-07 08:26:47 dovecot_plain authenticator failed for ([196.191.212.226]) [213.55.85.202]:23375: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.71.101
country_id: 2017370
description:
2025-02-07 08:26:35 dovecot_plain authenticator failed for ([82.208.71.101]) [82.208.71.101]:60884: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.88.186.142
country_id: 3469034
description:
Feb  7 08:26:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.88.186.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.104.180
country_id: 1814991
description:
Feb  7 08:26:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.104.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.165.114
country_id: 1269750
description:
2025-02-07 08:28:05 dovecot_plain authenticator failed for (static.ill.117.250.165.114.bsnl.co.in) [117.250.165.114]:56993: 535 Incorrect authentication data (set_id=abuse@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.118.132
country_id: 337996
description:
Feb  7 08:28:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.118.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.132.125.226
country_id: 2017370
description:
Feb  7 08:27:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.132.125.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.165.114
country_id: 1269750
description:
Feb  7 08:28:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.116
country_id: 1880251
description:
47.128.119.116 - - [07/Feb/2025:08:27:59 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=8246191 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/1ec0fb?panel=logger" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.116


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.118.132
country_id: 337996
description:
2025-02-07 08:28:14 dovecot_plain authenticator failed for ([196.190.118.132]) [196.190.118.132]:57090: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.74.118.92
country_id: 1835841
description:
Feb  7 08:27:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.74.118.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.74.118.92
country_id: 1835841
description:
2025-02-07 08:27:33 dovecot_plain authenticator failed for ([220.74.118.92]) [220.74.118.92]:57756: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.132.125.226
country_id: 2017370
description:
2025-02-07 08:27:47 dovecot_plain authenticator failed for ip79-132-125-226.ulk.host.ttk.ru [79.132.125.226]:55516: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.193.70
country_id: 1814991
description:
Feb  7 08:28:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.193.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2025-02-07 08:28:45 dovecot_login authenticator failed for ([116.113.193.70]) [116.113.193.70]:10686: 535 Incorrect authentication data (set_id=oudoc)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 118.128.165.171
country_id: 1835841
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:08-28.118.128.165.171


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.93.44
country_id: 1814991
description:
Feb  7 08:29:04 ait sshd[1675668]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.93.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.228.100
country_id: 6252001
description:
Feb  7 08:28:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.228.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.228.100
country_id: 6252001
description:
2025-02-07 08:28:31 dovecot_login authenticator failed for ([104.241.228.100]) [104.241.228.100]:52809: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.23.181.71
country_id: 2017370
description:
2025-02-07 08:29:03 dovecot_login authenticator failed for (pat-89-23-181-71.pool.powernet.com.ru) [89.23.181.71]:46025: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.93.44
country_id: 1814991
description:
Feb  7 08:29:04 ait sshd[1675668]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.93.44


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.14.135
country_id: 1668284
description:
Feb  7 08:29:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.14.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.14.135
country_id: 1668284
description:
2025-02-07 08:29:17 dovecot_login authenticator failed for 111-70-14-135.emome-ip.hinet.net [111.70.14.135]:36931: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 08:28:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.23.181.71
country_id: 2017370
description:
Feb  7 08:29:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.23.181.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.215
country_id: 6252001
description:
2025-02-07 08:30:11 dovecot_login authenticator failed for ([67.55.189.215]) [67.55.189.215]:57261: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
country_id: 294640
description:
Feb  7 08:29:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.55.189.215
country_id: 6252001
description:
Feb  7 08:30:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.55.189.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.134.239.97
country_id: 1814991
description:
Feb  7 08:29:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.134.239.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.134.239.97
country_id: 1814991
description:
2025-02-07 08:29:54 dovecot_plain authenticator failed for ([182.134.239.97]) [182.134.239.97]:33352: 535 Incorrect authentication data (set_id=adams@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
country_id: 294640
description:
2025-02-07 08:29:58 dovecot_login authenticator failed for ([147.235.97.158]) [147.235.97.158]:24301: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.203.210.119
country_id: 1269750
description:
2025-02-07 08:30:05 dovecot_plain authenticator failed for ([103.203.210.119]) [103.203.210.119]:45870: 535 Incorrect authentication data (set_id=adams)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.5.245.129
country_id: 1814991
description:
Feb  7 08:29:40 ait sshd[1675815]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.5.245.129 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.5.245.129
country_id: 1814991
description:
Feb  7 08:29:40 ait sshd[1675815]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.5.245.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.203.210.119
country_id: 1269750
description:
Feb  7 08:30:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.203.210.119 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.149.214
country_id: 1269750
description:
Feb  7 08:30:16 ait sshd[1676183]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.149.214


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.208.76.154
country_id: 3469034
description:
Feb  7 08:31:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.208.76.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
country_id: 1835841
description:
2025-02-07 08:31:58 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:44372: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.50
country_id: 2017370
description:
Feb  7 08:32:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 66.9.172.41
country_id: 3508796
description:
[2025-02-07 08:31:59 +0100] info [webmaild] 66.9.172.41 - info@ait-ext.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 189.241.42.249
country_id: 3996063
description:
Feb  7 08:31:37 ait sshd[1676744]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.241.42.249


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.55.59
country_id: 1835841
description:
Feb  7 08:31:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.55.59 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.84.58.166
country_id: 3469034
description:
[2025-02-07 08:31:32 +0100] info [webmaild] 170.84.58.166 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.186
country_id: 1814991
description:
Feb  7 08:31:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.186
country_id: 1814991
description:
2025-02-07 08:31:42 dovecot_login authenticator failed for ([111.61.177.186]) [111.61.177.186]:22398: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.102.48.129
country_id: 1814991
description:
Feb  7 08:31:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.102.48.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.114.149.106
country_id: 1814991
description:
Feb  7 08:31:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.114.149.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.149.106
country_id: 1814991
description:
2025-02-07 08:31:44 dovecot_plain authenticator failed for ([124.114.149.106]) [124.114.149.106]:36838: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.208.76.154
country_id: 3469034
description:
2025-02-07 08:31:52 dovecot_plain authenticator failed for (186-208-76-154.veloo.com.br) [186.208.76.154]:45219: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
country_id: 1835841
description:
Feb  7 08:31:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.171.55.59
country_id: 1835841
description:
2025-02-07 08:31:57 dovecot_plain authenticator failed for ([223.171.55.59]) [223.171.55.59]:46062: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.48.129
country_id: 1814991
description:
2025-02-07 08:31:35 dovecot_plain authenticator failed for ([112.102.48.129]) [112.102.48.129]:53562: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.241.42.249
country_id: 3996063
description:
Feb  7 08:31:37 ait sshd[1676744]: pam_imunify(sshd:auth): [IM360_RBL] The IP 189.241.42.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.65
country_id: 1819730
description:
2025-02-07 08:32:50 dovecot_login authenticator failed for (m121-202-154-65.smartone.com) [121.202.154.65]:4267: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.241.161
country_id: 1835841
description:
Feb  7 08:32:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.241.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
country_id: 2017370
description:
Feb  7 08:33:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.6.78.182
country_id: 3469034
description:
Feb  7 08:33:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.6.78.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.128.162.146
country_id: 1814991
description:
Feb  7 08:32:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.128.162.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.35.63.27
country_id: 1835841
description:
Feb  7 08:32:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.35.63.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.128.162.146
country_id: 1814991
description:
2025-02-07 08:32:41 dovecot_login authenticator failed for ([27.128.162.146]) [27.128.162.146]:40822: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.65
country_id: 1819730
description:
Feb  7 08:32:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.241.161
country_id: 1835841
description:
2025-02-07 08:33:00 dovecot_login authenticator failed for ([115.23.241.161]) [115.23.241.161]:37044: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
country_id: 2017370
description:
2025-02-07 08:33:13 dovecot_plain authenticator failed for (lervacyan) [81.211.77.58]:39509: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.24
country_id: 1819730
description:
2025-02-07 08:32:43 dovecot_plain authenticator failed for ([121.202.152.24]) [121.202.152.24]:18644: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.35.63.27
country_id: 1835841
description:
2025-02-07 08:32:43 dovecot_login authenticator failed for ([110.35.63.27]) [110.35.63.27]:59576: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 08:33:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.177.215.47
country_id: 1814991
description:
2025-02-07 08:33:07 dovecot_login authenticator failed for ([117.177.215.47]) [117.177.215.47]:37667: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.117.7.15
country_id: 1668284
description:
Feb  7 08:32:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.117.7.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.117.7.15
country_id: 1668284
description:
2025-02-07 08:32:25 dovecot_plain authenticator failed for ([150.117.7.15]) [150.117.7.15]:34219: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.24
country_id: 1819730
description:
Feb  7 08:32:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.177.215.47
country_id: 1814991
description:
Feb  7 08:33:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.177.215.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.6.78.182
country_id: 3469034
description:
2025-02-07 08:33:17 dovecot_login authenticator failed for (bd064eb6.virtua.com.br) [189.6.78.182]:65286: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.100.184.80
country_id: 1880251
description:
Feb  7 08:33:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.100.184.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.149.214
country_id: 1269750
description:
Feb  7 08:34:20 ait sshd[1677687]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.149.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.149.214
country_id: 1269750
description:
Feb  7 08:34:20 ait sshd[1677687]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.149.214


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.100.184.80
country_id: 1880251
description:
2025-02-07 08:33:35 dovecot_plain authenticator failed for (80-184-100-101.myrepublic.com.sg) [101.100.184.80]:56470: 535 Incorrect authentication data (set_id=ads89b99891y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.63.46.34
country_id: 2077456
description:
Feb  7 08:33:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.63.46.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.63.46.34
country_id: 2077456
description:
2025-02-07 08:33:47 dovecot_plain authenticator failed for ([203.29.84.253]) [203.63.46.34]:22516: 535 Incorrect authentication data (set_id=ads89b99891y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.148.43
country_id: 1835841
description:
Feb  7 08:35:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.148.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.68.52.210
country_id: 1269750
description:
Feb  7 08:35:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.68.52.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.246.114
country_id: 1814991
description:
2025-02-07 08:35:15 dovecot_login authenticator failed for ([120.237.246.114]) [120.237.246.114]:45629: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.189.153.136
country_id: 1814991
description:
Feb  7 08:35:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.189.153.136 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 189.241.42.249
country_id: 3996063
description:
Feb  7 08:34:47 ait sshd[1677745]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.241.42.249


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.28.66.78
country_id: 2264397
description:
Feb  7 08:35:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.28.66.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2025-02-07 08:35:16 dovecot_plain authenticator failed for ([103.68.52.210]) [103.68.52.210]:38112: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.241.42.249
country_id: 3996063
description:
Feb  7 08:34:47 ait sshd[1677745]: pam_imunify(sshd:auth): [IM360_RBL] The IP 189.241.42.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.28.66.78
country_id: 2264397
description:
2025-02-07 08:35:05 dovecot_plain authenticator failed for ([62.28.66.78]) [62.28.66.78]:40636: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.217.22
country_id: 3017382
description:
2025-02-07 08:35:14 dovecot_login authenticator failed for (ADMIN) [191.101.217.22]:55592: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.149.214
country_id: 1269750
description:
Feb  7 08:34:22 ait sshd[1677687]: Failed password for invalid user server from 64.227.149.214 port 55228 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.148.43
country_id: 1835841
description:
2025-02-07 08:35:02 dovecot_login authenticator failed for ([183.109.148.43]) [183.109.148.43]:41108: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.255.231.10
country_id: 1835841
description:
2025-02-07 08:35:06 dovecot_plain authenticator failed for ([106.255.231.10]) [106.255.231.10]:39435: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.246.114
country_id: 1814991
description:
Feb  7 08:35:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.246.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.189.153.136
country_id: 1814991
description:
2025-02-07 08:35:21 dovecot_plain authenticator failed for ([110.189.153.136]) [110.189.153.136]:40858: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.149.214
country_id: 1269750
description:
Feb  7 08:35:45 ait sshd[1678271]: Failed password for invalid user test from 64.227.149.214 port 58216 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.69.195.7
country_id: 1814991
description:
2025-02-07 08:36:11 dovecot_plain authenticator failed for ([125.69.195.7]) [125.69.195.7]:56592: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.53
country_id: 99237
description:
Feb  7 08:36:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.9.3.190
country_id: 3469034
description:
Feb  7 08:36:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.9.3.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.3.190
country_id: 3469034
description:
2025-02-07 08:36:09 dovecot_plain authenticator failed for ([187.9.3.190]) [187.9.3.190]:36130: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.48.27
country_id: 1668284
description:
2025-02-07 08:36:09 dovecot_plain authenticator failed for 111-70-48-27.emome-ip.hinet.net [111.70.48.27]:44057: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.15.104
country_id: 2017370
description:
2025-02-07 08:36:06 dovecot_plain authenticator failed for 95-31-15-104.static.corbina.ru [95.31.15.104]:55564: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.218.134.95
country_id: 6252001
description:
Feb  7 08:36:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.218.134.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.218.134.95
country_id: 6252001
description:
2025-02-07 08:36:15 dovecot_plain authenticator failed for 32-218-134-95.bng02.trtn.ct.frontiernet.net [32.218.134.95]:54286: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.177.75
country_id: 1269750
description:
2025-02-07 08:35:47 dovecot_plain authenticator failed for (49.207.177.75.actcorp.in) [49.207.177.75]:45424: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.165.251
country_id: 1835841
description:
2025-02-07 08:36:03 dovecot_plain authenticator failed for ([211.178.165.251]) [211.178.165.251]:50392: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.241.42.249
country_id: 3996063
description:
Feb  7 08:36:09 ait sshd[1678539]: pam_imunify(sshd:auth): [IM360_RBL] The IP 189.241.42.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2025-02-07 08:36:10 dovecot_plain authenticator failed for ([181.233.140.250]) [181.233.140.250]:43216: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.207.231.65
country_id: 1814991
description:
2025-02-07 08:36:15 dovecot_plain authenticator failed for ([111.207.231.67]) [111.207.231.65]:13973: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.207.177.75
country_id: 1269750
description:
Feb  7 08:35:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.207.177.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.169.117.118
country_id: 6252001
description:
Feb  7 08:36:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.169.117.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.55
country_id: 2017370
description:
2025-02-07 08:36:08 dovecot_plain authenticator failed for ([178.178.222.55]) [178.178.222.55]:33814: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.169.117.118
country_id: 6252001
description:
2025-02-07 08:36:10 dovecot_plain authenticator failed for 118.sub-166-169-117.myvzw.com [166.169.117.118]:32235: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.200.95.200
country_id: 2750405
description:
Feb  7 08:36:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.200.95.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.200.95.200
country_id: 2750405
description:
2025-02-07 08:36:14 dovecot_plain authenticator failed for 89-200-95-200.mobile.kpn.net [89.200.95.200]:38122: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.149.214
country_id: 1269750
description:
Feb  7 08:35:43 ait sshd[1678271]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.149.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2025-02-07 08:36:00 dovecot_plain authenticator failed for ([121.128.76.109]) [61.72.59.106]:32854: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.15.104
country_id: 2017370
description:
Feb  7 08:36:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.15.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.55
country_id: 2017370
description:
Feb  7 08:36:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.233.140.250
country_id: 3469034
description:
Feb  7 08:36:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.233.140.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.53
country_id: 99237
description:
2025-02-07 08:36:20 dovecot_plain authenticator failed for ([65.20.251.53]) [65.20.251.53]:52557: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.178.165.251
country_id: 1835841
description:
Feb  7 08:36:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.178.165.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.48.27
country_id: 1668284
description:
Feb  7 08:36:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.48.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.59.94.130
country_id: 1269750
description:
2025-02-07 08:36:09 dovecot_plain authenticator failed for (rw-00130-94.59.137.rcil.gov.in) [137.59.94.130]:55420: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.69.195.7
country_id: 1814991
description:
Feb  7 08:36:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.69.195.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.108.88.121
country_id: 1814991
description:
Feb  7 08:36:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.108.88.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.207.231.65
country_id: 1814991
description:
Feb  7 08:36:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.207.231.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.108.88.121
country_id: 1814991
description:
2025-02-07 08:36:14 dovecot_plain authenticator failed for ([113.108.88.121]) [113.108.88.121]:56718: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.24.150.179
country_id: 3658394
description:
[2025-02-07 08:36:21 +0100] info [webmaild] 200.24.150.179 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
country_id: 1835841
description:
Feb  7 08:35:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.59.94.130
country_id: 1269750
description:
Feb  7 08:36:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.59.94.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 189.241.42.249
country_id: 3996063
description:
Feb  7 08:36:09 ait sshd[1678539]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.241.42.249


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.30.170
country_id: 1814991
description:
Feb  7 08:36:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.30.170 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.149.214
country_id: 1269750
description:
Feb  7 08:35:43 ait sshd[1678271]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.149.214


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.87.103.131
country_id: 2017370
description:
2025-02-07 08:36:37 dovecot_plain authenticator failed for ([77.87.103.131]) [77.87.103.131]:53292: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
country_id: 1835841
description:
Feb  7 08:36:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.199.34
country_id: 1835841
description:
2025-02-07 08:36:26 dovecot_plain authenticator failed for ([14.49.199.34]) [14.49.199.34]:40929: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.93.130
country_id: 1835841
description:
2025-02-07 08:36:31 dovecot_plain authenticator failed for ([211.109.93.130]) [211.109.93.130]:33814: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.152.91.221
country_id: 1814991
description:
2025-02-07 08:36:32 dovecot_plain authenticator failed for ([124.152.91.221]) [124.152.91.221]:60683: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.249.163.4
country_id: 6251999
description:
Feb  7 08:36:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.249.163.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.249.163.4
country_id: 6251999
description:
2025-02-07 08:36:36 dovecot_plain authenticator failed for ([162.249.163.4]) [162.249.163.4]:57745: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.148.187.146
country_id: 3686110
description:
2025-02-07 08:36:54 dovecot_plain authenticator failed for (azteca-comunicaciones.com) [186.148.187.146]:57964: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.11.25.195
country_id: 6252001
description:
2025-02-07 08:36:25 dovecot_plain authenticator failed for ([66.11.25.195]) [66.11.25.195]:53184: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.123.72.205
country_id: 3469034
description:
Feb  7 08:36:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.123.72.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.235.203.63
country_id: 6252001
description:
2025-02-07 08:36:26 dovecot_plain authenticator failed for 108-235-203-63.lightspeed.chrlnc.sbcglobal.net [108.235.203.63]:56957: 535 Incorrect authentication data (set_id=7606e1dcc1da@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.166.68.184
country_id: 2017370
description:
Feb  7 08:36:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.166.68.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.166.68.184
country_id: 2017370
description:
2025-02-07 08:36:42 dovecot_plain authenticator failed for (5x166x68x184.dynamic.barnaul.ertelecom.ru) [5.166.68.184]:54960: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.87.103.131
country_id: 2017370
description:
Feb  7 08:36:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.87.103.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2025-02-07 08:36:40 dovecot_plain authenticator failed for ([203.123.219.137]) [203.123.219.137]:48691: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-36.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
country_id: 1835841
description:
Feb  7 08:37:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.128.78
country_id: 99237
description:
Feb  7 08:36:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.128.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.135.93
country_id: 2077456
description:
2025-02-07 08:36:31 dovecot_plain authenticator failed for 93.135.220.111.sta.wbroadband.net.au [111.220.135.93]:45691: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.148.187.146
country_id: 3686110
description:
Feb  7 08:36:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.148.187.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.235.203.63
country_id: 6252001
description:
Feb  7 08:36:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.235.203.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.49.199.34
country_id: 1835841
description:
Feb  7 08:36:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.49.199.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.93.130
country_id: 1835841
description:
Feb  7 08:36:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.93.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.73.70.43
country_id: 2661886
description:
Feb  7 08:36:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.73.70.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.128.78
country_id: 99237
description:
2025-02-07 08:36:25 dovecot_plain authenticator failed for ([65.20.128.78]) [65.20.128.78]:52520: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.13.2
country_id: 1814991
description:
2025-02-07 08:36:25 dovecot_plain authenticator failed for ([183.236.13.2]) [183.236.13.2]:48970: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.73.70.43
country_id: 2661886
description:
2025-02-07 08:36:38 dovecot_plain authenticator failed for 78-73-70-43-no600.tbcn.telia.com [78.73.70.43]:45638: 535 Incorrect authentication data (set_id=7606e1dcc1da)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.13.2
country_id: 1814991
description:
Feb  7 08:36:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.13.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2025-02-07 08:37:09 dovecot_plain authenticator failed for ([203.252.10.5]) [203.252.10.3]:54372: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.152.91.221
country_id: 1814991
description:
Feb  7 08:36:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.152.91.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.11.25.195
country_id: 6252001
description:
Feb  7 08:36:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.11.25.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.30.170
country_id: 1814991
description:
2025-02-07 08:36:22 dovecot_plain authenticator failed for ([61.185.30.170]) [61.185.30.170]:51009: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.123.72.205
country_id: 3469034
description:
2025-02-07 08:36:27 dovecot_plain authenticator failed for ([187.123.72.205]) [187.123.72.205]:46794: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.135.93
country_id: 2077456
description:
Feb  7 08:36:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.135.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
country_id: 2542007
description:
Feb  7 08:37:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
country_id: 2542007
description:
2025-02-07 08:37:45 dovecot_plain authenticator failed for (preamuchie) [102.53.15.54]:38323: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.147.45
country_id: 99237
description:
Feb  7 08:38:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.147.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-02-07 08:38:17 dovecot_plain authenticator failed for (ilize) [65.20.147.45]:54982: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.213
country_id: 1819730
description:
Feb  7 08:39:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.184.218.49
country_id: 3469034
description:
Feb  7 08:39:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.184.218.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.24
country_id: 1819730
description:
Feb  7 08:39:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.208.186.206
country_id: 1835841
description:
2025-02-07 08:39:10 dovecot_plain authenticator failed for ([175.208.186.206]) [175.208.186.206]:48260: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2025-02-07 08:39:10 dovecot_plain authenticator failed for (imparhoteis.static.gvt.net.br) [179.184.218.49]:55590: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.24
country_id: 1819730
description:
2025-02-07 08:39:11 dovecot_plain authenticator failed for ([121.202.152.24]) [121.202.152.24]:8546: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.208.186.206
country_id: 1835841
description:
Feb  7 08:39:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.208.186.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.213
country_id: 1819730
description:
2025-02-07 08:39:09 dovecot_plain authenticator failed for (m121-202-154-213.smartone.com) [121.202.154.213]:30172: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.115.76.186
country_id: 6252001
description:
2025-02-07 08:39:09 dovecot_plain authenticator failed for ool-45734cba.dyn.optonline.net [69.115.76.186]:49478: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.115.76.186
country_id: 6252001
description:
Feb  7 08:39:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.115.76.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.223.154.170
country_id: 2403846
description:
Feb  7 08:39:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.223.154.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.115.42.62
country_id: 1814991
description:
Feb  7 08:39:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.115.42.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
country_id: 1835841
description:
2025-02-07 08:39:32 dovecot_plain authenticator failed for ([218.150.170.10]) [218.150.170.10]:54696: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.200.14.2
country_id: 1814991
description:
2025-02-07 08:39:33 dovecot_plain authenticator failed for ([202.200.14.2]) [202.200.14.2]:55978: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.227.134
country_id: 1814991
description:
2025-02-07 08:39:39 dovecot_plain authenticator failed for (134.227.160.222.adsl-pool.jlccptt.net.cn) [222.160.227.134]:60048: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.223.154.170
country_id: 2403846
description:
2025-02-07 08:39:24 dovecot_plain authenticator failed for ([102.223.154.170]) [102.223.154.170]:41888: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
country_id: 1835841
description:
Feb  7 08:39:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.200.14.2
country_id: 1814991
description:
Feb  7 08:39:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.200.14.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.227.134
country_id: 1814991
description:
Feb  7 08:39:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.227.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.93.44
country_id: 1814991
description:
Feb  7 08:39:47 ait sshd[1679856]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.93.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.115.42.62
country_id: 1814991
description:
2025-02-07 08:39:26 dovecot_plain authenticator failed for ([27.115.42.62]) [27.115.42.62]:45149: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.93.44
country_id: 1814991
description:
Feb  7 08:39:47 ait sshd[1679856]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.93.44


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 216.238.117.235
country_id: 3469034
domain: ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:08-40.216.238.117.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-02-07 08:41:09 dovecot_plain authenticator failed for (intly) [65.20.133.208]:48456: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.160.11
country_id: 174982
description:
Feb  7 08:41:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.160.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 08:40:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.200.71
country_id: 99237
description:
Feb  7 08:41:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.200.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.200.71
country_id: 99237
description:
2025-02-07 08:41:05 dovecot_plain authenticator failed for (hyambry) [65.20.200.71]:36935: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.133.208
country_id: 99237
description:
Feb  7 08:41:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.133.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.160.11
country_id: 174982
description:
2025-02-07 08:41:15 dovecot_login authenticator failed for (ADMIN) [185.253.160.11]:59986: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 08:41:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.102.48.193
country_id: 1814991
description:
Feb  7 08:41:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.102.48.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.65.21
country_id: 1814991
description:
Feb  7 08:42:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.65.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.83.152.180
country_id: 3469034
description:
[2025-02-07 08:42:09 +0100] info [webmaild] 170.83.152.180 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-02-07 08:42:10 dovecot_login authenticator failed for syn-172-248-047-114.res.spectrum.com [172.248.47.114]:51829: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.13.53
country_id: 1668284
description:
2025-02-07 08:42:15 dovecot_login authenticator failed for 111-70-13-53.emome-ip.hinet.net [111.70.13.53]:42762: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.196.240
country_id: 6252001
description:
2025-02-07 08:42:20 dovecot_login authenticator failed for (mobile-166-195-196-240.mycingular.net) [166.195.196.240]:35895: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.227.82.82
country_id: 3469034
description:
[2025-02-07 08:41:51 +0100] info [webmaild] 45.227.82.82 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.48.193
country_id: 1814991
description:
2025-02-07 08:41:52 dovecot_login authenticator failed for ([112.102.48.193]) [112.102.48.193]:52390: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.248.47.114
country_id: 6252001
description:
Feb  7 08:42:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.248.47.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.65.21
country_id: 1814991
description:
2025-02-07 08:42:09 dovecot_login authenticator failed for ([183.220.65.21]) [183.220.65.21]:58318: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.13.53
country_id: 1668284
description:
Feb  7 08:42:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.13.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.196.240
country_id: 6252001
description:
Feb  7 08:42:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.196.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.112.6.186
country_id: 1814991
description:
2025-02-07 08:42:30 dovecot_login authenticator failed for ([116.112.6.186]) [116.112.6.186]:39076: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.125.141.141
country_id: 1814991
description:
Feb  7 08:42:53 ait sshd[1681149]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.125.141.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.125.141.141
country_id: 1814991
description:
Feb  7 08:42:53 ait sshd[1681149]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.125.141.141


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.112.6.186
country_id: 1814991
description:
Feb  7 08:42:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.112.6.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.129.195
country_id: 6251999
description:
2025-02-07 08:43:32 dovecot_plain authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:43026: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.124.47.11
country_id: 1814991
description:
Feb  7 08:43:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.124.47.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.212.238
country_id: 1814991
description:
2025-02-07 08:43:51 dovecot_login authenticator failed for ([58.18.212.238]) [58.18.212.238]:55668: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.18.71.134
country_id: 3469034
description:
Feb  7 08:43:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.18.71.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.228.32.34
country_id: 1814991
description:
Feb  7 08:43:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.228.32.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.228.32.34
country_id: 1814991
description:
2025-02-07 08:43:31 dovecot_login authenticator failed for ([124.228.32.34]) [124.228.32.34]:42068: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.18.71.134
country_id: 3469034
description:
2025-02-07 08:43:57 dovecot_plain authenticator failed for (20118071134.host.telemar.net.br) [201.18.71.134]:37804: 535 Incorrect authentication data (set_id=ads21a00069y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.129.195
country_id: 6251999
description:
Feb  7 08:43:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.129.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.124.47.11
country_id: 1814991
description:
2025-02-07 08:43:39 dovecot_login authenticator failed for ([111.124.47.11]) [111.124.47.11]:60793: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.42.163.252
country_id: 660013
description:
Feb  7 08:43:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.42.163.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2025-02-07 08:43:40 dovecot_plain authenticator failed for ([84.238.92.245]) [84.238.92.245]:53528: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.145.188.130
country_id: 1814991
description:
Feb  7 08:43:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.145.188.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.42.163.252
country_id: 660013
description:
2025-02-07 08:43:46 dovecot_plain authenticator failed for ([185.42.163.252]) [185.42.163.252]:37680: 535 Incorrect authentication data (set_id=ads21a00069y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.145.188.130
country_id: 1814991
description:
2025-02-07 08:43:46 dovecot_login authenticator failed for ([119.145.188.130]) [119.145.188.130]:57398: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.212.238
country_id: 1814991
description:
Feb  7 08:43:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.212.238 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 204.10.194.36
country_id: 2921044
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:NeCklAce||WPU:NeCklAce||RSV:6.65||T:APACHE||MV:08-43.204.10.194.36


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.238.92.245
country_id: 2623032
description:
Feb  7 08:43:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.238.92.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.115.40.138
country_id: 1814991
description:
2025-02-07 08:45:09 dovecot_plain authenticator failed for ([27.115.40.138]) [27.115.40.138]:55811: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
country_id: 1814991
description:
Feb  7 08:45:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.150.100.139
country_id: 6252001
description:
Feb  7 08:44:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.150.100.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.139.133.238
country_id: 1814991
description:
2025-02-07 08:44:55 dovecot_plain authenticator failed for ([123.139.133.238]) [123.139.133.238]:42690: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.150.100.139
country_id: 6252001
description:
2025-02-07 08:44:57 dovecot_login authenticator failed for ([107.150.100.139]) [107.150.100.139]:49306: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.84.54.180
country_id: 2635167
description:
2025-02-07 08:45:05 dovecot_login authenticator failed for (paritordatamine.co.uk) [91.84.54.180]:55953: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.115.40.138
country_id: 1814991
description:
Feb  7 08:45:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.115.40.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.34.254
country_id: 2017370
description:
Feb  7 08:45:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.34.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.16.161.35
country_id: 953987
description:
2025-02-07 08:45:15 dovecot_login authenticator failed for ([105.16.161.35]) [105.16.161.35]:33120: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.214.10.178
country_id: 2245662
description:
Feb  7 08:44:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.214.10.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.53.82
country_id: 1814991
description:
Feb  7 08:44:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.53.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.94.0.159
country_id: 1861060
description:
Feb  7 08:44:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.94.0.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
country_id: 1814991
description:
2025-02-07 08:45:16 dovecot_login authenticator failed for ([61.153.208.38]) [61.153.208.38]:35073: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.90.114
country_id: 1814991
description:
Feb  7 08:44:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.90.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.200.51
country_id: 294640
description:
2025-02-07 08:44:49 dovecot_login authenticator failed for mail.infologic.co.il [85.130.200.51]:57441: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 144.126.215.9
country_id: 6252001
description:
[2025-02-07 08:44:50 +0100] info [cpaneld] 144.126.215.9 - ait002 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.24.93
country_id: 1835841
description:
2025-02-07 08:45:06 dovecot_login authenticator failed for ([218.149.24.93]) [218.149.24.93]:34658: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.142.12.44
country_id: 2017370
description:
2025-02-07 08:44:35 dovecot_plain authenticator failed for ([5.142.12.44]) [5.142.12.44]:43074: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.200.51
country_id: 294640
description:
Feb  7 08:44:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.200.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
country_id: 1861060
description:
2025-02-07 08:45:01 dovecot_plain authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:54063: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.34.254
country_id: 2017370
description:
2025-02-07 08:45:11 dovecot_login authenticator failed for broadband-5-228-34-254.ip.moscow.rt.ru [5.228.34.254]:52942: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.53.82
country_id: 1814991
description:
2025-02-07 08:44:45 dovecot_plain authenticator failed for ([60.172.53.82]) [60.172.53.82]:37311: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.90.114
country_id: 1814991
description:
2025-02-07 08:44:52 dovecot_plain authenticator failed for ([58.18.90.114]) [58.18.90.114]:60076: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.214.10.178
country_id: 2245662
description:
2025-02-07 08:44:27 dovecot_plain authenticator failed for ([41.214.10.178]) [41.214.10.178]:52468: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.1.214.102
country_id: 1835841
description:
Feb  7 08:45:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.1.214.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.16.161.35
country_id: 953987
description:
Feb  7 08:45:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.16.161.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.142.12.44
country_id: 2017370
description:
Feb  7 08:44:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.142.12.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.227.134
country_id: 1814991
description:
Feb  7 08:44:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.227.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.139.133.238
country_id: 1814991
description:
Feb  7 08:44:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.139.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.1.214.102
country_id: 1835841
description:
2025-02-07 08:45:04 dovecot_login authenticator failed for ([59.1.214.102]) [59.1.214.102]:46408: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.227.134
country_id: 1814991
description:
2025-02-07 08:44:51 dovecot_login authenticator failed for (134.227.160.222.adsl-pool.jlccptt.net.cn) [222.160.227.134]:35702: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.24.93
country_id: 1835841
description:
Feb  7 08:45:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.24.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.54.150
country_id: 1814991
description:
2025-02-07 08:45:55 dovecot_plain authenticator failed for ([61.169.54.150]) [61.169.54.150]:41265: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.177.106
country_id: 2275384
description:
Feb  7 08:46:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.177.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.113.101
country_id: 1835841
description:
2025-02-07 08:46:11 dovecot_plain authenticator failed for ([211.48.113.101]) [211.48.113.101]:60654: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.204.41.73
country_id: 1814991
description:
Feb  7 08:46:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.204.41.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.115.211
country_id: 1880251
description:
2025-02-07 08:45:33 dovecot_login authenticator failed for (211.115.156.175.unknown.m1.com.sg) [175.156.115.211]:46951: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.159.145.190
country_id: 2400553
description:
Feb  7 08:45:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.159.145.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.225.203.106
country_id: 1814991
description:
Feb  7 08:46:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.225.203.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
country_id: 1814991
description:
2025-02-07 08:46:08 dovecot_plain authenticator failed for ([122.225.203.106]) [122.225.203.106]:62767: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.54.150
country_id: 1814991
description:
Feb  7 08:45:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.54.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.159.145.190
country_id: 2400553
description:
2025-02-07 08:45:55 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:33334: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.177.106
country_id: 2275384
description:
2025-02-07 08:46:04 dovecot_plain authenticator failed for ([196.250.177.106]) [196.250.177.106]:36804: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.113.101
country_id: 1835841
description:
Feb  7 08:46:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.113.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.204.41.73
country_id: 1814991
description:
2025-02-07 08:46:22 dovecot_plain authenticator failed for ([183.204.41.73]) [183.204.41.73]:53409: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.208.71.101
country_id: 2017370
description:
Feb  7 08:45:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.208.71.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.71.101
country_id: 2017370
description:
2025-02-07 08:45:29 dovecot_login authenticator failed for ([82.208.71.101]) [82.208.71.101]:59310: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.115.211
country_id: 1880251
description:
Feb  7 08:45:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.115.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.206.136.24
country_id: 1814991
description:
2025-02-07 08:46:58 dovecot_login authenticator failed for ([218.206.136.24]) [218.206.136.24]:40620: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.106.198.35
country_id: 1835841
description:
2025-02-07 08:47:00 dovecot_login authenticator failed for ([222.106.198.35]) [222.106.198.35]:43620: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.32.104
country_id: 1269750
description:
2025-02-07 08:47:04 dovecot_plain authenticator failed for (183.82.32.104.actcorp.in) [183.82.32.104]:52269: 535 Incorrect authentication data (set_id=jessica1234)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.210.190.233
country_id: 1814991
description:
Feb  7 08:47:15 ait sshd[1682704]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.210.190.233


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.154.222
country_id: 1814991
description:
2025-02-07 08:47:17 dovecot_login authenticator failed for ([39.165.154.222]) [39.165.154.222]:47322: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.104.122.159
country_id: 6251999
description:
2025-02-07 08:47:17 dovecot_login authenticator failed for host-216-104-122-159.public.eastlink.ca [216.104.122.159]:51993: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.106.198.35
country_id: 1835841
description:
Feb  7 08:46:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.106.198.35 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.93.44
country_id: 1814991
description:
Feb  7 08:47:08 ait sshd[1682684]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.93.44


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.17.6.119
country_id: 1814991
description:
Feb  7 08:46:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.17.6.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.93.44
country_id: 1814991
description:
Feb  7 08:47:08 ait sshd[1682684]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.93.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.189.234.28
country_id: 6252001
description:
2025-02-07 08:47:03 dovecot_login authenticator failed for ([12.189.234.28]) [12.189.234.28]:36666: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.205.14.196
country_id: 226074
description:
2025-02-07 08:46:55 dovecot_login authenticator failed for ([129.205.14.196]) [129.205.14.196]:47628: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.254.126.238
country_id: 2661886
description:
Feb  7 08:47:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.254.126.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.244.246.221
country_id: 1835841
description:
Feb  7 08:47:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.244.246.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.244.246.221
country_id: 1835841
description:
2025-02-07 08:47:09 dovecot_login authenticator failed for ([1.244.246.221]) [1.244.246.221]:58676: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.189.234.28
country_id: 6252001
description:
Feb  7 08:47:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.189.234.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.82.32.104
country_id: 1269750
description:
Feb  7 08:47:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.82.32.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.104.122.159
country_id: 6251999
description:
Feb  7 08:47:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.104.122.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.205.14.196
country_id: 226074
description:
Feb  7 08:46:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.205.14.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.17.6.119
country_id: 1814991
description:
2025-02-07 08:46:56 dovecot_login authenticator failed for (119.6.17.58.adsl-pool.jx.chinaunicom.com) [58.17.6.119]:45136: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.201.228.210
country_id: 99237
description:
Feb  7 08:46:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.201.228.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2025-02-07 08:46:54 dovecot_plain authenticator failed for ([62.201.228.210]) [62.201.228.210]:51050: 535 Incorrect authentication data (set_id=jessica1234@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.206.136.24
country_id: 1814991
description:
Feb  7 08:46:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.206.136.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
country_id: 2661886
description:
2025-02-07 08:47:06 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se (subez) [83.254.126.238]:52310: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.154.222
country_id: 1814991
description:
Feb  7 08:47:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.154.222 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.129.230.222
country_id: 3469034
description:
[2025-02-07 08:46:51 +0100] info [webmaild] 177.129.230.222 - info@elma-hk.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.253.194.29
country_id: 1814991
description:
Feb  7 08:47:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.253.194.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.196.62
country_id: 1814991
description:
2025-02-07 08:47:40 dovecot_login authenticator failed for ([183.167.196.62]) [183.167.196.62]:42450: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
country_id: 1835841
description:
Feb  7 08:48:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.148.148.191
country_id: 2661886
description:
2025-02-07 08:47:36 dovecot_plain authenticator failed for c188-148-148-191.bredband.tele2.se (ovent) [188.148.148.191]:36459: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.196.62
country_id: 1814991
description:
Feb  7 08:47:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.196.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.226.210
country_id: 1814991
description:
Feb  7 08:47:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.226.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.210
country_id: 1814991
description:
2025-02-07 08:47:52 dovecot_plain authenticator failed for ([61.185.226.210]) [61.185.226.210]:35622: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.115.100.144
country_id: 272103
description:
Feb  7 08:48:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.115.100.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.115.100.144
country_id: 272103
description:
2025-02-07 08:48:17 dovecot_login authenticator failed for 3pc100-144.rconx.com [185.115.100.144]:48711: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.20.130
country_id: 1835841
description:
Feb  7 08:48:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.253.194.29
country_id: 1814991
description:
2025-02-07 08:47:38 dovecot_plain authenticator failed for ([58.253.194.29]) [58.253.194.29]:60550: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Feb  7 08:47:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.235.203.63
country_id: 6252001
description:
Feb  7 08:48:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.235.203.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.235.203.63
country_id: 6252001
description:
2025-02-07 08:48:03 dovecot_login authenticator failed for 108-235-203-63.lightspeed.chrlnc.sbcglobal.net [108.235.203.63]:63331: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.43.137.90
country_id: 1835841
description:
Feb  7 08:48:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.43.137.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.246
country_id: 1814991
description:
Feb  7 08:48:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2025-02-07 08:48:20 dovecot_plain authenticator failed for ([116.114.84.246]) [116.114.84.246]:43482: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.181.133.153
country_id: 3469034
description:
Feb  7 08:47:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.181.133.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
country_id: 1835841
description:
Feb  7 08:48:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.148.148.191
country_id: 2661886
description:
Feb  7 08:47:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.148.148.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.76.127
country_id: 1835841
description:
2025-02-07 08:47:36 dovecot_login authenticator failed for ([183.107.76.127]) [183.107.76.127]:50262: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.43.137.90
country_id: 1835841
description:
2025-02-07 08:48:19 dovecot_login authenticator failed for ([14.43.137.90]) [14.43.137.90]:49380: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
country_id: 1835841
description:
2025-02-07 08:48:19 dovecot_login authenticator failed for ([175.202.82.251]) [175.202.82.251]:38980: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2025-02-07 08:47:24 dovecot_login authenticator failed for ([179.181.135.1]) [179.181.133.153]:46598: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.30.127.9
country_id: 1814991
description:
Feb  7 08:48:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.30.127.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2025-02-07 08:48:52 dovecot_plain authenticator failed for ([175.206.113.91]) [175.206.113.91]:52880: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.129.94
country_id: 149590
description:
2025-02-07 08:48:55 dovecot_plain authenticator failed for host-41-220-129-94.habari.co.tz ([197.250.7.50]) [41.220.129.94]:51610: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.74
country_id: 2077456
description:
2025-02-07 08:48:56 dovecot_plain authenticator failed for ([203.189.124.74]) [203.189.124.74]:45248: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.170.218.142
country_id: 1835841
description:
2025-02-07 08:49:04 dovecot_plain authenticator failed for ([121.170.218.142]) [121.170.218.142]:59896: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.3.159.176
country_id: 6252001
description:
Feb  7 08:48:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.3.159.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.52
country_id: 1819730
description:
2025-02-07 08:48:37 dovecot_plain authenticator failed for (m121-202-154-52.smartone.com) [121.202.154.52]:62498: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.129.94
country_id: 149590
description:
Feb  7 08:48:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.129.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.97
country_id: 3469034
description:
2025-02-07 08:49:12 dovecot_plain authenticator failed for (97.196.181.45.datasysteminfor.com.br) [45.181.196.97]:51564: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.83
country_id: 1819730
description:
2025-02-07 08:49:13 dovecot_login authenticator failed for 083.42.246.220.static.netvigator.com [220.246.42.83]:54143: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2025-02-07 08:48:40 dovecot_login authenticator failed for ([218.106.120.18]) [58.49.113.138]:12104: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.62.67.73
country_id: 2510769
description:
Feb  7 08:48:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.62.67.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
country_id: 3469034
description:
Feb  7 08:48:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 08:48:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.125.43
country_id: 1835841
description:
2025-02-07 08:48:58 dovecot_plain authenticator failed for ([14.37.125.43]) [14.37.125.43]:53314: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.170.218.142
country_id: 1835841
description:
Feb  7 08:49:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.170.218.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
country_id: 1835841
description:
2025-02-07 08:48:23 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:43790: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.192.69.10
country_id: 1835841
description:
Feb  7 08:48:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.192.69.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.76.58.118
country_id: 1835841
description:
2025-02-07 08:49:14 dovecot_plain authenticator failed for ([61.76.58.118]) [61.76.58.118]:54806: 535 Incorrect authentication data (set_id=abuse@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.52.116
country_id: 1814991
description:
Feb  7 08:48:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.52.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.115.211
country_id: 1880251
description:
Feb  7 08:48:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.115.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.233.177
country_id: 1269750
description:
2025-02-07 08:48:40 dovecot_plain authenticator failed for (nsg-corporate-177.233.187.122.airtel.in) [122.187.233.177]:46980: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.113.91
country_id: 1835841
description:
Feb  7 08:48:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.113.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.125.43
country_id: 1835841
description:
Feb  7 08:48:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.125.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.100.230
country_id: 1814991
description:
2025-02-07 08:48:29 dovecot_login authenticator failed for ([180.168.100.230]) [180.168.100.230]:59874: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.192.131
country_id: 1835841
description:
Feb  7 08:48:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.192.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.20.146
country_id: 2017370
description:
2025-02-07 08:48:38 dovecot_plain authenticator failed for ([31.173.20.146]) [31.173.20.146]:58188: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.30.127.9
country_id: 1814991
description:
2025-02-07 08:48:42 dovecot_plain authenticator failed for ([112.29.109.174]) [112.30.127.9]:55247: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
country_id: 1835841
description:
2025-02-07 08:48:54 dovecot_plain authenticator failed for ([203.128.181.121]) [203.128.181.121]:56340: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.180.240.96
country_id: 1282988
description:
Feb  7 08:49:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.180.240.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 08:49:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.52
country_id: 1819730
description:
Feb  7 08:48:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
country_id: 1814991
description:
Feb  7 08:48:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.16
country_id: 1819730
description:
2025-02-07 08:48:38 dovecot_plain authenticator failed for ([121.202.155.16]) [121.202.155.16]:21617: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.102.179
country_id: 1814991
description:
2025-02-07 08:48:44 dovecot_plain authenticator failed for ([183.238.102.179]) [183.238.102.179]:59692: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
country_id: 3469034
description:
Feb  7 08:48:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.222.38.9
country_id: 3923057
description:
Feb  7 08:48:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.222.38.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.83
country_id: 1819730
description:
Feb  7 08:49:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.83 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.65.158.86
country_id: 3469034
description:
[2025-02-07 08:48:27 +0100] info [webmaild] 45.65.158.86 - info@gvu.university "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.159.176
country_id: 6252001
description:
2025-02-07 08:48:37 dovecot_plain authenticator failed for (192-3-159-176-host.colocrossing.com) [192.3.159.176]:38312: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.180.240.96
country_id: 1282988
description:
2025-02-07 08:49:06 dovecot_plain authenticator failed for ([103.180.240.96]) [103.180.240.96]:53192: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.196.97
country_id: 3469034
description:
Feb  7 08:49:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.196.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.62.67.73
country_id: 2510769
description:
2025-02-07 08:48:43 dovecot_plain authenticator failed for ([85.62.67.73]) [85.62.67.73]:60170: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.102.179
country_id: 1814991
description:
Feb  7 08:48:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.102.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.74
country_id: 2077456
description:
Feb  7 08:48:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.208.71.101
country_id: 2017370
description:
Feb  7 08:49:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.208.71.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.76.58.118
country_id: 1835841
description:
Feb  7 08:49:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.76.58.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.20.146
country_id: 2017370
description:
Feb  7 08:48:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.20.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.131
country_id: 1835841
description:
2025-02-07 08:48:39 dovecot_plain authenticator failed for ([1.235.192.131]) [1.235.192.131]:58924: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.233.177
country_id: 1269750
description:
Feb  7 08:48:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.233.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.214.127
country_id: 1814991
description:
2025-02-07 08:48:41 dovecot_plain authenticator failed for ([223.241.214.127]) [223.241.214.127]:53016: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.67.133.193
country_id: 1814991
description:
Feb  7 08:48:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.67.133.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.141.194.159
country_id: 1835841
description:
2025-02-07 08:49:12 dovecot_plain authenticator failed for ([121.141.194.159]) [121.141.194.159]:44908: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.100.230
country_id: 1814991
description:
Feb  7 08:48:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.100.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.16
country_id: 1819730
description:
Feb  7 08:48:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.16 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.131.171.170
country_id: 3686110
description:
[2025-02-07 08:48:47 +0100] info [webmaild] 181.131.171.170 - info@ijari.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.115.211
country_id: 1880251
description:
2025-02-07 08:48:51 dovecot_plain authenticator failed for (211.115.156.175.unknown.m1.com.sg) [175.156.115.211]:52740: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.222.38.9
country_id: 3923057
description:
2025-02-07 08:49:00 dovecot_plain authenticator failed for (scz-177-222-38-00009.tigo.bo) [177.222.38.9]:33311: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
country_id: 1835841
description:
2025-02-07 08:49:00 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:44998: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.71.101
country_id: 2017370
description:
2025-02-07 08:49:04 dovecot_plain authenticator failed for ([82.208.71.101]) [82.208.71.101]:60982: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
country_id: 1694008
description:
2025-02-07 08:48:43 dovecot_login authenticator failed for ([203.177.65.26]) [58.69.17.18]:36758: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.67.133.193
country_id: 1814991
description:
2025-02-07 08:48:45 dovecot_plain authenticator failed for ([222.67.133.193]) [222.67.133.193]:54819: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.192.69.10
country_id: 1835841
description:
2025-02-07 08:48:40 dovecot_plain authenticator failed for ([113.192.69.10]) [113.192.69.10]:56798: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
country_id: 1814991
description:
2025-02-07 08:48:41 dovecot_plain authenticator failed for ([27.223.100.94]) [27.223.100.90]:56294: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
country_id: 1835841
description:
Feb  7 08:48:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
country_id: 1835841
description:
Feb  7 08:48:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.20.130
country_id: 1835841
description:
2025-02-07 08:48:23 dovecot_login authenticator failed for ([123.212.20.130]) [123.212.20.130]:54402: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.52.116
country_id: 1814991
description:
2025-02-07 08:48:32 dovecot_login authenticator failed for ([111.53.52.116]) [111.53.52.116]:55048: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.141.194.159
country_id: 1835841
description:
Feb  7 08:49:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.141.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
country_id: 3469034
description:
2025-02-07 08:48:26 dovecot_plain authenticator failed for (18712549.telemar.net.br) [187.76.174.254]:57303: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
country_id: 1694008
description:
Feb  7 08:48:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
country_id: 3469034
description:
2025-02-07 08:48:50 dovecot_plain authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:26643: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.241.214.127
country_id: 1814991
description:
Feb  7 08:48:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.241.214.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
country_id: 1814991
description:
Feb  7 08:48:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.179.34
country_id: 1880251
description:
2025-02-07 08:50:14 dovecot_login authenticator failed for ([188.166.179.34]) [188.166.179.34]:43634: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.163.57.10
country_id: 1643084
description:
Feb  7 08:49:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.163.57.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.20.253.109
country_id: 6252001
description:
Feb  7 08:49:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.20.253.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.253.125.205
country_id: 1814991
description:
Feb  7 08:49:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.253.125.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.166.179.34
country_id: 1880251
description:
Feb  7 08:50:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.166.179.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.143.51.58
country_id: 2635167
description:
Feb  7 08:50:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.143.51.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.133.182
country_id: 1835841
description:
Feb  7 08:50:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.133.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.143.51.58
country_id: 2635167
description:
2025-02-07 08:50:19 dovecot_plain authenticator failed for host81-143-51-58.in-addr.btopenworld.com (eopocheae) [81.143.51.58]:54132: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.87.237
country_id: 1814991
description:
2025-02-07 08:49:25 dovecot_login authenticator failed for ([61.150.87.237]) [61.150.87.237]:57530: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.150.88.22
country_id: 1814991
description:
Feb  7 08:49:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.150.88.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.20.253.109
country_id: 6252001
description:
2025-02-07 08:49:39 dovecot_login authenticator failed for (173-20-253-109.client.mchsi.com) [173.20.253.109]:59362: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.21.36.101
country_id: 1814991
description:
Feb  7 08:49:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.21.36.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.253.125.205
country_id: 1814991
description:
2025-02-07 08:49:50 dovecot_login authenticator failed for ([183.253.125.205]) [183.253.125.205]:59163: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.38.21
country_id: 6252001
description:
Feb  7 08:50:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.38.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.38.21
country_id: 6252001
description:
2025-02-07 08:50:19 dovecot_login authenticator failed for ([158.140.38.21]) [158.140.38.21]:55610: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.152.99.171
country_id: 6252001
description:
Feb  7 08:49:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.152.99.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.150.87.237
country_id: 1814991
description:
Feb  7 08:49:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.150.87.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.171
country_id: 6252001
description:
2025-02-07 08:49:24 dovecot_login authenticator failed for syn-184-152-099-171.res.spectrum.com [184.152.99.171]:39998: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.88.22
country_id: 1814991
description:
2025-02-07 08:49:29 dovecot_login authenticator failed for ([61.150.88.22]) [61.150.88.22]:33705: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
country_id: 1831722
description:
Feb  7 08:50:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.163.57.10
country_id: 1643084
description:
2025-02-07 08:49:29 dovecot_login authenticator failed for (ip-103-133.222-205.cloudteknologinusantara.co.id) [125.163.57.10]:35622: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.21.36.101
country_id: 1814991
description:
2025-02-07 08:49:42 dovecot_login authenticator failed for ([14.21.36.101]) [14.21.36.101]:40452: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.133.182
country_id: 1835841
description:
2025-02-07 08:50:20 dovecot_login authenticator failed for ([61.81.133.182]) [61.81.133.182]:46993: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.1.40.151
country_id: 6251999
description:
Feb  7 08:50:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.1.40.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.196.214
country_id: 6252001
description:
Feb  7 08:50:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.196.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.165.148.166
country_id: 3469034
description:
Feb  7 08:51:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.165.148.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.82
country_id: 1835841
description:
Feb  7 08:50:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.138
country_id: 3077311
description:
2025-02-07 08:50:38 dovecot_login authenticator failed for (ADMIN) [212.102.39.138]:58172: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.88.154.47
country_id: 1880251
description:
2025-02-07 08:50:53 dovecot_plain authenticator failed for (47.154.88.116.starhub.net.sg) [116.88.154.47]:47933: 535 Incorrect authentication data (set_id=ug88m8880009)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
country_id: 6252001
description:
2025-02-07 08:50:59 dovecot_login authenticator failed for syn-208-105-196-214.biz.spectrum.com (rrcs-208-105-196-214.nys.biz.rr.com) [208.105.196.214]:43275: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.202.80.152
country_id: 1835841
description:
Feb  7 08:51:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.202.80.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.202.80.152
country_id: 1835841
description:
2025-02-07 08:51:32 dovecot_plain authenticator failed for ([114.202.80.152]) [114.202.80.152]:44248: 535 Incorrect authentication data (set_id=ads07b99022y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.215.107.189
country_id: 3469034
description:
Feb  7 08:50:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.215.107.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.195.208.171
country_id: 1814991
description:
Feb  7 08:50:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.195.208.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.208.171
country_id: 1814991
description:
2025-02-07 08:50:49 dovecot_login authenticator failed for ([221.195.208.171]) [221.195.208.171]:15914: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.148.216.117
country_id: 1210997
description:
Feb  7 08:50:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.148.216.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.216.117
country_id: 1210997
description:
2025-02-07 08:50:54 dovecot_login authenticator failed for ([103.148.216.98]) [103.148.216.117]:35490: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.195.122.188
country_id: 1814991
description:
Feb  7 08:51:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.195.122.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
country_id: 3469034
description:
2025-02-07 08:51:20 dovecot_plain authenticator failed for (148166.telemar.net.br) [200.165.148.166]:48465: 535 Incorrect authentication data (set_id=ads07b99022y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-51.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.102.39.138
country_id: 3077311
description:
Feb  7 08:50:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.102.39.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.107.189
country_id: 3469034
description:
2025-02-07 08:50:42 dovecot_plain authenticator failed for (biophormula.static.gvt.net.br) [186.215.107.189]:40391: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.88.154.47
country_id: 1880251
description:
Feb  7 08:50:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.88.154.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.122.188
country_id: 1814991
description:
2025-02-07 08:51:20 dovecot_login authenticator failed for ([221.195.122.188]) [221.195.122.188]:36369: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.82
country_id: 1835841
description:
2025-02-07 08:50:36 dovecot_login authenticator failed for ([58.230.236.82]) [58.230.236.82]:45566: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2025-02-07 08:50:41 dovecot_login authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:35257: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.196.78
country_id: 1814991
description:
Feb  7 08:51:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.196.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.196.78
country_id: 1814991
description:
2025-02-07 08:51:38 dovecot_plain authenticator failed for ([39.152.196.78]) [39.152.196.78]:55189: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.34
country_id: 617790
description:
2025-02-07 08:51:53 dovecot_plain authenticator failed for ([185.167.56.34]) [185.167.56.34]:50654: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.125.141.141
country_id: 1814991
description:
Feb  7 08:52:00 ait sshd[1684881]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.125.141.141


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
country_id: 1835841
description:
Feb  7 08:51:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.125.141.141
country_id: 1814991
description:
Feb  7 08:52:00 ait sshd[1684881]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.125.141.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.124.119.7
country_id: 1814991
description:
2025-02-07 08:52:19 dovecot_plain authenticator failed for ([118.122.255.5]) [118.124.119.7]:38004: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.14.192.20
country_id: 1835841
description:
2025-02-07 08:51:42 dovecot_plain authenticator failed for ([110.14.192.20]) [110.14.192.20]:60432: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.1.239.146
country_id: 1814991
description:
Feb  7 08:52:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.1.239.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 08:52:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.2
country_id: 2077456
description:
2025-02-07 08:52:17 dovecot_plain authenticator failed for ([203.189.124.2]) [203.189.124.2]:42678: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.132.42.170
country_id: 1814991
description:
Feb  7 08:51:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.132.42.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.132.42.170
country_id: 1814991
description:
2025-02-07 08:51:44 dovecot_plain authenticator failed for ([116.132.42.170]) [116.132.42.170]:49393: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.35.200.202
country_id: 2921044
description:
Feb  7 08:52:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.35.200.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
country_id: 1269750
description:
2025-02-07 08:52:32 dovecot_plain authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:35602: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.14.192.20
country_id: 1835841
description:
Feb  7 08:51:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.14.192.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.34
country_id: 617790
description:
Feb  7 08:51:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.98.39
country_id: 2077456
description:
2025-02-07 08:51:52 dovecot_plain authenticator failed for ([203.147.98.39]) [203.147.98.39]:58714: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.200.202
country_id: 2921044
description:
2025-02-07 08:52:02 dovecot_plain authenticator failed for ([161.35.200.202]) [161.35.200.202]:36916: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.124.119.7
country_id: 1814991
description:
Feb  7 08:52:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.124.119.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.47.74.210
country_id: 1269750
description:
2025-02-07 08:51:56 dovecot_plain authenticator failed for ([103.47.74.210]) [103.47.74.210]:60378: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.2
country_id: 2077456
description:
Feb  7 08:52:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
country_id: 1835841
description:
2025-02-07 08:51:37 dovecot_login authenticator failed for ([211.105.213.144]) [211.105.213.144]:46720: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.202.250.46
country_id: 3469034
description:
Feb  7 08:51:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.202.250.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-02-07 08:51:44 dovecot_plain authenticator failed for ([200.202.250.46]) [200.202.250.46]:45913: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.147.98.39
country_id: 2077456
description:
Feb  7 08:51:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.147.98.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.47.74.210
country_id: 1269750
description:
Feb  7 08:51:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.47.74.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.239.146
country_id: 1814991
description:
2025-02-07 08:52:04 dovecot_plain authenticator failed for ([218.1.239.146]) [218.1.239.146]:21888: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
country_id: 1269750
description:
Feb  7 08:52:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.130.137.207
country_id: 2017370
description:
Feb  7 08:52:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.130.137.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.70.28
country_id: 1835841
description:
Feb  7 08:53:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.70.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.70.28
country_id: 1835841
description:
2025-02-07 08:53:20 dovecot_login authenticator failed for ([110.34.70.28]) [110.34.70.28]:50980: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.73.70.43
country_id: 2661886
description:
2025-02-07 08:53:43 dovecot_login authenticator failed for 78-73-70-43-no600.tbcn.telia.com [78.73.70.43]:51932: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.73.70.43
country_id: 2661886
description:
Feb  7 08:53:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.73.70.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 08:54:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.125.141.141
country_id: 1814991
description:
Feb  7 08:55:21 ait sshd[1685880]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.125.141.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.136.195.32
country_id: 1814991
description:
Feb  7 08:55:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.136.195.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 08:54:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 08:55:06 ait sshd[1685851]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 08:55:06 ait sshd[1685851]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206  user=ftp


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.125.141.141
country_id: 1814991
description:
Feb  7 08:55:21 ait sshd[1685880]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.125.141.141


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.231.223
country_id: 6252001
description:
2025-02-07 08:55:49 dovecot_plain authenticator failed for ([104.241.231.223]) [104.241.231.223]:39218: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 08:55:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.136.195.32
country_id: 1814991
description:
2025-02-07 08:55:34 dovecot_plain authenticator failed for (32.195.136.122.adsl-pool.jlccptt.net.cn) [122.136.195.32]:48254: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.231.223
country_id: 6252001
description:
Feb  7 08:55:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.231.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.23
country_id: 1819730
description:
Feb  7 08:57:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.97.90.143
country_id: 1814991
description:
Feb  7 08:57:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.97.90.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
country_id: 1269750
description:
Feb  7 08:56:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-02-07 08:56:44 dovecot_plain authenticator failed for ([103.107.36.18]) [103.107.36.18]:54850: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.105
country_id: 390903
description:
2025-02-07 08:57:03 dovecot_login authenticator failed for (ADMIN) [79.127.181.105]:41454: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.69.46.149
country_id: 1168579
description:
2025-02-07 08:57:06 dovecot_plain authenticator failed for ([202.69.46.149]) [202.69.46.149]:49685: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.23
country_id: 1819730
description:
2025-02-07 08:57:17 dovecot_plain authenticator failed for ([121.202.152.23]) [121.202.152.23]:46916: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.164.165
country_id: 298795
description:
2025-02-07 08:56:51 dovecot_login authenticator failed for ([5.11.164.165]) [5.11.164.165]:56854: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.69.46.149
country_id: 1168579
description:
Feb  7 08:57:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.69.46.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.172.79.206
country_id: 1835841
description:
Feb  7 08:57:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.172.79.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.172.79.206
country_id: 1835841
description:
2025-02-07 08:57:14 dovecot_login authenticator failed for ([211.172.79.206]) [211.172.79.206]:58748: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.97.90.143
country_id: 1814991
description:
2025-02-07 08:57:32 dovecot_plain authenticator failed for ([180.97.90.143]) [180.97.90.143]:55588: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Feb  7 08:56:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 08:56:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.164.165
country_id: 298795
description:
Feb  7 08:56:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.164.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-02-07 08:56:39 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (zinal) [87.103.126.54]:40300: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.170.102
country_id: 1814991
description:
2025-02-07 08:57:58 dovecot_plain authenticator failed for ([183.234.170.102]) [183.234.170.102]:39196: 535 Incorrect authentication data (set_id=abuse@elmisa.com)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.116.106
country_id: 1880251
description:
47.128.116.106 - - [07/Feb/2025:08:57:58 +0100] "GET /images/facebook.png HTTP/2.0" 415 176 ait-edu.us "https://ait-edu.us/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16911751" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.116.106


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.112.141.230
country_id: 2750405
description:
Feb  7 08:58:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.112.141.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.252.225
country_id: 6252001
description:
Feb  7 08:58:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.252.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.112.141.230
country_id: 2750405
description:
2025-02-07 08:58:06 dovecot_plain authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:36918: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.131.211.168
country_id: 690791
description:
Feb  7 08:58:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.131.211.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.170.102
country_id: 1814991
description:
Feb  7 08:57:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.170.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.252.225
country_id: 6252001
description:
2025-02-07 08:58:08 dovecot_plain authenticator failed for syn-076-176-252-225.res.spectrum.com [76.176.252.225]:41446: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 08:58:09 ait sshd[1686978]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.137.30
country_id: 1835841
description:
2025-02-07 08:58:17 dovecot_plain authenticator failed for ([1.237.137.30]) [1.237.137.30]:40612: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 08:57:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 08:58:09 ait sshd[1686978]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=gvu


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.10.28.249
country_id: 1282988
description:
[2025-02-07 08:58:09 +0100] info [webmaild] 103.10.28.249 - info@iric.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.237.137.30
country_id: 1835841
description:
Feb  7 08:58:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.237.137.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2025-02-07 08:58:19 dovecot_login authenticator failed for ([94.131.211.168]) [94.131.211.168]:60652: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.247.74
country_id: 1814991
description:
2025-02-07 08:58:59 dovecot_plain authenticator failed for ([183.234.247.74]) [183.234.247.74]:54811: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.151
country_id: 1814991
description:
2025-02-07 08:59:15 dovecot_plain authenticator failed for ([36.134.78.151]) [36.134.78.151]:47397: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 08:59:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.247.74
country_id: 1814991
description:
Feb  7 08:58:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.247.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
country_id: 1835841
description:
Feb  7 08:59:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2025-02-07 08:59:08 dovecot_login authenticator failed for ([203.123.219.137]) [203.123.219.137]:45027: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.134.78.151
country_id: 1814991
description:
Feb  7 08:59:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.134.78.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.6.43.236
country_id: 1814991
description:
Feb  7 08:58:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.6.43.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.43.236
country_id: 1814991
description:
2025-02-07 08:58:38 dovecot_login authenticator failed for ([183.6.43.236]) [183.6.43.236]:53961: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.140.244.144
country_id: 1835841
description:
Feb  7 08:58:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.140.244.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.140.244.144
country_id: 1835841
description:
2025-02-07 08:58:52 dovecot_login authenticator failed for ([125.140.244.144]) [125.140.244.144]:59014: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 08:59:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.122.139.172
country_id: 6252001
description:
2025-02-07 08:59:58 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:58309: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.53.172
country_id: 1668284
description:
2025-02-07 09:00:09 dovecot_plain authenticator failed for ([58.115.53.172]) [58.115.53.172]:51331: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.237.66
country_id: 6252001
description:
Feb  7 09:00:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.237.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.237.66
country_id: 6252001
description:
2025-02-07 09:00:15 dovecot_login authenticator failed for ([104.241.237.66]) [104.241.237.66]:41980: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.72.99
country_id: 1269750
description:
Feb  7 09:00:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.72.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.72.99
country_id: 1269750
description:
2025-02-07 09:00:12 dovecot_plain authenticator failed for ([152.52.72.99]) [152.52.72.99]:62849: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.122.139.172
country_id: 6252001
description:
Feb  7 08:59:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.122.139.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.1.159
country_id: 1668284
description:
Feb  7 08:59:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.1.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.1.159
country_id: 1668284
description:
2025-02-07 09:00:00 dovecot_plain authenticator failed for 111-70-1-159.emome-ip.hinet.net [111.70.1.159]:41055: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.115.53.172
country_id: 1668284
description:
Feb  7 09:00:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.115.53.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.174.3.182
country_id: 2658434
description:
Feb  7 09:00:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.174.3.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.138.162
country_id: 1168579
description:
2025-02-07 09:00:45 dovecot_plain authenticator failed for ([182.176.138.162]) [182.176.138.162]:55409: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-02-07 09:00:45 dovecot_plain authenticator failed for syn-172-248-047-114.res.spectrum.com [172.248.47.114]:55960: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2025-02-07 09:00:46 dovecot_plain authenticator failed for ([190.223.36.108]) [190.223.36.108]:52074: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.106.198.35
country_id: 1835841
description:
Feb  7 09:00:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.106.198.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.147.64
country_id: 3469034
description:
2025-02-07 09:00:53 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.147.64]:47723: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.39.230.40
country_id: 1835841
description:
2025-02-07 09:00:54 dovecot_plain authenticator failed for ([118.39.230.40]) [118.39.230.40]:1480: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Feb  7 09:00:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.224.22.135
country_id: 6252001
description:
Feb  7 09:01:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.224.22.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.129.201.81
country_id: 1210997
description:
2025-02-07 09:01:13 dovecot_plain authenticator failed for ([103.129.201.82]) [103.129.201.81]:55260: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.32.250.174
country_id: 1814991
description:
Feb  7 09:00:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.32.250.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.241.197
country_id: 1814991
description:
2025-02-07 09:00:48 dovecot_plain authenticator failed for ([183.220.241.197]) [183.220.241.197]:51684: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.199.209.60
country_id: 1269750
description:
Feb  7 09:00:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.199.209.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.254.158
country_id: 1210997
description:
Feb  7 09:01:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.254.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.195.208.171
country_id: 1814991
description:
Feb  7 09:01:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.195.208.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.208.171
country_id: 1814991
description:
2025-02-07 09:01:17 dovecot_plain authenticator failed for ([221.195.208.171]) [221.195.208.171]:29862: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.23.77.27
country_id: 1814991
description:
Feb  7 09:00:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.23.77.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2025-02-07 09:00:49 dovecot_plain authenticator failed for ([182.239.78.124]) [182.239.78.124]:47566: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.178
country_id: 1835841
description:
Feb  7 09:00:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.178
country_id: 1835841
description:
2025-02-07 09:00:52 dovecot_plain authenticator failed for ([218.149.228.178]) [218.149.228.178]:60210: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.35.199.239
country_id: 2635167
description:
2025-02-07 09:00:59 dovecot_plain authenticator failed for ([89.35.199.239]) [89.35.199.239]:58570: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.32.250.174
country_id: 1814991
description:
2025-02-07 09:01:00 dovecot_plain authenticator failed for ([117.32.250.174]) [117.32.250.174]:46444: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.127.124.229
country_id: 2510769
description:
2025-02-07 09:01:01 dovecot_plain authenticator failed for 229.red-217-127-124.staticip.rima-tde.net [217.127.124.229]:52096: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
country_id: 1814991
description:
2025-02-07 09:01:08 dovecot_plain authenticator failed for ([223.80.109.135]) [27.223.100.90]:44620: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.199.147
country_id: 1819730
description:
Feb  7 09:00:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.199.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.237.10
country_id: 290557
description:
Feb  7 09:01:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.237.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.196.30.122
country_id: 1269750
description:
2025-02-07 09:01:10 dovecot_plain authenticator failed for ([103.196.30.122]) [103.196.30.122]:49398: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.84
country_id: 1819730
description:
2025-02-07 09:01:12 dovecot_login authenticator failed for ([118.26.153.84]) [118.26.153.84]:60750: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.252.8.34
country_id: 1643084
description:
2025-02-07 09:00:57 dovecot_plain authenticator failed for ([43.252.8.34]) [43.252.8.34]:39370: 535 Incorrect authentication data (set_id=eng21a00034y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.6.250.109
country_id: 2635167
description:
Feb  7 09:01:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.6.250.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.237.10
country_id: 290557
description:
2025-02-07 09:01:16 dovecot_plain authenticator failed for ([94.204.237.10]) [94.204.237.10]:57662: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.174.3.182
country_id: 2658434
description:
2025-02-07 09:00:45 dovecot_plain authenticator failed for 182.3.174.178.static.wline.lns.sme.cust.swisscom.ch [178.174.3.182]:41711: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.35.199.239
country_id: 2635167
description:
Feb  7 09:00:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.35.199.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.30.234.153
country_id: 6252001
description:
Feb  7 09:00:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.30.234.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.106.67.50
country_id: 6252001
description:
2025-02-07 09:00:57 dovecot_plain authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:38432: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
country_id: 3017382
description:
Feb  7 09:01:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.202.24.117
country_id: 1814991
description:
2025-02-07 09:01:04 dovecot_plain authenticator failed for ([120.202.24.117]) [120.202.24.117]:42865: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-02-07 09:00:42 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:30441: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.241.197
country_id: 1814991
description:
Feb  7 09:00:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.241.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.213.57.49
country_id: 1835841
description:
Feb  7 09:00:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.213.57.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
country_id: 3469034
description:
2025-02-07 09:00:58 dovecot_plain authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:57775: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.100.181
country_id: 2017370
description:
Feb  7 09:01:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.100.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.22.116.38
country_id: 6252001
description:
2025-02-07 09:01:00 dovecot_plain authenticator failed for ([134.22.116.38]) [134.22.116.38]:37448: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.100.181
country_id: 2017370
description:
2025-02-07 09:01:03 dovecot_plain authenticator failed for (broadband-37.204-100-181.ip.moscow.rt.ru) [37.204.100.181]:53892: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.0.200
country_id: 1814991
description:
Feb  7 09:01:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.0.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-02-07 09:00:45 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:53552: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.114.230
country_id: 6252001
description:
2025-02-07 09:01:33 dovecot_plain authenticator failed for zdomainaccess.com [216.70.114.230]:43658: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.0.200
country_id: 1814991
description:
2025-02-07 09:01:32 dovecot_login authenticator failed for ([218.22.0.200]) [218.22.0.200]:41322: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.252.8.34
country_id: 1643084
description:
Feb  7 09:00:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.252.8.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
country_id: 1814991
description:
Feb  7 09:01:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.224.22.135
country_id: 6252001
description:
2025-02-07 09:01:06 dovecot_plain authenticator failed for ([50.224.22.135]) [50.224.22.135]:48600: 535 Incorrect authentication data (set_id=eng21a00034y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
country_id: 1512440
description:
2025-02-07 09:00:50 dovecot_plain authenticator failed for ([213.230.65.53]) [213.230.65.53]:52264: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.147.64
country_id: 3469034
description:
Feb  7 09:00:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.147.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.39.230.40
country_id: 1835841
description:
Feb  7 09:00:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.39.230.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.16
country_id: 1819730
description:
2025-02-07 09:00:55 dovecot_plain authenticator failed for ([121.202.155.16]) [121.202.155.16]:4748: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
country_id: 1269750
description:
2025-02-07 09:00:57 dovecot_plain authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:46496: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 185.98.5.103
country_id: 1522867
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-01.185.98.5.103


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.239.78.124
country_id: 1819730
description:
Feb  7 09:00:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.239.78.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
country_id: 3469034
description:
Feb  7 09:00:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.22.116.38
country_id: 6252001
description:
Feb  7 09:00:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.22.116.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.202.24.117
country_id: 1814991
description:
Feb  7 09:01:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.202.24.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.180
country_id: 2542007
description:
Feb  7 09:00:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
country_id: 1269750
description:
Feb  7 09:00:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.30.234.153
country_id: 6252001
description:
2025-02-07 09:01:00 dovecot_plain authenticator failed for s153-234-30-96.ssvec.az.wi-power.com [96.30.234.153]:52230: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.6.250.109
country_id: 2635167
description:
2025-02-07 09:01:10 dovecot_plain authenticator failed for 109.250.6.51.dyn.plus.net [51.6.250.109]:50544: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.129.201.81
country_id: 1210997
description:
Feb  7 09:01:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.129.201.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.213.57.49
country_id: 1835841
description:
2025-02-07 09:00:48 dovecot_plain authenticator failed for ([182.213.57.49]) [182.213.57.49]:48224: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.62.34.216
country_id: 6252001
description:
Feb  7 09:00:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.62.34.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.16
country_id: 1819730
description:
Feb  7 09:00:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.106.67.50
country_id: 6252001
description:
Feb  7 09:00:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.106.67.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.26.153.84
country_id: 1819730
description:
Feb  7 09:01:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.26.153.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.151.154.196
country_id: 2921044
description:
2025-02-07 09:00:43 dovecot_plain authenticator failed for p50979ac4.dip0.t-ipconnect.de [80.151.154.196]:41178: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
country_id: 3017382
description:
2025-02-07 09:01:06 dovecot_plain authenticator failed for (embetabary) [185.113.51.55]:49630: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.248.47.114
country_id: 6252001
description:
Feb  7 09:00:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.248.47.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.199.147
country_id: 1819730
description:
2025-02-07 09:00:42 dovecot_plain authenticator failed for (m121-202-199-147.smartone.com) [121.202.199.147]:17775: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.65.53
country_id: 1512440
description:
Feb  7 09:00:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.65.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.199.209.60
country_id: 1269750
description:
2025-02-07 09:01:01 dovecot_plain authenticator failed for (ws60-209.199.103.rcil.gov.in) [103.199.209.60]:56200: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.151.154.196
country_id: 2921044
description:
Feb  7 09:00:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.151.154.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.176.138.162
country_id: 1168579
description:
Feb  7 09:00:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.176.138.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.223.36.108
country_id: 3932488
description:
Feb  7 09:00:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.223.36.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.23.77.27
country_id: 1814991
description:
2025-02-07 09:00:48 dovecot_plain authenticator failed for ([14.23.77.27]) [14.23.77.27]:48838: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.106.198.35
country_id: 1835841
description:
2025-02-07 09:00:49 dovecot_plain authenticator failed for ([222.106.198.35]) [222.106.198.35]:56594: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.127.124.229
country_id: 2510769
description:
Feb  7 09:00:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.127.124.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.254.158
country_id: 1210997
description:
2025-02-07 09:01:03 dovecot_plain authenticator failed for ([103.115.254.158]) [103.115.254.158]:47495: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.196.30.122
country_id: 1269750
description:
Feb  7 09:01:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.196.30.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-02-07 09:00:35 dovecot_login authenticator failed for ([102.53.15.180]) [102.53.15.180]:33005: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.114.230
country_id: 6252001
description:
Feb  7 09:01:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.114.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.139.182.85
country_id: 1814991
description:
Feb  7 09:02:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.139.182.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.251.121.70
country_id: 1861060
description:
Feb  7 09:01:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.251.121.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
country_id: 3895114
description:
2025-02-07 09:02:01 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:42737: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.243.7.50
country_id: 1835841
description:
Feb  7 09:02:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.243.7.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.99
country_id: 6251999
description:
2025-02-07 09:02:28 dovecot_plain authenticator failed for ([207.219.221.99]) [207.219.221.99]:57885: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.139.55
country_id: 1814991
description:
Feb  7 09:02:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.139.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.193.45
country_id: 6252001
description:
2025-02-07 09:01:49 dovecot_plain authenticator failed for syn-208-105-193-045.biz.spectrum.com [208.105.193.45]:58415: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
country_id: 2017370
description:
Feb  7 09:01:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.2.14.94
country_id: 298795
description:
[2025-02-07 09:02:03 +0100] info [webmaild] 46.2.14.94 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
country_id: 1269750
description:
Feb  7 09:02:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.193.45
country_id: 6252001
description:
Feb  7 09:01:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.193.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.34.158.19
country_id: 3144096
description:
2025-02-07 09:01:48 dovecot_plain authenticator failed for ti0004q160-7861.bb.online.no [95.34.158.19]:58840: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.217.2.45
country_id: 597427
description:
Feb  7 09:02:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.217.2.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.243.7.50
country_id: 1835841
description:
2025-02-07 09:02:30 dovecot_plain authenticator failed for ([203.243.7.50]) [203.243.7.50]:48627: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.34.158.19
country_id: 3144096
description:
Feb  7 09:01:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.34.158.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.168.78
country_id: 3469034
description:
Feb  7 09:01:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.168.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
country_id: 2017370
description:
2025-02-07 09:01:57 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:60870: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.89.73
country_id: 1835841
description:
Feb  7 09:02:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.89.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
country_id: 3895114
description:
Feb  7 09:01:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.197.68.116
country_id: 1880251
description:
Feb  7 09:02:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.197.68.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.96.151.110
country_id: 1814991
description:
Feb  7 09:02:30 ait sshd[1688639]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.96.151.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.68.116
country_id: 1880251
description:
2025-02-07 09:02:32 dovecot_plain authenticator failed for (116.68.197.124.unknown.m1.com.sg) [124.197.68.116]:42916: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2025-02-07 09:01:46 dovecot_plain authenticator failed for works.ssc-gr.info [160.251.121.70]:58928: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.94.125.250
country_id: 2017370
description:
Feb  7 09:02:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.94.125.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.94.125.250
country_id: 2017370
description:
2025-02-07 09:02:07 dovecot_plain authenticator failed for h77-94-125-250.static.bashtel.ru [77.94.125.250]:34463: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.99
country_id: 6251999
description:
Feb  7 09:02:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.139.182.85
country_id: 1814991
description:
2025-02-07 09:02:33 dovecot_plain authenticator failed for ([43.139.182.85]) [43.139.182.85]:59336: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.168.78
country_id: 3469034
description:
2025-02-07 09:01:54 dovecot_login authenticator failed for (78-168-168-45.weblinknet.com.br) [45.168.168.78]:57840: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.89.73
country_id: 1835841
description:
2025-02-07 09:02:04 dovecot_login authenticator failed for ([106.246.89.73]) [106.246.89.73]:34180: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
country_id: 1269750
description:
2025-02-07 09:02:16 dovecot_plain authenticator failed for (nsg-static-171.125.76.182-airtel.com) [182.76.87.90]:47734: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.139.55
country_id: 1814991
description:
2025-02-07 09:02:18 dovecot_plain authenticator failed for ([112.194.139.55]) [112.194.139.55]:44456: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.217.2.45
country_id: 597427
description:
2025-02-07 09:02:15 dovecot_plain authenticator failed for static-193-217-2-45.cust.tele2.lt [193.217.2.45]:52663: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.96.151.110
country_id: 1814991
description:
Feb  7 09:02:30 ait sshd[1688639]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.96.151.110


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.195.65
country_id: 6252001
description:
Feb  7 09:02:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.215.195.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.62.67.73
country_id: 2510769
description:
Feb  7 09:03:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.62.67.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.62.67.73
country_id: 2510769
description:
2025-02-07 09:03:30 dovecot_plain authenticator failed for ([85.62.67.73]) [85.62.67.73]:47280: 535 Incorrect authentication data (set_id=abs3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.162
country_id: 1835841
description:
Feb  7 09:02:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.162
country_id: 1835841
description:
2025-02-07 09:02:50 dovecot_plain authenticator failed for ([218.149.228.162]) [218.149.228.162]:48067: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.215.195.65
country_id: 6252001
description:
2025-02-07 09:02:40 dovecot_plain authenticator failed for (162-215-195-65.unifiedlayer.com) [162.215.195.65]:64615: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.88.152
country_id: 294640
description:
Feb  7 09:02:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.88.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.152
country_id: 294640
description:
2025-02-07 09:02:44 dovecot_plain authenticator failed for ([2.55.88.152]) [2.55.88.152]:52650: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.174.233.64
country_id: 2661886
description:
Feb  7 09:03:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.174.233.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.228.195.251
country_id: 1814991
description:
2025-02-07 09:03:54 dovecot_plain authenticator failed for ([116.228.195.251]) [116.228.195.251]:35428: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
country_id: 1814991
description:
2025-02-07 09:03:39 dovecot_plain authenticator failed for ([218.98.160.119]) [218.98.160.117]:18554: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.113.122.243
country_id: 1835841
description:
2025-02-07 09:03:39 dovecot_plain authenticator failed for ([210.113.122.243]) [210.113.122.243]:60720: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
country_id: 1819730
description:
Feb  7 09:03:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.188.40.123
country_id: 2017370
description:
Feb  7 09:03:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.188.40.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.188.40.123
country_id: 2017370
description:
2025-02-07 09:03:53 dovecot_plain authenticator failed for (90.188.40.123.stbur.ru) [90.188.40.123]:38818: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
country_id: 1814991
description:
Feb  7 09:03:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.102.76.10
country_id: 3932488
description:
2025-02-07 09:03:41 dovecot_plain authenticator failed for ([148.102.73.4]) [148.102.76.10]:42530: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Feb  7 09:04:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.134.126.162
country_id: 6252001
description:
2025-02-07 09:04:11 dovecot_plain authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:4318: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
country_id: 1835841
description:
Feb  7 09:04:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.181.81
country_id: 294640
description:
Feb  7 09:03:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.181.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.113.122.243
country_id: 1835841
description:
Feb  7 09:03:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.113.122.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.102.76.10
country_id: 3932488
description:
Feb  7 09:03:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.102.76.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.50
country_id: 2017370
description:
2025-02-07 09:03:56 dovecot_plain authenticator failed for ([178.178.222.50]) [178.178.222.50]:51580: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.73.70.43
country_id: 2661886
description:
Feb  7 09:03:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.73.70.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.102.66.226
country_id: 6251999
description:
Feb  7 09:03:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.102.66.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.102.66.226
country_id: 6251999
description:
2025-02-07 09:03:56 dovecot_plain authenticator failed for ([207.102.66.226]) [207.102.66.226]:62688: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.84.11.180
country_id: 1861060
description:
2025-02-07 09:04:07 dovecot_plain authenticator failed for ([59.84.11.180]) [59.84.11.180]:62698: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.139.55
country_id: 1814991
description:
2025-02-07 09:03:40 dovecot_plain authenticator failed for ([112.194.139.55]) [112.194.139.55]:43510: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.77.125
country_id: 2963597
description:
2025-02-07 09:03:41 dovecot_plain authenticator failed for ([80.233.77.125]) [80.233.77.125]:14733: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.221.64.10
country_id: 2413451
description:
Feb  7 09:03:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.221.64.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-02-07 09:03:45 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:43700: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
country_id: 3017382
description:
Feb  7 09:03:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.161.242.146
country_id: 1814991
description:
2025-02-07 09:04:12 dovecot_plain authenticator failed for (146.242.161.222.adsl-pool.jlccptt.net.cn) [222.161.242.146]:13787: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
country_id: 1835841
description:
2025-02-07 09:04:18 dovecot_plain authenticator failed for ([211.109.75.68]) [211.109.75.69]:64369: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.139.55
country_id: 1814991
description:
Feb  7 09:03:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.139.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
country_id: 3017382
description:
2025-02-07 09:03:55 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (conreepin) [51.255.84.180]:33594: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.174.233.64
country_id: 2661886
description:
2025-02-07 09:03:56 dovecot_plain authenticator failed for h-158-174-233-64.a192.priv.bahnhof.se [158.174.233.64]:44977: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.30
country_id: 1814991
description:
2025-02-07 09:04:04 dovecot_login authenticator failed for ([60.167.19.30]) [60.167.19.30]:58867: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.84.11.180
country_id: 1861060
description:
Feb  7 09:04:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.84.11.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.161.242.146
country_id: 1814991
description:
Feb  7 09:04:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.161.242.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.76.127
country_id: 1835841
description:
2025-02-07 09:04:18 dovecot_login authenticator failed for ([183.107.76.127]) [183.107.76.127]:42090: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.221.59
country_id: 1269750
description:
2025-02-07 09:03:37 dovecot_plain authenticator failed for (abts-north-static-059.221.160.122.airtelbroadband.in) [122.160.221.59]:37402: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.8.21
country_id: 2661886
description:
Feb  7 09:03:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.246.8.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.8.21
country_id: 2661886
description:
2025-02-07 09:03:47 dovecot_login authenticator failed for (ADMIN) [46.246.8.21]:39143: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.228.195.251
country_id: 1814991
description:
Feb  7 09:03:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.228.195.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.50
country_id: 2017370
description:
Feb  7 09:03:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.134.126.162
country_id: 6252001
description:
Feb  7 09:04:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.134.126.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.221.59
country_id: 1269750
description:
Feb  7 09:03:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.221.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.181.81
country_id: 294640
description:
2025-02-07 09:03:38 dovecot_plain authenticator failed for ([85.130.181.81]) [85.130.181.81]:54097: 535 Incorrect authentication data (set_id=abs3)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.97.0
country_id: 1880251
description:
47.128.97.0 - - [07/Feb/2025:09:03:53 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19036880 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=125%2C106&filter_course-language=118&instructor=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.97.0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.73.70.43
country_id: 2661886
description:
2025-02-07 09:04:01 dovecot_plain authenticator failed for 78-73-70-43-no600.tbcn.telia.com [78.73.70.43]:46512: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.30
country_id: 1814991
description:
Feb  7 09:04:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.233.77.125
country_id: 2963597
description:
Feb  7 09:03:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.233.77.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.64.10
country_id: 2413451
description:
2025-02-07 09:03:45 dovecot_plain authenticator failed for ([102.221.64.10]) [102.221.64.10]:51531: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.127.143.140
country_id: 1835841
description:
Feb  7 09:03:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.127.143.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.127.143.140
country_id: 1835841
description:
2025-02-07 09:03:53 dovecot_plain authenticator failed for ([116.127.143.140]) [116.127.143.140]:33392: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
country_id: 1835841
description:
Feb  7 09:04:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.222
country_id: 1819730
description:
2025-02-07 09:04:48 dovecot_plain authenticator failed for ([121.202.205.222]) [121.202.205.222]:22119: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.227.130.11
country_id: 3469034
description:
[2025-02-07 09:04:59 +0100] info [webmaild] 186.227.130.11 - info@aitopen.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.63
country_id: 1819730
description:
2025-02-07 09:05:05 dovecot_plain authenticator failed for (m121-202-201-63.smartone.com) [121.202.201.63]:55638: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.21.36.113
country_id: 1814991
description:
2025-02-07 09:05:07 dovecot_plain authenticator failed for ([14.21.36.113]) [14.21.36.113]:42502: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.21.36.113
country_id: 1814991
description:
Feb  7 09:05:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.21.36.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.4.150
country_id: 1814991
description:
2025-02-07 09:05:11 dovecot_plain authenticator failed for ([222.180.4.150]) [222.180.4.150]:50424: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
country_id: 1814991
description:
Feb  7 09:05:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.23.103
country_id: 1835841
description:
Feb  7 09:05:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.23.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
country_id: 1814991
description:
2025-02-07 09:05:33 dovecot_plain authenticator failed for ([112.111.61.229]) [112.111.61.229]:45230: 535 Incorrect authentication data (set_id=bscs18bit0012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.222
country_id: 1819730
description:
Feb  7 09:04:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.45.216.101
country_id: 6252001
description:
Feb  7 09:05:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.45.216.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.45.216.101
country_id: 6252001
description:
2025-02-07 09:05:13 dovecot_plain authenticator failed for c-73-45-216-101.hsd1.il.comcast.net [73.45.216.101]:40592: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
country_id: 1835841
description:
2025-02-07 09:04:50 dovecot_plain authenticator failed for ([211.105.213.144]) [211.105.213.144]:48328: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.172.120.32
country_id: 1814991
description:
Feb  7 09:04:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.172.120.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.172.120.32
country_id: 1814991
description:
2025-02-07 09:04:56 dovecot_plain authenticator failed for ([111.172.120.32]) [111.172.120.32]:43834: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.4.150
country_id: 1814991
description:
Feb  7 09:05:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.4.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.172.239.193
country_id: 3017382
description:
Feb  7 09:05:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.172.239.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.172.239.193
country_id: 3017382
description:
2025-02-07 09:05:33 dovecot_login authenticator failed for sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:55719: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
country_id: 6252001
description:
2025-02-07 09:05:44 dovecot_login authenticator failed for (70-90-99-29-ma-ne.hfc.comcastbusiness.net) [70.90.99.29]:52750: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.126.223.175
country_id: 2017370
description:
Feb  7 09:05:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.126.223.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.108.12
country_id: 1814991
description:
2025-02-07 09:06:31 dovecot_login authenticator failed for ([112.27.108.12]) [112.27.108.12]:33452: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.90.99.29
country_id: 6252001
description:
Feb  7 09:05:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.90.99.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
country_id: 2017370
description:
2025-02-07 09:05:53 dovecot_plain authenticator failed for ([92.126.223.175]) [92.126.223.175]:44910: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.26.146.182
country_id: 2017370
description:
2025-02-07 09:06:02 dovecot_plain authenticator failed for 94-26-146-182.arbital.ru [94.26.146.182]:46853: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.139
country_id: 1835841
description:
Feb  7 09:06:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.108.12
country_id: 1814991
description:
Feb  7 09:06:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.108.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.23.103
country_id: 1835841
description:
2025-02-07 09:05:35 dovecot_plain authenticator failed for ([115.23.23.103]) [115.23.23.103]:45724: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.191.131
country_id: 2017370
description:
2025-02-07 09:06:06 dovecot_plain authenticator failed for broadband-178-140-191-131.ip.moscow.rt.ru [178.140.191.131]:43590: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.245.227
country_id: 1835841
description:
Feb  7 09:06:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.245.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.245.227
country_id: 1835841
description:
2025-02-07 09:06:21 dovecot_plain authenticator failed for ([220.77.245.227]) [220.77.245.227]:47606: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.206.57.7
country_id: 2589581
description:
[2025-02-07 09:05:57 +0100] info [webmaild] 197.206.57.7 - info@university-publishing.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.191.131
country_id: 2017370
description:
Feb  7 09:06:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.191.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.139
country_id: 1835841
description:
2025-02-07 09:06:10 dovecot_plain authenticator failed for ([61.108.83.254]) [61.108.83.139]:46552: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.122
country_id: 2077456
description:
Feb  7 09:06:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.122
country_id: 2077456
description:
2025-02-07 09:06:44 dovecot_login authenticator failed for ([103.79.175.122]) [103.79.175.122]:47592: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-07.80.76.51.123


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 79.127.182.73
country_id: 719819
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:StephenAJnr||WPU:StephenAJnr||RSV:6.65||T:APACHE||MV:09-07.79.127.182.73


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
country_id: 1269750
description:
Feb  7 09:07:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-02-07 09:07:57 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:40940: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.168.173.87
country_id: 3175395
description:
Feb  7 09:08:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.168.173.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.138.18
country_id: 3469034
description:
Feb  7 09:08:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.138.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.239.78.124
country_id: 1819730
description:
Feb  7 09:07:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.239.78.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2025-02-07 09:07:41 dovecot_login authenticator failed for ([182.239.78.124]) [182.239.78.124]:60206: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.138.18
country_id: 3469034
description:
2025-02-07 09:08:22 dovecot_plain authenticator failed for ([189.44.138.18]) [189.44.138.18]:38423: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.90.89.66
country_id: 3686110
description:
Feb  7 09:08:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.90.89.66 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.44.155
country_id: 1880251
description:
47.128.44.155 - - [07/Feb/2025:09:08:06 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13728625 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/mod/forum/discuss.php?d=3980" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.44.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.168.173.87
country_id: 3175395
description:
2025-02-07 09:08:09 dovecot_plain authenticator failed for (carbile) [185.168.173.87]:47812: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.90.89.66
country_id: 3686110
description:
2025-02-07 09:08:35 dovecot_plain authenticator failed for ([66.90.89.66]) [66.90.89.66]:47510: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.12.254.47
country_id: 1814991
description:
2025-02-07 09:08:38 dovecot_plain authenticator failed for ([106.12.254.47]) [106.12.254.47]:25832: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.93.37.178
country_id: 1269750
description:
Feb  7 09:08:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.93.37.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.9.38.92
country_id: 1835841
description:
Feb  7 09:08:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.9.38.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.178.251.33
country_id: 1835841
description:
Feb  7 09:08:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.178.251.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.143.30.155
country_id: 1814991
description:
2025-02-07 09:09:01 dovecot_plain authenticator failed for ([222.143.30.155]) [222.143.30.155]:54548: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.196.6
country_id: 1819730
description:
Feb  7 09:09:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.196.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.186.220.42
country_id: 1835841
description:
2025-02-07 09:09:23 dovecot_login authenticator failed for ([211.186.220.42]) [211.186.220.42]:54700: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.253.142
country_id: 1269750
description:
2025-02-07 09:09:32 dovecot_login authenticator failed for (abts-tn-static-142.253.165.122.airtelbroadband.in) [122.165.253.142]:45426: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.239.78.124
country_id: 1819730
description:
Feb  7 09:09:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.239.78.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.196.6
country_id: 1819730
description:
2025-02-07 09:09:13 dovecot_login authenticator failed for ([121.202.196.6]) [121.202.196.6]:62122: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.161.197.130
country_id: 1562822
description:
Feb  7 09:09:14 ait sshd[1691114]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.161.197.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.254.47
country_id: 1814991
description:
Feb  7 09:08:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.12.254.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2025-02-07 09:09:06 dovecot_plain authenticator failed for ([182.239.78.124]) [182.239.78.124]:44402: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.161.197.130
country_id: 1562822
description:
Feb  7 09:09:14 ait sshd[1691114]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.197.130


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
country_id: 6252001
description:
Feb  7 09:09:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.253.142
country_id: 1269750
description:
Feb  7 09:09:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.253.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
country_id: 1269750
description:
2025-02-07 09:08:45 dovecot_plain authenticator failed for ([103.93.37.178]) [103.93.37.178]:36986: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.38.92
country_id: 1835841
description:
2025-02-07 09:08:47 dovecot_plain authenticator failed for ([59.9.38.92]) [59.9.38.92]:41630: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.178.251.33
country_id: 1835841
description:
2025-02-07 09:08:55 dovecot_plain authenticator failed for ([210.178.251.33]) [210.178.251.33]:60705: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.143.30.155
country_id: 1814991
description:
Feb  7 09:08:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.143.30.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.186.220.42
country_id: 1835841
description:
Feb  7 09:09:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.186.220.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-02-07 09:09:24 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:39982: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.6.99
country_id: 1814991
description:
Feb  7 09:10:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.6.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.6.99
country_id: 1814991
description:
2025-02-07 09:10:17 dovecot_plain authenticator failed for ([61.169.6.99]) [61.169.6.99]:46626: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.146
country_id: 732800
description:
Feb  7 09:09:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.146
country_id: 732800
description:
2025-02-07 09:09:58 dovecot_plain authenticator failed for ([185.255.212.146]) [185.255.212.146]:23699: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.170.200
country_id: 2017370
description:
2025-02-07 09:10:37 dovecot_plain authenticator failed for (broadband-37.204-170-200.ip.moscow.rt.ru) [37.204.170.200]:34695: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 09:10:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.220.209.59
country_id: 1814991
description:
Feb  7 09:10:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.220.209.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.220.209.59
country_id: 1814991
description:
2025-02-07 09:11:01 dovecot_plain authenticator failed for ([114.220.209.59]) [114.220.209.59]:49779: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.249.167.45
country_id: 6252001
description:
Feb  7 09:11:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.249.167.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.249.167.45
country_id: 6252001
description:
2025-02-07 09:11:23 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:43745: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.170.200
country_id: 2017370
description:
Feb  7 09:10:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.170.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.23.77.27
country_id: 1814991
description:
Feb  7 09:10:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.23.77.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.23.77.27
country_id: 1814991
description:
2025-02-07 09:10:52 dovecot_plain authenticator failed for ([14.23.77.27]) [14.23.77.27]:37429: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.195.217.94
country_id: 1814991
description:
Feb  7 09:11:51 ait sshd[1692162]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.195.217.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.227.200.201
country_id: 1562822
description:
Feb  7 09:12:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.227.200.201 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.62.110
country_id: 1880251
description:
47.128.62.110 - - [07/Feb/2025:09:12:06 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13535646 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/help.php?module=quiz&file=popup.html" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.62.110


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2025-02-07 09:12:14 dovecot_login authenticator failed for ([123.129.245.249]) [123.129.245.249]:33875: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.147.64
country_id: 3469034
description:
Feb  7 09:12:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.147.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.156.115.37
country_id: 338010
description:
Feb  7 09:12:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.156.115.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
country_id: 1835841
description:
Feb  7 09:12:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.147.64
country_id: 3469034
description:
2025-02-07 09:12:24 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.147.64]:53042: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.115.37
country_id: 338010
description:
2025-02-07 09:12:27 dovecot_plain authenticator failed for ([197.156.115.37]) [197.156.115.37]:52820: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.195.217.94
country_id: 1814991
description:
Feb  7 09:11:51 ait sshd[1692162]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.195.217.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.198.129.54
country_id: 3175395
description:
2025-02-07 09:12:05 dovecot_login authenticator failed for ip54-129-198-217.pool-bba.aruba.it [217.198.129.54]:48206: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.129.245.249
country_id: 1814991
description:
Feb  7 09:12:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.129.245.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.198.129.54
country_id: 3175395
description:
Feb  7 09:12:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.198.129.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.227.200.201
country_id: 1562822
description:
2025-02-07 09:12:07 dovecot_plain authenticator failed for ([171.227.200.201]) [171.227.200.201]:60472: 535 Incorrect authentication data (set_id=eng18b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2025-02-07 09:12:24 dovecot_plain authenticator failed for ([220.80.223.144]) [220.80.223.144]:58334: 535 Incorrect authentication data (set_id=eng18b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.102
country_id: 1269750
description:
Feb  7 09:12:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.134.126.162
country_id: 6252001
description:
2025-02-07 09:12:46 dovecot_plain authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:4342: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.66
country_id: 1036973
description:
Feb  7 09:12:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.102
country_id: 1269750
description:
2025-02-07 09:12:56 dovecot_plain authenticator failed for (nsg-corporate-102.234.187.122.airtel.in) [122.187.234.102]:33109: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.252.63.242
country_id: 1835841
description:
2025-02-07 09:12:58 dovecot_plain authenticator failed for ([1.252.63.242]) [1.252.63.242]:54742: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
country_id: 1269750
description:
Feb  7 09:13:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.174.248
country_id: 2017370
description:
Feb  7 09:13:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.174.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.104.199.27
country_id: 1814991
description:
Feb  7 09:13:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.104.199.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.114.215
country_id: 1168579
description:
Feb  7 09:12:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.114.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.153.49
country_id: 1814991
description:
2025-02-07 09:12:45 dovecot_plain authenticator failed for ([221.2.153.49]) [221.2.153.49]:40950: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.118.213.68
country_id: 3865483
description:
Feb  7 09:12:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.118.213.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.12.240.14
country_id: 2017370
description:
2025-02-07 09:13:00 dovecot_login authenticator failed for ([85.12.240.14]) [85.12.240.14]:45416: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.213.68
country_id: 3865483
description:
2025-02-07 09:13:00 dovecot_plain authenticator failed for (red.138.118.213.068.ssservicios.com.ar) [138.118.213.68]:45289: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.218.10.21
country_id: 1835841
description:
Feb  7 09:12:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.218.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.153.49
country_id: 1814991
description:
Feb  7 09:12:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.153.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.6.68.50
country_id: 1814991
description:
2025-02-07 09:12:43 dovecot_plain authenticator failed for ([221.6.68.50]) [221.6.68.50]:61521: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.23.77.27
country_id: 1814991
description:
2025-02-07 09:12:45 dovecot_plain authenticator failed for ([14.23.77.27]) [14.23.77.27]:37123: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.252.63.242
country_id: 1835841
description:
Feb  7 09:12:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.252.63.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
country_id: 1269750
description:
2025-02-07 09:13:04 dovecot_plain authenticator failed for (nsg-static-90.87.76.182-airtel.com) [182.76.87.90]:45900: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.98.159
country_id: 1835841
description:
2025-02-07 09:13:11 dovecot_plain authenticator failed for ([211.252.98.159]) [211.252.98.159]:57616: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
country_id: 1562822
description:
2025-02-07 09:13:15 dovecot_login authenticator failed for ([27.71.27.81]) [27.71.27.81]:39099: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.222.171.6
country_id: 3017382
description:
Feb  7 09:12:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.222.171.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.236.141.106
country_id: 290291
description:
2025-02-07 09:13:25 dovecot_login authenticator failed for ([87.236.141.106]) [87.236.141.106]:51909: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.30.217.31
country_id: 2017370
description:
Feb  7 09:12:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.30.217.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
country_id: 1819730
description:
2025-02-07 09:12:49 dovecot_plain authenticator failed for 202-82-20-241.static.imsbiz.com [202.82.20.241]:64148: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2025-02-07 09:12:56 dovecot_plain authenticator failed for ([196.28.226.66]) [196.28.226.66]:35178: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.3.252
country_id: 6252001
description:
2025-02-07 09:13:03 dovecot_plain authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:52836: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.142.242
country_id: 1819730
description:
2025-02-07 09:13:07 dovecot_plain authenticator failed for 242.142.48.116.static.netvigator.com [116.48.142.242]:39612: 535 Incorrect authentication data (set_id=eng18a00033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.57
country_id: 1835841
description:
2025-02-07 09:12:44 dovecot_plain authenticator failed for ([180.71.9.57]) [180.71.9.57]:58956: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.124.47.11
country_id: 1814991
description:
2025-02-07 09:12:43 dovecot_plain authenticator failed for ([111.124.47.11]) [111.124.47.11]:35188: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.115.100.144
country_id: 272103
description:
Feb  7 09:13:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.115.100.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.142.135
country_id: 1562822
description:
2025-02-07 09:13:27 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:9080: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.225.8
country_id: 290557
description:
Feb  7 09:12:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.225.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.116.95.48
country_id: 1880251
description:
2025-02-07 09:13:13 dovecot_plain authenticator failed for ([203.116.95.48]) [203.116.95.48]:52788: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.236.141.106
country_id: 290291
description:
Feb  7 09:13:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.236.141.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.35.156.113
country_id: 1210997
description:
[2025-02-07 09:13:00 +0100] info [webmaild] 103.35.156.113 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.218.10.21
country_id: 1835841
description:
2025-02-07 09:12:48 dovecot_plain authenticator failed for ([118.218.10.21]) [118.218.10.21]:57220: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
country_id: 1814991
description:
Feb  7 09:13:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.174.248
country_id: 2017370
description:
2025-02-07 09:13:06 dovecot_plain authenticator failed for broadband-77-37-174-248.ip.moscow.rt.ru [77.37.174.248]:59376: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.123.219.82
country_id: 6252001
description:
Feb  7 09:13:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.123.219.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.30.217.31
country_id: 2017370
description:
2025-02-07 09:12:41 dovecot_plain authenticator failed for 95-30-217-31.broadband.corbina.ru [95.30.217.31]:59020: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.172.239.193
country_id: 3017382
description:
Feb  7 09:12:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.172.239.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.172.239.193
country_id: 3017382
description:
2025-02-07 09:12:56 dovecot_plain authenticator failed for sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:65231: 535 Incorrect authentication data (set_id=eng18a00033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.134.3.252
country_id: 6252001
description:
Feb  7 09:13:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.134.3.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-02-07 09:13:04 dovecot_plain authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:41476: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.81
country_id: 1562822
description:
Feb  7 09:13:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.27.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.23.77.27
country_id: 1814991
description:
Feb  7 09:12:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.23.77.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.6.68.50
country_id: 1814991
description:
Feb  7 09:12:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.6.68.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.12.240.14
country_id: 2017370
description:
Feb  7 09:12:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.12.240.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.115.100.144
country_id: 272103
description:
2025-02-07 09:13:05 dovecot_plain authenticator failed for 3pc100-144.rconx.com [185.115.100.144]:45276: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.116.95.48
country_id: 1880251
description:
Feb  7 09:13:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.116.95.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.215.71
country_id: 290557
description:
2025-02-07 09:13:12 dovecot_login authenticator failed for ([5.30.215.71]) [5.30.215.71]:51667: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-02-07 09:13:30 dovecot_login authenticator failed for ool-457bdb52.dyn.optonline.net [69.123.219.82]:51346: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.222.171.6
country_id: 3017382
description:
2025-02-07 09:12:39 dovecot_plain authenticator failed for 6.ip-92-222-171.eu [92.222.171.6]:45208: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.53.18.44
country_id: 1149361
description:
2025-02-07 09:12:41 dovecot_plain authenticator failed for ([103.53.18.44]) [103.53.18.44]:59570: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.252.98.159
country_id: 1835841
description:
Feb  7 09:13:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.252.98.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.215.71
country_id: 290557
description:
Feb  7 09:13:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.215.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.104.199.27
country_id: 1814991
description:
2025-02-07 09:13:12 dovecot_plain authenticator failed for ([120.24.83.156]) [223.104.199.27]:27199: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.241.245.198
country_id: 1814991
description:
Feb  7 09:12:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.241.245.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.124.47.11
country_id: 1814991
description:
Feb  7 09:12:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.124.47.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.225.8
country_id: 290557
description:
2025-02-07 09:12:42 dovecot_plain authenticator failed for ([5.30.225.8]) [5.30.225.8]:45489: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.82.20.241
country_id: 1819730
description:
Feb  7 09:12:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.82.20.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.102
country_id: 1814991
description:
Feb  7 09:12:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.102
country_id: 1814991
description:
2025-02-07 09:13:01 dovecot_plain authenticator failed for ([111.48.214.102]) [111.48.214.102]:21540: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2025-02-07 09:13:02 dovecot_plain authenticator failed for (www.safecleen.com) [58.49.113.138]:16289: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.152.119.174
country_id: 1835841
description:
2025-02-07 09:13:09 dovecot_plain authenticator failed for ([121.152.119.174]) [121.152.119.174]:50534: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.53.18.44
country_id: 1149361
description:
Feb  7 09:12:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.53.18.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.152.119.174
country_id: 1835841
description:
Feb  7 09:13:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.152.119.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.142.135
country_id: 1562822
description:
Feb  7 09:13:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.142.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.241.245.198
country_id: 1814991
description:
2025-02-07 09:12:43 dovecot_plain authenticator failed for ([114.241.245.198]) [114.241.245.198]:43718: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.71.9.57
country_id: 1835841
description:
Feb  7 09:12:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.71.9.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.134.126.162
country_id: 6252001
description:
Feb  7 09:12:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.134.126.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.114.215
country_id: 1168579
description:
2025-02-07 09:12:41 dovecot_plain authenticator failed for ([103.123.114.215]) [103.123.114.215]:39030: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.4.255.205
country_id: 1835841
description:
2025-02-07 09:13:51 dovecot_login authenticator failed for ([59.4.255.205]) [59.4.255.205]:46197: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.248.159.20
country_id: 1814991
description:
Feb  7 09:13:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.248.159.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.252.204.203
country_id: 1835841
description:
Feb  7 09:14:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.252.204.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.252.204.203
country_id: 1835841
description:
2025-02-07 09:14:15 dovecot_login authenticator failed for ([1.252.204.203]) [1.252.204.203]:61381: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.121
country_id: 617790
description:
Feb  7 09:13:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.121
country_id: 617790
description:
2025-02-07 09:13:52 dovecot_login authenticator failed for ([185.167.58.121]) [185.167.58.121]:49368: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.177.75
country_id: 1269750
description:
2025-02-07 09:14:03 dovecot_login authenticator failed for (49.207.177.75.actcorp.in) [49.207.177.75]:43104: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.241.150
country_id: 1814991
description:
Feb  7 09:14:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.241.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.47.48.178
country_id: 1814991
description:
2025-02-07 09:14:24 dovecot_login authenticator failed for ([183.47.48.178]) [183.47.48.178]:42210: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.96.11.230
country_id: 2510769
description:
Feb  7 09:14:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.96.11.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.4.255.205
country_id: 1835841
description:
Feb  7 09:13:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.4.255.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.248.159.20
country_id: 1814991
description:
2025-02-07 09:14:00 dovecot_login authenticator failed for ([58.248.159.20]) [58.248.159.20]:34209: 535 Incorrect authentication data (set_id=freeman@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.207.177.75
country_id: 1269750
description:
Feb  7 09:14:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.207.177.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.71.98.202
country_id: 1814991
description:
Feb  7 09:14:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.71.98.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.241.150
country_id: 1814991
description:
2025-02-07 09:14:24 dovecot_login authenticator failed for ([61.143.241.150]) [61.143.241.150]:41721: 535 Incorrect authentication data (set_id=freeman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.71.98.202
country_id: 1814991
description:
2025-02-07 09:14:10 dovecot_login authenticator failed for ([223.71.98.202]) [223.71.98.202]:36406: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.47.48.178
country_id: 1814991
description:
Feb  7 09:14:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.47.48.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.96.11.230
country_id: 2510769
description:
2025-02-07 09:14:33 dovecot_login authenticator failed for 230.red-213-96-11.staticip.rima-tde.net [213.96.11.230]:55140: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.84.18
country_id: 895949
description:
Feb  7 09:14:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.84.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.124.94
country_id: 1880251
description:
2025-02-07 09:15:10 dovecot_plain authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:52434: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.55
country_id: 2017370
description:
2025-02-07 09:15:13 dovecot_login authenticator failed for ([178.178.222.55]) [178.178.222.55]:60308: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.149.125.227
country_id: 2328926
description:
Feb  7 09:14:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.149.125.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
country_id: 1814991
description:
Feb  7 09:14:55 ait sshd[1693222]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
country_id: 1814991
description:
Feb  7 09:14:55 ait sshd[1693222]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.164.147.150
country_id: 3865483
description:
2025-02-07 09:15:00 dovecot_plain authenticator failed for ([181.164.147.150]) [181.164.147.150]:8626: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.124.94
country_id: 1880251
description:
Feb  7 09:15:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.124.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.55
country_id: 2017370
description:
Feb  7 09:15:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.117.32.22
country_id: 2017370
description:
2025-02-07 09:15:24 dovecot_login authenticator failed for ([87.117.32.22]) [87.117.32.22]:50716: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.149.125.227
country_id: 2328926
description:
2025-02-07 09:14:37 dovecot_login authenticator failed for ([197.149.125.227]) [197.149.125.227]:32916: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.164.147.150
country_id: 3865483
description:
Feb  7 09:14:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.164.147.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.132.2
country_id: 3017382
description:
2025-02-07 09:15:02 dovecot_login authenticator failed for vps-6186bf6b.vps.ovh.net [57.129.132.2]:42092: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.200.216.246
country_id: 1814991
description:
2025-02-07 09:15:13 dovecot_login authenticator failed for ([113.200.216.246]) [113.200.216.246]:38896: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.84.18
country_id: 895949
description:
2025-02-07 09:14:45 dovecot_login authenticator failed for ([41.216.84.18]) [41.216.84.18]:40840: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.132.2
country_id: 3017382
description:
Feb  7 09:15:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.129.132.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.126.223.175
country_id: 2017370
description:
Feb  7 09:15:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.126.223.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
country_id: 2017370
description:
2025-02-07 09:15:02 dovecot_login authenticator failed for ([92.126.223.175]) [92.126.223.175]:44916: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.200.216.246
country_id: 1814991
description:
Feb  7 09:15:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.200.216.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.117.32.22
country_id: 2017370
description:
Feb  7 09:15:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.117.32.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.168.246
country_id: 1269750
description:
2025-02-07 09:15:57 dovecot_plain authenticator failed for (host103-171-169-246.renubroadband.com) [103.171.168.246]:59674: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.172.79.206
country_id: 1835841
description:
Feb  7 09:15:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.172.79.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.1.214.102
country_id: 1835841
description:
Feb  7 09:15:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.1.214.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
country_id: 1269750
description:
Feb  7 09:15:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.124.14.241
country_id: 3469034
description:
[2025-02-07 09:16:05 +0100] info [webmaild] 177.124.14.241 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.113.43.143
country_id: 1269750
description:
2025-02-07 09:15:48 dovecot_plain authenticator failed for vps-b909f986.vps.ovh.ca [148.113.43.143]:35518: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.1.214.102
country_id: 1835841
description:
2025-02-07 09:15:59 dovecot_plain authenticator failed for ([59.1.214.102]) [59.1.214.102]:36242: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.6.78.182
country_id: 3469034
description:
2025-02-07 09:16:04 dovecot_plain authenticator failed for ([189.6.78.182]) [189.6.78.182]:6117: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.13.138.138
country_id: 1814991
description:
2025-02-07 09:16:12 dovecot_plain authenticator failed for (hn.kd.smx.adsl) [221.13.138.138]:43875: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.57.205.7
country_id: 1814991
description:
2025-02-07 09:16:26 dovecot_plain authenticator failed for ([117.57.205.7]) [117.57.205.7]:44332: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.189.232
country_id: 2017370
description:
2025-02-07 09:15:45 dovecot_plain authenticator failed for (host-232.185.15.189.0.0xffffff00.STERLING.stercom.ru) [185.15.189.232]:53608: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.84.175
country_id: 1835841
description:
Feb  7 09:15:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.84.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.144.140
country_id: 1814991
description:
Feb  7 09:16:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.144.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.144.140
country_id: 1814991
description:
2025-02-07 09:16:11 dovecot_login authenticator failed for ([112.15.144.140]) [112.15.144.140]:47962: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.20.119
country_id: 1880251
description:
47.128.20.119 - - [07/Feb/2025:09:16:18 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19381640 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/main/index.php?Itemid=300&id=240&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.20.119


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.35.66.243
country_id: 6252001
description:
2025-02-07 09:15:58 dovecot_login authenticator failed for ([4.35.66.243]) [4.35.66.243]:44665: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-02-07 09:16:01 dovecot_plain authenticator failed for ([103.107.36.18]) [103.107.36.18]:52196: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.35.66.243
country_id: 6252001
description:
Feb  7 09:15:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 4.35.66.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.172.79.206
country_id: 1835841
description:
2025-02-07 09:15:48 dovecot_plain authenticator failed for ([211.172.79.206]) [211.172.79.206]:50762: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.84.175
country_id: 1835841
description:
2025-02-07 09:15:48 dovecot_plain authenticator failed for ([222.114.84.175]) [222.114.84.175]:38136: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.113.43.143
country_id: 1269750
description:
Feb  7 09:15:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.113.43.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.168.246
country_id: 1269750
description:
Feb  7 09:15:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.168.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.6.78.182
country_id: 3469034
description:
Feb  7 09:16:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.6.78.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.13.138.138
country_id: 1814991
description:
Feb  7 09:16:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.13.138.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.194.181.238
country_id: 1835841
description:
2025-02-07 09:16:17 dovecot_plain authenticator failed for ([175.194.181.238]) [175.194.181.238]:64650: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.57.205.7
country_id: 1814991
description:
Feb  7 09:16:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.57.205.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.177.40.85
country_id: 1269750
description:
Feb  7 09:15:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.177.40.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.189.232
country_id: 2017370
description:
Feb  7 09:15:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.189.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.95.18
country_id: 290557
description:
2025-02-07 09:16:32 dovecot_login authenticator failed for ([94.200.95.18]) [94.200.95.18]:36182: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.200.95.18
country_id: 290557
description:
Feb  7 09:16:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.200.95.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.40.85
country_id: 1269750
description:
2025-02-07 09:15:36 dovecot_login authenticator failed for ([103.177.40.85]) [103.177.40.85]:54381: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.194.181.238
country_id: 1835841
description:
Feb  7 09:16:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.194.181.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.243.79.22
country_id: 3469034
description:
Feb  7 09:16:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.243.79.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.243.79.22
country_id: 3469034
description:
2025-02-07 09:16:37 dovecot_plain authenticator failed for 191-243-79-22.telecomconectividade.net.br [191.243.79.22]:46242: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.6.160.15
country_id: 1814991
description:
Feb  7 09:16:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.6.160.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.6.160.15
country_id: 1814991
description:
2025-02-07 09:16:52 dovecot_login authenticator failed for ([218.6.160.15]) [218.6.160.15]:60836: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 09:17:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
country_id: 2921044
description:
Feb  7 09:17:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.215.235.125
country_id: 1831722
description:
2025-02-07 09:16:35 dovecot_login authenticator failed for (ADMIN) [188.215.235.125]:59212: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 09:17:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
country_id: 2921044
description:
2025-02-07 09:17:17 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (basibiatic) [91.56.31.167]:62453: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.252.92.5
country_id: 1821275
description:
Feb  7 09:17:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.252.92.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.127.188
country_id: 1835841
description:
Feb  7 09:18:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.127.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.127.188
country_id: 1835841
description:
2025-02-07 09:18:25 dovecot_plain authenticator failed for ([114.108.127.188]) [114.108.127.188]:44430: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.122.198.52
country_id: 1814991
description:
Feb  7 09:18:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.122.198.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.252.92.5
country_id: 1821275
description:
2025-02-07 09:17:34 dovecot_login authenticator failed for (ADMIN) [84.252.92.5]:33434: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
country_id: 690791
description:
2025-02-07 09:18:39 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (regasilic) [92.244.126.105]:41948: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
country_id: 1522867
description:
Feb  7 09:18:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.161.119.194
country_id: 3144096
description:
2025-02-07 09:18:43 dovecot_plain authenticator failed for 194.79-161-119.customer.lyse.net (prona) [79.161.119.194]:57822: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.253.178
country_id: 1814991
description:
Feb  7 09:18:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.253.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.224.221
country_id: 1168579
description:
2025-02-07 09:19:02 dovecot_plain authenticator failed for ([103.57.224.221]) [103.57.224.221]:32786: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.244.126.105
country_id: 690791
description:
Feb  7 09:18:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.244.126.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.15.178.174
country_id: 1814991
description:
2025-02-07 09:18:38 dovecot_plain authenticator failed for ([60.15.178.174]) [60.15.178.174]:53640: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.108.95.66
country_id: 690791
description:
2025-02-07 09:19:12 dovecot_plain authenticator failed for (cocus) [109.108.95.66]:47247: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
country_id: 1819730
description:
2025-02-07 09:18:49 dovecot_plain authenticator failed for ([121.202.152.13]) [121.202.152.13]:56952: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.178
country_id: 1814991
description:
2025-02-07 09:18:57 dovecot_plain authenticator failed for ([116.113.253.178]) [116.113.253.178]:36345: 535 Incorrect authentication data (set_id=abuse@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.224.221
country_id: 1168579
description:
Feb  7 09:19:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.224.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.198.52
country_id: 1814991
description:
2025-02-07 09:18:34 dovecot_plain authenticator failed for ([157.122.198.52]) [157.122.198.52]:54422: 535 Incorrect authentication data (set_id=abuse@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.15.178.174
country_id: 1814991
description:
Feb  7 09:18:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.15.178.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.161.119.194
country_id: 3144096
description:
Feb  7 09:18:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.161.119.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
country_id: 1522867
description:
2025-02-07 09:18:45 dovecot_plain authenticator failed for (lairgoid) [109.166.70.166]:22540: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.13
country_id: 1819730
description:
Feb  7 09:18:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.206.202
country_id: 1819730
description:
Feb  7 09:19:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.206.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.202
country_id: 1819730
description:
2025-02-07 09:19:13 dovecot_plain authenticator failed for (m121-202-206-202.smartone.com) [121.202.206.202]:45369: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.112.71.128
country_id: 6252001
description:
Feb  7 09:19:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.112.71.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.112.71.128
country_id: 6252001
description:
2025-02-07 09:19:06 dovecot_plain authenticator failed for syn-070-112-071-128.res.spectrum.com [70.112.71.128]:43849: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.108.95.66
country_id: 690791
description:
Feb  7 09:19:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.108.95.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 09:20:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 09:20:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  7 09:20:18 ait sshd[1695454]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  7 09:20:18 ait sshd[1695454]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.101.128.156
country_id: 6252001
description:
Feb  7 09:20:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.101.128.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.56.226
country_id: 3469034
description:
2025-02-07 09:21:23 dovecot_plain authenticator failed for ([187.6.56.226]) [187.6.56.226]:36440: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.251
country_id: 1819730
description:
Feb  7 09:21:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
country_id: 690791
description:
Feb  7 09:21:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.231.249
country_id: 6252001
description:
Feb  7 09:21:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.231.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.6.56.226
country_id: 3469034
description:
Feb  7 09:21:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.6.56.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.231.249
country_id: 6252001
description:
2025-02-07 09:21:28 dovecot_login authenticator failed for ([104.241.231.249]) [104.241.231.249]:38855: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.98.117
country_id: 1814991
description:
Feb  7 09:20:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.98.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.48.197
country_id: 1269750
description:
Feb  7 09:21:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.48.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.172.48.197
country_id: 1269750
description:
2025-02-07 09:21:08 dovecot_plain authenticator failed for ([103.172.48.197]) [103.172.48.197]:36651: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.251
country_id: 1819730
description:
2025-02-07 09:21:15 dovecot_login authenticator failed for (m121-202-204-251.smartone.com) [121.202.204.251]:60897: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.98.117
country_id: 1814991
description:
2025-02-07 09:20:44 dovecot_plain authenticator failed for ([27.223.98.117]) [27.223.98.117]:34780: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.101.128.156
country_id: 6252001
description:
2025-02-07 09:20:56 dovecot_plain authenticator failed for c-73-101-128-156.hsd1.pa.comcast.net [73.101.128.156]:18430: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
country_id: 690791
description:
2025-02-07 09:21:25 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (fevalospen) [94.45.76.149]:56216: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.54.124
country_id: 1880251
description:
47.128.54.124 - - [07/Feb/2025:09:21:40 +0100] "GET /data1/images/image1.jpg HTTP/2.0" 415 176 mail.ait-edu.us "https://mail.ait-edu.us/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=27848492" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.54.124


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  7 09:22:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.70.166.51
country_id: 298795
description:
Feb  7 09:21:34 ait sshd[1695962]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.70.166.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.70.166.51
country_id: 298795
description:
Feb  7 09:21:34 ait sshd[1695962]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.70.166.51


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.109.233.181
country_id: 2017370
description:
Feb  7 09:22:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.109.233.181 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-22.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-07 09:22:25 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-176.static.tpgi.com.au) [110.175.220.250]:49319: 535 Incorrect authentication data (set_id=sarpong-nsiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2025-02-07 09:22:25 dovecot_plain authenticator failed for (akerean) [89.109.233.181]:40155: 535 Incorrect authentication data (set_id=ads76a66686y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-02-07 09:23:25 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:25951: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 09:22:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.30.214
country_id: 1835841
description:
2025-02-07 09:22:48 dovecot_plain authenticator failed for ([220.77.30.214]) [220.77.30.214]:55593: 535 Incorrect authentication data (set_id=sarpong-nsiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.165.61
country_id: 3351879
description:
Feb  7 09:23:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.165.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
country_id: 3351879
description:
2025-02-07 09:23:14 dovecot_login authenticator failed for (cust61-165.63.41.tvcabo.ao) [41.63.165.61]:7209: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.213
country_id: 1819730
description:
2025-02-07 09:23:20 dovecot_plain authenticator failed for (m121-202-154-213.smartone.com) [121.202.154.213]:45380: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Feb  7 09:23:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.30.214
country_id: 1835841
description:
Feb  7 09:22:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.30.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.24
country_id: 617790
description:
2025-02-07 09:23:09 dovecot_plain authenticator failed for ([185.167.56.24]) [185.167.56.24]:51970: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.213
country_id: 1819730
description:
Feb  7 09:23:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.24
country_id: 617790
description:
Feb  7 09:23:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
country_id: 1694008
description:
Feb  7 09:23:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
country_id: 1694008
description:
2025-02-07 09:23:45 dovecot_plain authenticator failed for (58.69.17.18.pldt.net) [58.69.17.18]:53136: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.57
country_id: 1835841
description:
2025-02-07 09:24:03 dovecot_plain authenticator failed for ([180.71.9.57]) [180.71.9.57]:41304: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.203.122.112
country_id: 6252001
description:
Feb  7 09:24:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.203.122.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.203.122.112
country_id: 6252001
description:
2025-02-07 09:24:29 dovecot_plain authenticator failed for syn-069-203-122-112.res.spectrum.com [69.203.122.112]:38442: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.83.78
country_id: 1269750
description:
Feb  7 09:23:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.83.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.71.9.57
country_id: 1835841
description:
Feb  7 09:24:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.71.9.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.83.78
country_id: 1269750
description:
2025-02-07 09:24:01 dovecot_plain authenticator failed for ([182.78.83.78]) [182.78.83.78]:58518: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.222.190.69
country_id: 1522867
description:
Feb  7 09:24:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.222.190.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.236.141.106
country_id: 290291
description:
2025-02-07 09:24:59 dovecot_plain authenticator failed for ([87.236.141.106]) [87.236.141.106]:59762: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.170.217.42
country_id: 1835841
description:
2025-02-07 09:25:05 dovecot_plain authenticator failed for ([112.170.217.42]) [112.170.217.42]:42281: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.134.96.117
country_id: 6251999
description:
2025-02-07 09:25:21 dovecot_plain authenticator failed for ([207.134.96.117]) [207.134.96.117]:39774: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.153.94
country_id: 1814991
description:
Feb  7 09:24:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.153.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.194.181.238
country_id: 1835841
description:
Feb  7 09:24:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.194.181.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.112
country_id: 1814991
description:
2025-02-07 09:24:49 dovecot_plain authenticator failed for ([183.249.1.112]) [183.249.1.112]:37165: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.213.68
country_id: 3865483
description:
2025-02-07 09:24:50 dovecot_plain authenticator failed for (red.138.118.213.068.ssservicios.com.ar) [138.118.213.68]:37466: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.155.105
country_id: 1814991
description:
Feb  7 09:25:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.155.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.177.247.242
country_id: 1269750
description:
Feb  7 09:24:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.177.247.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.97.10
country_id: 1814991
description:
Feb  7 09:24:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.97.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.222.190.69
country_id: 1522867
description:
2025-02-07 09:24:54 dovecot_plain authenticator failed for (client.fttb.2day.kz) [176.222.190.69]:35050: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.198.54
country_id: 1814991
description:
2025-02-07 09:24:57 dovecot_plain authenticator failed for ([157.122.198.54]) [157.122.198.54]:52452: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.117.144.158
country_id: 1835841
description:
Feb  7 09:25:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.117.144.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.242.51.215
country_id: 1269750
description:
Feb  7 09:24:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.242.51.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.147.184
country_id: 3469034
description:
Feb  7 09:24:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.147.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.240.204.168
country_id: 2077456
description:
Feb  7 09:24:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.240.204.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.1.154
country_id: 1819730
description:
Feb  7 09:25:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.1.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.105.234
country_id: 1668284
description:
Feb  7 09:25:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.105.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.246.241.234
country_id: 1814991
description:
Feb  7 09:24:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.246.241.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.19.17
country_id: 1668284
description:
Feb  7 09:24:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.19.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.85.68.71
country_id: 1835841
description:
2025-02-07 09:25:05 dovecot_plain authenticator failed for ([220.85.68.71]) [220.85.68.71]:24830: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.132.207
country_id: 2077456
description:
Feb  7 09:25:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.132.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.154.53.221
country_id: 1814991
description:
Feb  7 09:24:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.154.53.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.117.144.158
country_id: 1835841
description:
2025-02-07 09:25:03 dovecot_plain authenticator failed for ([175.117.144.158]) [175.117.144.158]:46404: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.155.105
country_id: 1814991
description:
2025-02-07 09:25:13 dovecot_plain authenticator failed for ([222.68.155.105]) [222.68.155.105]:42733: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.143.244.159
country_id: 1835841
description:
2025-02-07 09:25:18 dovecot_plain authenticator failed for ([125.143.244.159]) [125.143.244.159]:39485: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.19.17
country_id: 1668284
description:
2025-02-07 09:24:51 dovecot_plain authenticator failed for 111-70-19-17.emome-ip.hinet.net [111.70.19.17]:54641: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.177.247.242
country_id: 1269750
description:
2025-02-07 09:24:48 dovecot_plain authenticator failed for (host-247342.fivenetwork.com) [202.177.247.242]:41036: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
country_id: 3144096
description:
Feb  7 09:24:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.238.200
country_id: 298795
description:
2025-02-07 09:24:52 dovecot_plain authenticator failed for ([5.11.238.200]) [5.11.238.200]:55028: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.79.249.83
country_id: 6252001
description:
2025-02-07 09:25:06 dovecot_plain authenticator failed for ([50.79.249.83]) [50.79.249.83]:44255: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.234
country_id: 1668284
description:
2025-02-07 09:25:12 dovecot_plain authenticator failed for 110-25-105-234.adsl.fetnet.net [110.25.105.234]:51151: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
country_id: 2017370
description:
Feb  7 09:25:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.28.125.96
country_id: 6252001
description:
2025-02-07 09:24:47 dovecot_plain authenticator failed for ([38.28.125.96]) [38.28.125.96]:57378: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.216.105.6
country_id: 6252001
description:
2025-02-07 09:24:37 dovecot_plain authenticator failed for ([127.0.0.1]) [91.216.105.6]:56130: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.169.117.118
country_id: 6252001
description:
2025-02-07 09:24:50 dovecot_plain authenticator failed for 118.sub-166-169-117.myvzw.com [166.169.117.118]:49143: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
country_id: 2077456
description:
2025-02-07 09:25:04 dovecot_plain authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:44286: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.224.159.218
country_id: 1814991
description:
2025-02-07 09:25:07 dovecot_plain authenticator failed for ([221.224.159.220]) [221.224.159.218]:57182: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.70.142
country_id: 1835841
description:
2025-02-07 09:25:11 dovecot_plain authenticator failed for ([218.149.70.142]) [218.149.70.142]:42464: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.132.207
country_id: 2077456
description:
2025-02-07 09:25:20 dovecot_plain authenticator failed for 207.132.220.111.sta.wbroadband.net.au [111.220.132.207]:54588: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.246.241.234
country_id: 1814991
description:
2025-02-07 09:24:35 dovecot_plain authenticator failed for ([210.22.130.22]) [58.246.241.234]:48496: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.194.181.238
country_id: 1835841
description:
2025-02-07 09:24:51 dovecot_plain authenticator failed for ([175.194.181.238]) [175.194.181.238]:51673: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.122.198.54
country_id: 1814991
description:
Feb  7 09:24:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.122.198.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.236.141.106
country_id: 290291
description:
Feb  7 09:24:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.236.141.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.134.96.117
country_id: 6251999
description:
Feb  7 09:25:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.134.96.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.242.51.215
country_id: 1269750
description:
2025-02-07 09:24:49 dovecot_plain authenticator failed for ([117.242.51.215]) [117.242.51.215]:35494: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.154.53.221
country_id: 1814991
description:
2025-02-07 09:24:49 dovecot_plain authenticator failed for ([101.230.251.217]) [180.154.53.221]:34121: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.97.10
country_id: 1814991
description:
2025-02-07 09:24:50 dovecot_plain authenticator failed for ([116.114.97.10]) [116.114.97.10]:51813: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.70.142
country_id: 1835841
description:
Feb  7 09:25:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.70.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.238.200
country_id: 298795
description:
Feb  7 09:24:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.238.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
country_id: 1835841
description:
Feb  7 09:25:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.224.159.218
country_id: 1814991
description:
Feb  7 09:25:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.224.159.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.240.204.168
country_id: 2077456
description:
2025-02-07 09:24:51 dovecot_plain authenticator failed for 60-240-204-168.static.tpgi.com.au [60.240.204.168]:50177: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.118.213.68
country_id: 3865483
description:
Feb  7 09:24:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.118.213.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.153.94
country_id: 1814991
description:
2025-02-07 09:24:53 dovecot_plain authenticator failed for ([150.242.239.128]) [222.68.153.94]:53476: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.6.160.15
country_id: 1814991
description:
2025-02-07 09:25:15 dovecot_plain authenticator failed for ([218.6.160.15]) [218.6.160.15]:38477: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
country_id: 2017370
description:
2025-02-07 09:25:20 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:49068: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.252.8.34
country_id: 1643084
description:
2025-02-07 09:25:30 dovecot_plain authenticator failed for ([43.252.8.34]) [43.252.8.34]:35786: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.112
country_id: 1814991
description:
Feb  7 09:24:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.100.18.224
country_id: 1835841
description:
2025-02-07 09:25:08 dovecot_plain authenticator failed for ([183.100.18.224]) [183.100.18.224]:48312: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.28.125.96
country_id: 6252001
description:
Feb  7 09:24:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.28.125.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2025-02-07 09:25:04 dovecot_plain authenticator failed for ([203.252.10.3]) [203.252.10.3]:58688: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.1.154
country_id: 1819730
description:
2025-02-07 09:25:09 dovecot_plain authenticator failed for 110-4-1-154.static.pccw-hkt.com [110.4.1.154]:3708: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.169.117.118
country_id: 6252001
description:
Feb  7 09:24:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.169.117.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.85.68.71
country_id: 1835841
description:
Feb  7 09:25:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.85.68.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.147.184
country_id: 3469034
description:
2025-02-07 09:24:49 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.147.184]:34560: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.6.160.15
country_id: 1814991
description:
Feb  7 09:25:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.6.160.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.143.244.159
country_id: 1835841
description:
Feb  7 09:25:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.143.244.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.252.8.34
country_id: 1643084
description:
Feb  7 09:25:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.252.8.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-02-07 09:24:53 dovecot_plain authenticator failed for ([85.19.195.12]) [85.19.195.12]:36760: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.102
country_id: 1819730
description:
2025-02-07 09:26:05 dovecot_plain authenticator failed for ([118.26.153.102]) [118.26.153.102]:62804: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.43.174
country_id: 3469034
description:
2025-02-07 09:26:09 dovecot_plain authenticator failed for (189-113-43-174.netturbo.com.br) [189.113.43.174]:37780: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
country_id: 1819730
description:
2025-02-07 09:26:14 dovecot_login authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:34775: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.148.0.202
country_id: 6252001
description:
Feb  7 09:26:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.148.0.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
country_id: 6252001
description:
2025-02-07 09:26:17 dovecot_plain authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:56978: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.118.86
country_id: 1880251
description:
47.128.118.86 - - [07/Feb/2025:09:26:03 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11554289 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/main/index.php?Itemid=193&id=140&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.118.86


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.26.153.102
country_id: 1819730
description:
Feb  7 09:26:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.26.153.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
country_id: 1819730
description:
Feb  7 09:26:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.241.59.150
country_id: 1562822
description:
2025-02-07 09:26:32 dovecot_login authenticator failed for (static.vnpt.vn) [14.241.59.150]:56932: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.4
country_id: 1835841
description:
Feb  7 09:25:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.4
country_id: 1835841
description:
2025-02-07 09:25:54 dovecot_plain authenticator failed for ([203.252.10.4]) [203.252.10.4]:47338: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 09:25:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.113.43.174
country_id: 3469034
description:
Feb  7 09:26:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.113.43.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.241.59.150
country_id: 1562822
description:
Feb  7 09:26:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.241.59.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.178.158
country_id: 3469034
description:
Feb  7 09:25:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.178.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.178.158
country_id: 3469034
description:
2025-02-07 09:25:51 dovecot_plain authenticator failed for (200-168-190-25.customer.tdatabrasil.net.br) [189.56.178.158]:59674: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.70.28
country_id: 1835841
description:
Feb  7 09:27:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.70.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 09:27:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.34.254
country_id: 2017370
description:
2025-02-07 09:27:59 dovecot_plain authenticator failed for broadband-5-228-34-254.ip.moscow.rt.ru [5.228.34.254]:57796: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.70.28
country_id: 1835841
description:
2025-02-07 09:27:34 dovecot_plain authenticator failed for ([110.34.70.28]) [110.34.70.28]:47537: 535 Incorrect authentication data (set_id=abuse@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.93.201.42
country_id: 1269750
description:
Feb  7 09:27:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.93.201.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.201.42
country_id: 1269750
description:
2025-02-07 09:27:43 dovecot_plain authenticator failed for ([103.93.201.42]) [103.93.201.42]:34640: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.251.253.62
country_id: 1835841
description:
2025-02-07 09:27:47 dovecot_plain authenticator failed for ([219.251.253.62]) [219.251.253.62]:36025: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.221.59
country_id: 1269750
description:
Feb  7 09:27:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.221.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.221.59
country_id: 1269750
description:
2025-02-07 09:27:53 dovecot_plain authenticator failed for (abts-north-static-059.221.160.122.airtelbroadband.in) [122.160.221.59]:59872: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.211.246.121
country_id: 1814991
description:
Feb  7 09:28:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.211.246.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.177.247.242
country_id: 1269750
description:
Feb  7 09:28:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.177.247.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.39.230.40
country_id: 1835841
description:
Feb  7 09:28:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.39.230.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.174
country_id: 1814991
description:
2025-02-07 09:28:22 dovecot_plain authenticator failed for ([27.40.100.174]) [27.40.100.174]:60151: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.158.72.138
country_id: 6251999
description:
Feb  7 09:27:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.158.72.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2025-02-07 09:27:41 dovecot_plain authenticator failed for ([213.230.127.217]) [213.230.127.217]:59188: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.177.247.242
country_id: 1269750
description:
2025-02-07 09:28:09 dovecot_plain authenticator failed for (host-247342.fivenetwork.com) [202.177.247.242]:33154: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.174
country_id: 1814991
description:
Feb  7 09:28:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.130.70.80
country_id: 6252001
description:
Feb  7 09:27:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.130.70.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.104
country_id: 1668284
description:
Feb  7 09:27:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.34.254
country_id: 2017370
description:
Feb  7 09:27:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.34.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.195.159
country_id: 6252001
description:
2025-02-07 09:28:01 dovecot_plain authenticator failed for (mobile-166-195-195-159.mycingular.net) [166.195.195.159]:60690: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.255.34.171
country_id: 2017370
description:
2025-02-07 09:28:02 dovecot_plain authenticator failed for broadband-188-255-34-171.ip.moscow.rt.ru [188.255.34.171]:50906: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.39.230.40
country_id: 1835841
description:
2025-02-07 09:28:12 dovecot_plain authenticator failed for ([118.39.230.40]) [118.39.230.40]:3539: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.154.62
country_id: 2017370
description:
Feb  7 09:28:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.154.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.127.217
country_id: 1512440
description:
Feb  7 09:27:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.127.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.99.163
country_id: 2017370
description:
2025-02-07 09:27:41 dovecot_plain authenticator failed for (82-208-99-163.static.mts-nn.ru) [82.208.99.163]:56438: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2025-02-07 09:27:43 dovecot_plain authenticator failed for ([121.179.93.147]) [121.179.93.147]:56168: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.104
country_id: 1668284
description:
2025-02-07 09:27:56 dovecot_plain authenticator failed for 111-70-49-104.emome-ip.hinet.net [111.70.49.104]:39410: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.255.34.171
country_id: 2017370
description:
Feb  7 09:28:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.255.34.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.154.62
country_id: 2017370
description:
2025-02-07 09:28:20 dovecot_plain authenticator failed for broadband-5-228-154-62.ip.moscow.rt.ru (hypogies) [5.228.154.62]:58032: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
country_id: 1814991
description:
Feb  7 09:27:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
country_id: 1835841
description:
Feb  7 09:27:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.70.80
country_id: 6252001
description:
2025-02-07 09:27:55 dovecot_plain authenticator failed for mobile-166-130-70-80.mycingular.net [166.130.70.80]:54299: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.168.97
country_id: 1835841
description:
2025-02-07 09:28:03 dovecot_plain authenticator failed for ([211.252.168.97]) [211.252.168.97]:36420: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.158.72.138
country_id: 6251999
description:
2025-02-07 09:27:40 dovecot_plain authenticator failed for 67-158-72-138.dhcp.execulink.com [67.158.72.138]:53696: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2025-02-07 09:27:43 dovecot_plain authenticator failed for (www.safecleen.com) [58.49.113.138]:16769: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.251.253.62
country_id: 1835841
description:
Feb  7 09:27:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.251.253.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.211.246.121
country_id: 1814991
description:
2025-02-07 09:28:06 dovecot_plain authenticator failed for ([221.211.246.121]) [221.211.246.121]:42122: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.208.99.163
country_id: 2017370
description:
Feb  7 09:27:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.208.99.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.252.168.97
country_id: 1835841
description:
Feb  7 09:28:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.252.168.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.67.18
country_id: 1814991
description:
2025-02-07 09:28:11 dovecot_plain authenticator failed for ([112.91.67.18]) [112.91.67.18]:50570: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.214.65.245
country_id: 1835841
description:
Feb  7 09:27:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.214.65.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.214.65.245
country_id: 1835841
description:
2025-02-07 09:27:55 dovecot_plain authenticator failed for ([123.214.65.245]) [123.214.65.245]:34364: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.195.159
country_id: 6252001
description:
Feb  7 09:27:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.195.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.67.18
country_id: 1814991
description:
Feb  7 09:28:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.67.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
country_id: 2017370
description:
2025-02-07 09:28:41 dovecot_plain authenticator failed for (13-78-123-185.host.cirex.ru) [185.123.78.13]:53432: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
country_id: 2658434
description:
2025-02-07 09:29:11 dovecot_plain authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:39283: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.97
country_id: 3469034
description:
2025-02-07 09:28:44 dovecot_plain authenticator failed for ([179.185.1.97]) [179.185.1.97]:37546: 535 Incorrect authentication data (set_id=abio17@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.102.165.200
country_id: 294640
description:
Feb  7 09:28:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.102.165.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.165.200
country_id: 294640
description:
2025-02-07 09:28:54 dovecot_plain authenticator failed for (82-102-165-200.orange.net.il) [82.102.165.200]:59639: 535 Incorrect authentication data (set_id=abio17)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.1.97
country_id: 3469034
description:
Feb  7 09:28:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.1.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
country_id: 2017370
description:
Feb  7 09:28:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.62
country_id: 1819730
description:
2025-02-07 09:29:02 dovecot_plain authenticator failed for (m121-202-154-62.smartone.com) [121.202.154.62]:42932: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.108.27
country_id: 3175395
description:
2025-02-07 09:30:06 dovecot_plain authenticator failed for net-93-64-108-27.cust.vodafonedsl.it [93.64.108.27]:59376: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.193.37.116
country_id: 1835841
description:
2025-02-07 09:30:30 dovecot_plain authenticator failed for ([211.193.37.116]) [211.193.37.116]:42294: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.175.225.109
country_id: 1605651
description:
2025-02-07 09:31:25 dovecot_plain authenticator failed for (localhost) [118.175.225.109]:44764: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2025-02-07 09:30:36 dovecot_plain authenticator failed for (phrocued) [65.20.148.194]:38662: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2025-02-07 09:31:18 dovecot_plain authenticator failed for ([218.149.235.152]) [218.149.235.152]:47456: 535 Incorrect authentication data (set_id=ads19b00188y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.16.161.35
country_id: 953987
description:
2025-02-07 09:31:19 dovecot_plain authenticator failed for ([105.16.161.35]) [105.16.161.35]:38502: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.124.127.56
country_id: 6252001
description:
2025-02-07 09:31:01 dovecot_plain authenticator failed for ([98.124.127.56]) [98.124.127.56]:44608: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.100.220.123
country_id: 1562822
description:
2025-02-07 09:31:02 dovecot_plain authenticator failed for (localhost) [116.100.220.123]:48208: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.165.251
country_id: 1835841
description:
2025-02-07 09:31:33 dovecot_plain authenticator failed for ([211.178.165.251]) [211.178.165.251]:48489: 535 Incorrect authentication data (set_id=ads19b00188y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.70.142
country_id: 1835841
description:
2025-02-07 09:32:22 dovecot_plain authenticator failed for ([218.149.70.142]) [218.149.70.142]:39018: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.36.39
country_id: 6251999
description:
2025-02-07 09:32:27 dovecot_login authenticator failed for (ADMIN) [191.96.36.39]:1362: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.175.225.109
country_id: 1605651
description:
2025-02-07 09:31:41 dovecot_plain authenticator failed for (localhost) [118.175.225.109]:44911: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-02-07 09:32:10 dovecot_plain authenticator failed for ([89.101.36.159]) [89.101.36.159]:49737: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.70.142
country_id: 1835841
description:
Feb  7 09:32:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.70.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.175.130.145
country_id: 3895114
description:
[2025-02-07 09:32:21 +0100] info [webmaild] 186.175.130.145 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
country_id: 1835841
description:
2025-02-07 09:31:45 dovecot_plain authenticator failed for ([115.22.247.178]) [115.22.247.178]:52275: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.125.68.208
country_id: 1835841
description:
2025-02-07 09:32:34 dovecot_plain authenticator failed for ([175.125.68.208]) [175.125.68.208]:33517: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.179
country_id: 1814991
description:
2025-02-07 09:32:38 dovecot_plain authenticator failed for ([182.135.66.179]) [182.135.66.179]:37838: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.31
country_id: 1819730
description:
2025-02-07 09:32:40 dovecot_plain authenticator failed for (m121-202-200-31.smartone.com) [121.202.200.31]:26894: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.118.83.237
country_id: 6252001
description:
2025-02-07 09:32:47 dovecot_plain authenticator failed for syn-172-118-083-237.res.spectrum.com [172.118.83.237]:34217: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.19.108
country_id: 298795
description:
2025-02-07 09:33:04 dovecot_plain authenticator failed for ([149.0.19.108]) [149.0.19.108]:33244: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.143.30.155
country_id: 1814991
description:
2025-02-07 09:33:10 dovecot_plain authenticator failed for ([222.143.30.155]) [222.143.30.155]:37732: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.46.115.29
country_id: 6290252
description:
Feb  7 09:34:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.46.115.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.29
country_id: 6290252
description:
2025-02-07 09:34:13 dovecot_login authenticator failed for (ADMIN) [37.46.115.29]:51660: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.89.118
country_id: 226074
description:
2025-02-07 09:34:18 dovecot_plain authenticator failed for ([196.0.89.118]) [196.0.89.118]:45945: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.84.107.245
country_id: 1835841
description:
2025-02-07 09:33:37 dovecot_login authenticator failed for ([220.84.107.245]) [220.84.107.245]:49029: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.229.58
country_id: 6252001
description:
2025-02-07 09:33:59 dovecot_login authenticator failed for ([104.241.229.58]) [104.241.229.58]:47137: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
country_id: 3469034
description:
2025-02-07 09:34:07 dovecot_plain authenticator failed for ([200.149.51.186]) [200.149.51.186]:48344: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.57.71
country_id: 1819730
description:
2025-02-07 09:35:21 dovecot_plain authenticator failed for n220246057071.netvigator.com [220.246.57.71]:55327: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.189
country_id: 1814991
description:
2025-02-07 09:34:48 dovecot_login authenticator failed for ([111.61.177.189]) [111.61.177.189]:29828: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.137.159
country_id: 1269750
description:
2025-02-07 09:35:02 dovecot_login authenticator failed for ([103.109.44.163]) [122.165.137.159]:34706: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.247.92.186
country_id: 1814991
description:
2025-02-07 09:35:03 dovecot_plain authenticator failed for ([60.247.92.186]) [60.247.92.186]:35853: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.166.68.89
country_id: 2017370
description:
2025-02-07 09:35:05 dovecot_plain authenticator failed for (5x166x68x89.dynamic.barnaul.ertelecom.ru) [5.166.68.89]:60934: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.123
country_id: 1269750
description:
2025-02-07 09:35:11 dovecot_plain authenticator failed for ([103.146.233.123]) [103.146.233.123]:35466: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.201.7
country_id: 1835841
description:
2025-02-07 09:34:47 dovecot_plain authenticator failed for ([59.12.201.7]) [59.12.201.7]:45989: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
country_id: 1814991
description:
Feb  7 09:34:48 ait sshd[1700974]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
country_id: 1814991
description:
Feb  7 09:34:48 ait sshd[1700974]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.20.180
country_id: 1562822
description:
2025-02-07 09:34:55 dovecot_plain authenticator failed for ([27.71.20.180]) [27.71.20.180]:59545: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.183.213.234
country_id: 3469034
description:
[2025-02-07 09:35:16 +0100] info [webmaild] 177.183.213.234 - info@aitsmartschool.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 09:36:26 ait sshd[1701737]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 09:36:26 ait sshd[1701737]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.83.205
country_id: 1814991
description:
2025-02-07 09:35:36 dovecot_plain authenticator failed for ([58.18.83.205]) [58.18.83.205]:54088: 535 Incorrect authentication data (set_id=klah)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 204.10.194.42
country_id: 2921044
domain: elibrary.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:appiahkubiemmanuel360@gmail.com||WPU:appiahkubiemmanuel360@gmail.com||RSV:6.65||T:APACHE||MV:09-36.204.10.194.42


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.66.58.174
country_id: 690791
description:
[2025-02-07 09:36:14 +0100] info [webmaild] 212.66.58.174 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.57.104.252
country_id: 1522867
description:
2025-02-07 09:36:25 dovecot_plain authenticator failed for 95.57.104.252.dynamic.telecom.kz [95.57.104.252]:32783: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.5.245.129
country_id: 1814991
description:
Feb  7 09:36:30 ait sshd[1701742]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.5.245.129


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.5.245.129
country_id: 1814991
description:
Feb  7 09:36:30 ait sshd[1701742]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.5.245.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.202
country_id: 1819730
description:
2025-02-07 09:36:52 dovecot_plain authenticator failed for (m121-202-206-202.smartone.com) [121.202.206.202]:25684: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.80.166
country_id: 1880251
description:
2025-02-07 09:36:55 dovecot_plain authenticator failed for (166.80.156.175.unknown.m1.com.sg) [175.156.80.166]:50310: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


