# incident

plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.69.23.79
country_id: 6251999
domain: jabmar.org
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/cache.php||SC:/home/titlemas/public_html/JABMAR.org/images/images


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 188.166.105.120
country_id: 2750405
description:
Feb  6 18:54:24 ait sshd[1351786]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.105.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.22.37.184
country_id: 3144096
description:
2025-02-06 18:54:37 dovecot_plain authenticator failed for ([217.22.37.184]) [217.22.37.184]:38192: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
country_id: 1210997
description:
Feb  6 18:54:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.160.166.237
country_id: 1820814
description:
Feb  6 18:54:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.160.166.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-02-06 18:54:40 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:42245: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.170
country_id: 3923057
description:
2025-02-06 18:54:45 dovecot_plain authenticator failed for static-200-105-141-170.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.170]:43258: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.245.95.11
country_id: 1562822
description:
Feb  6 18:54:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.245.95.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.17
country_id: 1835841
description:
2025-02-06 18:54:46 dovecot_plain authenticator failed for ([121.154.90.17]) [121.154.90.17]:58110: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.100.105.194
country_id: 2750405
description:
Feb  6 18:54:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.100.105.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.59.53
country_id: 617790
description:
2025-02-06 18:54:48 dovecot_plain authenticator failed for ([185.167.59.53]) [185.167.59.53]:41232: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.88.106
country_id: 1814991
description:
2025-02-06 18:54:47 dovecot_plain authenticator failed for ([117.158.88.106]) [117.158.88.106]:12220: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.166.105.120
country_id: 2750405
description:
Feb  6 18:54:24 ait sshd[1351786]: pam_imunify(sshd:auth): [IM360_RBL] The IP 188.166.105.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.226.173.151
country_id: 2017370
description:
2025-02-06 18:54:37 dovecot_plain authenticator failed for (pool-176-226-173-151.is74.ru) [176.226.173.151]:55140: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.139.39.106
country_id: 1814991
description:
Feb  6 18:54:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.139.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.95.67.92
country_id: 6252001
description:
Feb  6 18:54:39 ait sshd[1351899]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.95.67.92  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
country_id: 3932488
description:
2025-02-06 18:54:41 dovecot_plain authenticator failed for ([200.37.179.83]) [200.37.179.83]:49856: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
country_id: 1835841
description:
2025-02-06 18:54:43 dovecot_plain authenticator failed for ([219.248.65.30]) [219.248.65.30]:43034: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.151.154.196
country_id: 2921044
description:
2025-02-06 18:54:43 dovecot_plain authenticator failed for p50979ac4.dip0.t-ipconnect.de [80.151.154.196]:53289: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.245.95.11
country_id: 1562822
description:
2025-02-06 18:54:48 dovecot_plain authenticator failed for ([210.245.95.11]) [210.245.95.11]:57624: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
country_id: 1814991
description:
2025-02-06 18:54:40 dovecot_plain authenticator failed for ([125.72.92.174]) [125.72.92.174]:44892: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.7.86.144
country_id: 1814991
description:
2025-02-06 18:54:42 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [123.7.86.144]:35604: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.138.181
country_id: 1819730
description:
Feb  6 18:54:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.138.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.182
country_id: 1668284
description:
2025-02-06 18:54:47 dovecot_plain authenticator failed for 111-70-49-182.emome-ip.hinet.net [111.70.49.182]:52478: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-02-06 18:55:21 dovecot_plain authenticator failed for ([103.107.36.18]) [103.107.36.18]:54278: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.124.225.252
country_id: 1835841
description:
2025-02-06 18:54:54 dovecot_plain authenticator failed for ([220.124.225.252]) [220.124.225.252]:49969: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-02-06 18:54:57 dovecot_plain authenticator failed for ([200.202.250.46]) [200.202.250.46]:53363: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.199.57.220
country_id: 6251999
description:
2025-02-06 18:55:02 dovecot_plain authenticator failed for ([192.199.57.220]) [192.199.57.220]:41943: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.58.225.46
country_id: 1814991
description:
Feb  6 18:55:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.58.225.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.177.75
country_id: 1269750
description:
2025-02-06 18:55:07 dovecot_plain authenticator failed for (49.207.177.75.actcorp.in) [49.207.177.75]:35546: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.213.68
country_id: 3865483
description:
2025-02-06 18:55:08 dovecot_plain authenticator failed for (red.138.118.213.068.ssservicios.com.ar) [138.118.213.68]:40502: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
country_id: 1269750
description:
Feb  6 18:55:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.26.63.158
country_id: 1814991
description:
Feb  6 18:54:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.26.63.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.71.173.250
country_id: 1269750
description:
Feb  6 18:54:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.71.173.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.44
country_id: 6251999
description:
Feb  6 18:55:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.105.3.221
country_id: 1835841
description:
2025-02-06 18:55:23 dovecot_plain authenticator failed for ([183.105.3.221]) [183.105.3.221]:36392: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.124.225.252
country_id: 1835841
description:
Feb  6 18:54:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.124.225.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.240.2.38
country_id: 1814991
description:
Feb  6 18:54:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.240.2.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
country_id: 6252001
description:
2025-02-06 18:54:54 dovecot_plain authenticator failed for ([96.79.174.131]) [96.79.174.131]:39070: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.202.250.46
country_id: 3469034
description:
Feb  6 18:54:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.202.250.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2025-02-06 18:54:57 dovecot_plain authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:39448: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2025-02-06 18:54:59 dovecot_plain authenticator failed for 128.27.155.104.bc.googleusercontent.com [104.155.27.128]:62652: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
country_id: 1269750
description:
2025-02-06 18:55:02 dovecot_plain authenticator failed for ([59.99.153.21]) [59.99.153.21]:26896: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.184.194
country_id: 1814991
description:
Feb  6 18:55:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.184.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.103.235.223
country_id: 1835841
description:
Feb  6 18:54:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.103.235.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-02-06 18:54:50 dovecot_plain authenticator failed for ([83.136.176.12]) [83.136.176.12]:33198: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.14.232
country_id: 1512440
description:
Feb  6 18:54:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.14.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.71.173.250
country_id: 1269750
description:
2025-02-06 18:54:59 dovecot_plain authenticator failed for ([14.97.7.138]) [182.71.173.250]:52550: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
country_id: 1562822
description:
2025-02-06 18:55:01 dovecot_plain authenticator failed for ([171.244.40.228]) [171.244.40.236]:37995: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.80.241.73
country_id: 1835841
description:
2025-02-06 18:55:03 dovecot_plain authenticator failed for ([61.80.241.73]) [61.80.241.73]:40524: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.133.161
country_id: 1269750
description:
2025-02-06 18:55:16 dovecot_plain authenticator failed for (abts-north-dynamic-161.133.176.122.airtelbroadband.in) [122.176.133.161]:53579: 535 Incorrect authentication data (set_id=ds18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.119.2
country_id: 1814991
description:
2025-02-06 18:54:51 dovecot_plain authenticator failed for ([180.168.119.2]) [180.168.119.2]:52509: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.234.154
country_id: 1814991
description:
2025-02-06 18:54:54 dovecot_plain authenticator failed for ([183.167.234.154]) [183.167.234.154]:60726: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.15
country_id: 6251999
description:
2025-02-06 18:54:56 dovecot_plain authenticator failed for ([207.219.222.15]) [207.219.222.15]:46477: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.177.106
country_id: 2275384
description:
2025-02-06 18:55:02 dovecot_plain authenticator failed for ([196.250.177.106]) [196.250.177.106]:38831: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.54.3.2
country_id: 1814991
description:
Feb  6 18:55:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.54.3.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.75.189
country_id: 1814991
description:
Feb  6 18:54:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.75.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.118.229
country_id: 1880251
description:
2025-02-06 18:54:55 dovecot_plain authenticator failed for ([138.75.118.229]) [138.75.118.229]:56404: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.240.2.38
country_id: 1814991
description:
2025-02-06 18:54:56 dovecot_plain authenticator failed for ([58.240.2.38]) [58.240.2.38]:44024: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.92.25.206
country_id: 1835841
description:
2025-02-06 18:55:10 dovecot_plain authenticator failed for ([220.92.25.206]) [220.92.25.206]:55252: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
country_id: 1835841
description:
2025-02-06 18:54:50 dovecot_plain authenticator failed for ([218.150.170.10]) [218.150.170.10]:58158: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.155.27.128
country_id: 2802361
description:
Feb  6 18:54:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.155.27.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.72.14.152
country_id: 6252001
description:
2025-02-06 18:54:59 dovecot_plain authenticator failed for ([76.72.14.152]) [76.72.14.152]:64766: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.80.241.73
country_id: 1835841
description:
Feb  6 18:55:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.80.241.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.65
country_id: 1819730
description:
2025-02-06 18:55:02 dovecot_plain authenticator failed for (m121-202-154-65.smartone.com) [121.202.154.65]:44766: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.38.70.172
country_id: 1168579
description:
2025-02-06 18:55:07 dovecot_plain authenticator failed for ([110.38.70.172]) [110.38.70.172]:43259: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.92.25.206
country_id: 1835841
description:
Feb  6 18:55:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.92.25.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.239.78.124
country_id: 1819730
description:
Feb  6 18:55:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.239.78.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.100.105.194
country_id: 2750405
description:
2025-02-06 18:54:50 dovecot_plain authenticator failed for d96469c2.static.ziggozakelijk.nl ([217.100.105.195]) [217.100.105.194]:56542: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.15
country_id: 6251999
description:
Feb  6 18:54:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.26.63.158
country_id: 1814991
description:
2025-02-06 18:54:54 dovecot_plain authenticator failed for ([36.26.63.158]) [36.26.63.158]:54136: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.194.34
country_id: 1880251
description:
2025-02-06 18:54:58 dovecot_plain authenticator failed for (34.194.75.138.unknown.m1.com.sg) [138.75.194.34]:33539: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-02-06 18:54:59 dovecot_plain authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:38166: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.44
country_id: 6251999
description:
2025-02-06 18:55:05 dovecot_plain authenticator failed for ([207.219.222.44]) [207.219.222.44]:44327: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.118.213.68
country_id: 3865483
description:
Feb  6 18:55:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.118.213.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.182.32.16
country_id: 1814991
description:
Feb  6 18:55:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.182.32.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
country_id: 6252001
description:
Feb  6 18:54:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.75.189
country_id: 1814991
description:
2025-02-06 18:54:57 dovecot_plain authenticator failed for ([183.236.75.189]) [183.236.75.189]:55618: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
country_id: 6252001
description:
Feb  6 18:54:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.38.70.172
country_id: 1168579
description:
Feb  6 18:55:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.38.70.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.207.177.75
country_id: 1269750
description:
Feb  6 18:55:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.207.177.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.166.162.78
country_id: 1814991
description:
Feb  6 18:55:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.166.162.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.58.225.46
country_id: 1814991
description:
2025-02-06 18:55:08 dovecot_plain authenticator failed for ([58.58.225.46]) [58.58.225.46]:52630: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
country_id: 3895114
description:
Feb  6 18:55:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.103.235.223
country_id: 1835841
description:
2025-02-06 18:54:52 dovecot_plain authenticator failed for ([222.103.235.223]) [222.103.235.223]:56246: 535 Incorrect authentication data (set_id=eng20a00022y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.230.168.26
country_id: 2661886
description:
Feb  6 18:54:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.230.168.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.46.250
country_id: 3469034
description:
2025-02-06 18:54:55 dovecot_plain authenticator failed for ([189.80.46.250]) [189.80.46.250]:35310: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.194.34
country_id: 1880251
description:
Feb  6 18:54:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.194.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.253
country_id: 1819730
description:
Feb  6 18:54:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.103.120.150
country_id: 1819730
description:
Feb  6 18:55:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.103.120.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.212.136.240
country_id: 6252001
description:
2025-02-06 18:55:04 dovecot_plain authenticator failed for 240.sub-97-212-136.myvzw.com [97.212.136.240]:57934: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.54.3.2
country_id: 1814991
description:
2025-02-06 18:55:15 dovecot_plain authenticator failed for ([182.54.3.2]) [182.54.3.2]:37800: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.118.229
country_id: 1880251
description:
Feb  6 18:54:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.118.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.98
country_id: 1269750
description:
2025-02-06 18:54:53 dovecot_plain authenticator failed for ([103.190.91.98]) [103.190.91.98]:49411: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.148.43
country_id: 1835841
description:
Feb  6 18:54:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.148.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.120.150
country_id: 1819730
description:
2025-02-06 18:55:05 dovecot_plain authenticator failed for 150.120.103.218.static.netvigator.com [218.103.120.150]:55945: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
country_id: 3895114
description:
2025-02-06 18:55:07 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:47048: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.176.133.161
country_id: 1269750
description:
Feb  6 18:55:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.176.133.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.34.192.68
country_id: 1814991
description:
Feb  6 18:55:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.34.192.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.166.162.78
country_id: 1814991
description:
2025-02-06 18:54:50 dovecot_plain authenticator failed for ([180.166.162.78]) [180.166.162.78]:4570: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.148.43
country_id: 1835841
description:
2025-02-06 18:55:00 dovecot_plain authenticator failed for ([183.109.148.43]) [183.109.148.43]:40940: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.253
country_id: 1819730
description:
2025-02-06 18:55:01 dovecot_plain authenticator failed for (m121-202-152-253.smartone.com) [121.202.152.253]:32789: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2025-02-06 18:55:10 dovecot_plain authenticator failed for ([182.239.78.124]) [182.239.78.124]:58676: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.34.192.68
country_id: 1814991
description:
2025-02-06 18:55:21 dovecot_plain authenticator failed for (68.192.34.58.broad.xw.sh.dynamic.163data.com.cn) [58.34.192.68]:56793: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.182.32.16
country_id: 1814991
description:
2025-02-06 18:55:15 dovecot_plain authenticator failed for ([118.182.32.16]) [118.182.32.16]:35196: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.119.2
country_id: 1814991
description:
Feb  6 18:54:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.119.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.35.237.38
country_id: 1835841
description:
Feb  6 18:54:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.35.237.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.35.237.38
country_id: 1835841
description:
2025-02-06 18:54:56 dovecot_plain authenticator failed for ([211.35.237.38]) [211.35.237.38]:44533: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.72.14.152
country_id: 6252001
description:
Feb  6 18:54:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.72.14.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
country_id: 1562822
description:
Feb  6 18:54:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.199.57.220
country_id: 6251999
description:
Feb  6 18:55:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.199.57.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.212.136.240
country_id: 6252001
description:
Feb  6 18:55:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.212.136.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.105.3.221
country_id: 1835841
description:
Feb  6 18:55:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.105.3.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.184.194
country_id: 1814991
description:
2025-02-06 18:55:27 dovecot_plain authenticator failed for ([114.242.172.76]) [61.51.184.194]:49281: 535 Incorrect authentication data (set_id=ds18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.98
country_id: 1269750
description:
Feb  6 18:54:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.14.232
country_id: 1512440
description:
2025-02-06 18:54:54 dovecot_plain authenticator failed for ([195.158.14.232]) [195.158.14.232]:35656: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.65
country_id: 1819730
description:
Feb  6 18:55:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.234.154
country_id: 1814991
description:
Feb  6 18:54:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.234.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.80.46.250
country_id: 3469034
description:
Feb  6 18:54:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.80.46.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.99.153.21
country_id: 1269750
description:
Feb  6 18:55:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.99.153.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.177.106
country_id: 2275384
description:
Feb  6 18:55:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.177.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.75.33.121
country_id: 174982
description:
Feb  6 18:56:02 ait sshd[1352827]: pam_imunify(sshd:auth): [IM360_RBL] The IP 109.75.33.121 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 109.75.33.121
country_id: 174982
description:
Feb  6 18:56:02 ait sshd[1352827]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.75.33.121


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.47.172.133
country_id: 1831722
description:
Feb  6 18:56:27 ait sshd[1352946]: pam_imunify(sshd:auth): [IM360_RBL] The IP 163.47.172.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 18:56:27 ait sshd[1352951]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 18:56:27 ait sshd[1352951]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.117.0.253
country_id: 1835841
description:
Feb  6 18:56:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.117.0.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
country_id: 1835841
description:
2025-02-06 18:56:09 dovecot_plain authenticator failed for ([222.117.0.253]) [222.117.0.253]:42485: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.114.230
country_id: 6252001
description:
Feb  6 18:56:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.114.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.114.230
country_id: 6252001
description:
2025-02-06 18:56:18 dovecot_plain authenticator failed for zdomainaccess.com [216.70.114.230]:46068: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 163.47.172.133
country_id: 1831722
description:
Feb  6 18:56:27 ait sshd[1352946]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.47.172.133  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.255.119.54
country_id: 1562822
description:
Feb  6 18:57:00 ait sshd[1353152]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.255.119.54


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.239.165.120
country_id: 1643084
description:
Feb  6 18:57:30 ait sshd[1353287]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.239.165.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.245.145.254
country_id: 1880251
description:
2025-02-06 18:57:45 dovecot_plain authenticator failed for ([157.245.145.254]) [157.245.145.254]:50920: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 18:56:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:18-57.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.46.207.98
country_id: 6252001
description:
Feb  6 18:57:30 ait sshd[1353291]: pam_imunify(sshd:auth): [IM360_RBL] The IP 198.46.207.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.208.253.74
country_id: 130758
description:
Feb  6 18:57:38 ait sshd[1353310]: pam_imunify(sshd:auth): [IM360_RBL] The IP 85.208.253.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.38.70.172
country_id: 1168579
description:
2025-02-06 18:57:49 dovecot_login authenticator failed for ([110.38.70.172]) [110.38.70.172]:35849: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.198.146.227
country_id: 2921044
description:
Feb  6 18:56:52 ait sshd[1353143]: pam_imunify(sshd:auth): [IM360_RBL] The IP 35.198.146.227 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.239.165.120
country_id: 1643084
description:
Feb  6 18:57:30 ait sshd[1353287]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.239.165.120


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.145.254
country_id: 1880251
description:
Feb  6 18:57:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.145.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.38.70.172
country_id: 1168579
description:
Feb  6 18:57:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.38.70.172 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 35.198.146.227
country_id: 2921044
description:
Feb  6 18:56:52 ait sshd[1353143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.198.146.227


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.255.119.54
country_id: 1562822
description:
Feb  6 18:57:00 ait sshd[1353152]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.255.119.54 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 198.46.207.98
country_id: 6252001
description:
Feb  6 18:57:30 ait sshd[1353291]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.46.207.98


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 85.208.253.74
country_id: 130758
description:
Feb  6 18:57:38 ait sshd[1353310]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.208.253.74


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.71.37.202
country_id: 1814991
description:
Feb  6 18:57:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.71.37.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.129.94
country_id: 149590
description:
2025-02-06 18:58:34 dovecot_plain authenticator failed for host-41-220-129-94.habari.co.tz ([197.250.7.50]) [41.220.129.94]:50786: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 109.75.33.121
country_id: 174982
description:
Feb  6 18:58:46 ait sshd[1353916]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.75.33.121


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.202.1.58
country_id: 3469034
description:
2025-02-06 18:58:10 dovecot_plain authenticator failed for ([177.202.1.58]) [177.202.1.58]:47933: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.202.94.224
country_id: 390903
description:
Feb  6 18:58:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.202.94.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.175.76.146
country_id: 6252001
description:
Feb  6 18:58:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.175.76.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.23.172
country_id: 6251999
description:
Feb  6 18:58:41 ait sshd[1353740]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.203.23.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.75.33.121
country_id: 174982
description:
Feb  6 18:58:46 ait sshd[1353916]: pam_imunify(sshd:auth): [IM360_RBL] The IP 109.75.33.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.18.139.82
country_id: 1814991
description:
Feb  6 18:57:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.18.139.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.52.202.92
country_id: 1814991
description:
Feb  6 18:58:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.52.202.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.91.39
country_id: 130758
description:
Feb  6 18:58:21 ait sshd[1353548]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.91.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.202.1.58
country_id: 3469034
description:
Feb  6 18:58:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.202.1.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.210.188.130
country_id: 1814991
description:
2025-02-06 18:58:11 dovecot_plain authenticator failed for ([58.210.188.130]) [58.210.188.130]:53458: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 198.46.207.98
country_id: 6252001
description:
Feb  6 18:58:42 ait sshd[1353749]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.46.207.98


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.131.46.146
country_id: 1814991
description:
Feb  6 18:57:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.131.46.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.71.37.202
country_id: 1814991
description:
2025-02-06 18:57:54 dovecot_plain authenticator failed for ([47.98.191.121]) [101.71.37.202]:32208: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.131.46.146
country_id: 1814991
description:
2025-02-06 18:57:54 dovecot_plain authenticator failed for ([61.131.46.146]) [61.131.46.146]:40276: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.171.64.170
country_id: 6252001
description:
Feb  6 18:58:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.171.64.170 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.207.98
country_id: 6252001
description:
Feb  6 18:58:44 ait sshd[1353749]: Failed password for invalid user admin from 198.46.207.98 port 56192 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.23.199.34
country_id: 1643084
description:
Feb  6 18:58:25 ait sshd[1353603]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.23.199.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.174.189.52
country_id: 1835841
description:
2025-02-06 18:58:27 dovecot_plain authenticator failed for ([121.174.189.52]) [121.174.189.52]:32943: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.46.207.98
country_id: 6252001
description:
Feb  6 18:58:42 ait sshd[1353749]: pam_imunify(sshd:auth): [IM360_RBL] The IP 198.46.207.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.18.139.82
country_id: 1814991
description:
2025-02-06 18:58:00 dovecot_plain authenticator failed for ([60.18.139.82]) [60.18.139.82]:51652: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
country_id: 1269750
description:
2025-02-06 18:58:03 dovecot_plain authenticator failed for ([115.245.172.214]) [115.245.172.214]:48396: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.166.105.120
country_id: 2750405
description:
Feb  6 18:58:20 ait sshd[1353544]: pam_imunify(sshd:auth): [IM360_RBL] The IP 188.166.105.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.174.189.52
country_id: 1835841
description:
Feb  6 18:58:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.174.189.52 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 188.166.105.120
country_id: 2750405
description:
Feb  6 18:58:20 ait sshd[1353544]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.105.120


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
country_id: 2017370
description:
Feb  6 18:57:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
country_id: 2017370
description:
2025-02-06 18:57:57 dovecot_login authenticator failed for (12-78-123-185.host.cirex.ru) [185.123.78.13]:61258: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.245.172.214
country_id: 1269750
description:
Feb  6 18:58:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.245.172.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.24.33
country_id: 3508796
description:
Feb  6 18:58:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.24.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.129.94
country_id: 149590
description:
Feb  6 18:58:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.129.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.36.24.33
country_id: 3508796
description:
2025-02-06 18:58:03 dovecot_plain authenticator failed for ([138.36.24.33]) [138.36.24.33]:43438: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.64.170
country_id: 6252001
description:
2025-02-06 18:58:03 dovecot_plain authenticator failed for ([50.171.64.170]) [50.171.64.170]:52072: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.210.188.130
country_id: 1814991
description:
Feb  6 18:58:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.210.188.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
country_id: 6252001
description:
2025-02-06 18:58:32 dovecot_plain authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:47370: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.203.23.172
country_id: 6251999
description:
Feb  6 18:58:41 ait sshd[1353740]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.23.172  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.52.202.92
country_id: 1814991
description:
2025-02-06 18:58:04 dovecot_plain authenticator failed for ([123.52.202.92]) [123.52.202.92]:56892: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.91.39
country_id: 130758
description:
Feb  6 18:58:21 ait sshd[1353548]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.91.39


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.202.94.224
country_id: 390903
description:
2025-02-06 18:58:21 dovecot_plain authenticator failed for o6z8xc.static.otenet.gr [87.202.94.224]:38730: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.23.199.34
country_id: 1643084
description:
Feb  6 18:58:25 ait sshd[1353603]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.23.199.34


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.89.116.5
country_id: 6252001
description:
Feb  6 18:59:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.89.116.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.33.87.111
country_id: 2017370
description:
2025-02-06 18:59:43 dovecot_plain authenticator failed for (111-86-33-194.intelcom-ug.ru) [194.33.87.111]:52376: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.83.182.122
country_id: 6252001
description:
Feb  6 18:59:00 ait sshd[1354016]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.83.182.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 18:59:38 ait sshd[1354305]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.77.216.166
country_id: 2635167
description:
2025-02-06 18:59:41 dovecot_plain authenticator failed for 79-77-216-166.dynamic.dsl.as9105.com [79.77.216.166]:55999: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.198.146.227
country_id: 2921044
description:
Feb  6 18:59:11 ait sshd[1354065]: pam_imunify(sshd:auth): [IM360_RBL] The IP 35.198.146.227 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 35.198.146.227
country_id: 2921044
description:
Feb  6 18:59:11 ait sshd[1354065]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.198.146.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.77.216.166
country_id: 2635167
description:
Feb  6 18:59:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.77.216.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.83.182.122
country_id: 6252001
description:
Feb  6 18:59:00 ait sshd[1354016]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.83.182.122


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.166.105.120
country_id: 2750405
description:
Feb  6 18:59:30 ait sshd[1354124]: pam_imunify(sshd:auth): [IM360_RBL] The IP 188.166.105.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.33.87.111
country_id: 2017370
description:
Feb  6 18:59:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.33.87.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
country_id: 6252001
description:
2025-02-06 18:59:44 dovecot_plain authenticator failed for ([70.89.116.5]) [70.89.116.5]:46714: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 188.166.105.120
country_id: 2750405
description:
Feb  6 18:59:30 ait sshd[1354124]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.105.120


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 18:59:38 ait sshd[1354305]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.238
country_id: 337996
description:
Feb  6 18:59:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.227.87.29
country_id: 1814991
description:
Feb  6 19:00:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.227.87.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.227.87.29
country_id: 1814991
description:
2025-02-06 19:00:08 dovecot_plain authenticator failed for ([106.227.87.29]) [106.227.87.29]:51530: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.252.197.3
country_id: 732800
description:
2025-02-06 19:00:11 dovecot_plain authenticator failed for ([151.252.197.3]) [151.252.197.3]:60748: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.83.182.122
country_id: 6252001
description:
Feb  6 19:00:13 ait sshd[1354662]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.83.182.122 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.83.182.122
country_id: 6252001
description:
Feb  6 19:00:13 ait sshd[1354662]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.83.182.122


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.198.146.227
country_id: 2921044
description:
Feb  6 19:00:24 ait sshd[1354746]: pam_imunify(sshd:auth): [IM360_RBL] The IP 35.198.146.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.208.253.74
country_id: 130758
description:
Feb  6 19:00:29 ait sshd[1354879]: pam_imunify(sshd:auth): [IM360_RBL] The IP 85.208.253.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.252.197.3
country_id: 732800
description:
Feb  6 19:00:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.252.197.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.91.39
country_id: 130758
description:
Feb  6 19:00:42 ait sshd[1354908]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.91.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.238
country_id: 337996
description:
2025-02-06 18:59:54 dovecot_plain authenticator failed for ([196.191.212.238]) [196.191.212.238]:52272: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.93.134
country_id: 1835841
description:
2025-02-06 18:59:57 dovecot_plain authenticator failed for ([211.109.93.134]) [211.109.93.134]:36306: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 35.198.146.227
country_id: 2921044
description:
Feb  6 19:00:24 ait sshd[1354746]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.198.146.227


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 85.208.253.74
country_id: 130758
description:
Feb  6 19:00:29 ait sshd[1354879]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.208.253.74


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.91.39
country_id: 130758
description:
Feb  6 19:00:42 ait sshd[1354908]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.91.39


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.93.134
country_id: 1835841
description:
Feb  6 18:59:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.93.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.183.178
country_id: 2017370
description:
Feb  6 19:00:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.183.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.183.178
country_id: 2017370
description:
2025-02-06 19:00:21 dovecot_plain authenticator failed for broadband-5-228-183-178.ip.moscow.rt.ru [5.228.183.178]:45533: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.7.248.50
country_id: 1814991
description:
Feb  6 19:01:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.7.248.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.7.248.50
country_id: 1814991
description:
2025-02-06 19:01:25 dovecot_plain authenticator failed for ([116.7.248.50]) [116.7.248.50]:33138: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.191.253.130
country_id: 6252001
description:
Feb  6 19:01:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.191.253.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.191.253.130
country_id: 6252001
description:
2025-02-06 19:01:37 dovecot_plain authenticator failed for syn-068-191-253-130.biz.spectrum.com ([68.191.253.131]) [68.191.253.130]:37668: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.221.101.111
country_id: 3144096
description:
Feb  6 19:01:48 ait sshd[1355479]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.221.101.111


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.212.235.151
country_id: 1562822
description:
Feb  6 19:00:56 ait sshd[1355075]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.212.235.151  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.23.199.34
country_id: 1643084
description:
Feb  6 19:01:24 ait sshd[1355296]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.23.199.34 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.23.199.34
country_id: 1643084
description:
Feb  6 19:01:24 ait sshd[1355296]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.23.199.34


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.221.101.111
country_id: 3144096
description:
Feb  6 19:01:48 ait sshd[1355479]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.221.101.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.235.151
country_id: 1562822
description:
Feb  6 19:00:56 ait sshd[1355075]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.212.235.151 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-01.194.163.182.227


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.208.253.74
country_id: 130758
description:
Feb  6 19:01:47 ait sshd[1355357]: pam_imunify(sshd:auth): [IM360_RBL] The IP 85.208.253.74 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 85.208.253.74
country_id: 130758
description:
Feb  6 19:01:47 ait sshd[1355357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.208.253.74


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.255.119.54
country_id: 1562822
description:
Feb  6 19:02:12 ait sshd[1355634]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.255.119.54 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.208.253.74
country_id: 130758
description:
Feb  6 19:01:49 ait sshd[1355357]: Failed password for invalid user cdr from 85.208.253.74 port 44012 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.91.39
country_id: 130758
description:
Feb  6 19:02:05 ait sshd[1355580]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.91.39 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.91.39
country_id: 130758
description:
Feb  6 19:02:05 ait sshd[1355580]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.91.39


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.255.119.54
country_id: 1562822
description:
Feb  6 19:02:12 ait sshd[1355634]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.255.119.54


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.221.101.111
country_id: 3144096
description:
Feb  6 19:01:50 ait sshd[1355479]: Failed password for invalid user goudirect from 92.221.101.111 port 55370 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.23.199.34
country_id: 1643084
description:
Feb  6 19:03:47 ait sshd[1356276]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.23.199.34


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.191.145.123
country_id: 1814991
description:
Feb  6 19:03:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.191.145.123 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 180.100.217.208
country_id: 1814991
description:
Feb  6 19:03:31 ait sshd[1356225]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.100.217.208


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.23.199.34
country_id: 1643084
description:
Feb  6 19:03:47 ait sshd[1356276]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.23.199.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.108.44.169
country_id: 660013
description:
Feb  6 19:04:12 ait sshd[1356571]: pam_imunify(sshd:auth): [IM360_RBL] The IP 65.108.44.169 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.227.2.181
country_id: 1814991
description:
Feb  6 19:04:17 ait sshd[1356579]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.227.2.181


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.56.252.11
country_id: 2963597
description:
Feb  6 19:04:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.56.252.11 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.127.67.83
country_id: 2077456
description:
Feb  6 19:04:20 ait sshd[1356588]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.67.83  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.180.0
country_id: 1269750
description:
Feb  6 19:03:58 ait sshd[1356514]: pam_imunify(sshd:auth): [IM360_RBL] The IP 143.110.180.0 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.117.91.67
country_id: 1835841
description:
2025-02-06 19:04:06 dovecot_plain authenticator failed for ([220.117.91.67]) [220.117.91.67]:59452: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.84.62.149
country_id: 3996063
description:
2025-02-06 19:04:44 dovecot_plain authenticator failed for ([187.218.57.50]) [138.84.62.149]:29129: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.178.158.132
country_id: 1269750
description:
2025-02-06 19:03:54 dovecot_plain authenticator failed for ([103.178.158.133]) [103.178.158.132]:46526: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.117.91.67
country_id: 1835841
description:
Feb  6 19:04:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.117.91.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.56.252.11
country_id: 2963597
description:
2025-02-06 19:04:23 dovecot_login authenticator failed for (ADMIN) [193.56.252.11]:41522: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 54.238.102.131
country_id: 1861060
domain: ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:19-04.54.238.102.131


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 65.108.44.169
country_id: 660013
description:
Feb  6 19:04:12 ait sshd[1356571]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.108.44.169  user=lemassne


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.178.158.132
country_id: 1269750
description:
Feb  6 19:03:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.178.158.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.127.67.83
country_id: 2077456
description:
Feb  6 19:04:20 ait sshd[1356588]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.127.67.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.24
country_id: 3625428
description:
2025-02-06 19:04:02 dovecot_login authenticator failed for (ADMIN) [95.181.237.24]:45600: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.227.2.181
country_id: 1814991
description:
Feb  6 19:04:17 ait sshd[1356579]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.227.2.181 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.34
country_id: 1643084
description:
Feb  6 19:03:50 ait sshd[1356276]: Disconnected from invalid user admin 103.23.199.34 port 47286 [preauth]


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.255.119.54
country_id: 1562822
description:
Feb  6 19:03:51 ait sshd[1356409]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.255.119.54


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 143.110.180.0
country_id: 1269750
description:
Feb  6 19:03:58 ait sshd[1356514]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.110.180.0  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.255.119.54
country_id: 1562822
description:
Feb  6 19:03:51 ait sshd[1356409]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.255.119.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 19:04:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 65.108.44.169
country_id: 660013
description:
[2025-02-06 19:04:11 +0100] info [whostmgrd] 65.108.44.169 - lemassne "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.132.43.94
country_id: 1814991
description:
Feb  6 19:05:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.132.43.94 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 5.183.209.179
country_id: 2750405
description:
Feb  6 19:05:41 ait sshd[1357495]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.183.209.179  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.33.204.130
country_id: 2017370
description:
Feb  6 19:05:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.33.204.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.132.2
country_id: 3017382
description:
2025-02-06 19:04:52 dovecot_plain authenticator failed for vps-6186bf6b.vps.ovh.net [57.129.132.2]:52922: 535 Incorrect authentication data (set_id=efreeman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.132.43.94
country_id: 1814991
description:
2025-02-06 19:05:04 dovecot_login authenticator failed for ([116.132.43.94]) [116.132.43.94]:12474: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.165.83
country_id: 99237
description:
Feb  6 19:05:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.165.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.172.192.150
country_id: 6252001
description:
Feb  6 19:05:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.172.192.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.172.192.150
country_id: 6252001
description:
2025-02-06 19:05:14 dovecot_login authenticator failed for syn-173-172-192-150.res.spectrum.com [173.172.192.150]:57018: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.132.2
country_id: 3017382
description:
Feb  6 19:04:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.129.132.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.191.253.130
country_id: 6252001
description:
Feb  6 19:05:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.191.253.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.183.209.179
country_id: 2750405
description:
Feb  6 19:05:41 ait sshd[1357495]: pam_imunify(sshd:auth): [IM360_RBL] The IP 5.183.209.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.165.83
country_id: 99237
description:
2025-02-06 19:05:14 dovecot_plain authenticator failed for ([65.20.165.83]) [65.20.165.83]:41956: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.191.253.130
country_id: 6252001
description:
2025-02-06 19:05:23 dovecot_plain authenticator failed for syn-068-191-253-130.biz.spectrum.com ([68.191.253.131]) [68.191.253.130]:57144: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.108.70.38
country_id: 1814991
description:
2025-02-06 19:06:06 dovecot_login authenticator failed for ([218.108.70.38]) [218.108.70.38]:34602: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.97.219.60
country_id: 1269750
description:
Feb  6 19:06:28 ait sshd[1357806]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.97.219.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 19:06:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.161.197.130
country_id: 1562822
description:
Feb  6 19:05:52 ait sshd[1357528]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.161.197.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.182.71.73
country_id: 3017382
description:
Feb  6 19:06:40 ait sshd[1357887]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.182.71.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.232.19.79
country_id: 2750405
description:
Feb  6 19:06:44 ait sshd[1357899]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.232.19.79 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.232.19.79
country_id: 2750405
description:
Feb  6 19:06:44 ait sshd[1357899]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.232.19.79  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.161.197.130
country_id: 1562822
description:
Feb  6 19:05:52 ait sshd[1357528]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.197.130


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2025-02-06 19:05:51 dovecot_login authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:59616: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 77.83.1.40
country_id: 2635167
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:RubyO||WPU:RubyO||RSV:6.65||T:APACHE||MV:19-06.77.83.1.40


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.97.219.60
country_id: 1269750
description:
Feb  6 19:06:28 ait sshd[1357806]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.97.219.60


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 77.83.1.38
country_id: 2635167
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:RubyO||WPU:RubyO||RSV:6.65||T:APACHE||MV:19-05.77.83.1.38


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.182.71.73
country_id: 3017382
description:
Feb  6 19:06:40 ait sshd[1357887]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.182.71.73


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.108.70.38
country_id: 1814991
description:
Feb  6 19:06:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.108.70.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 180.100.217.208
country_id: 1814991
description:
Feb  6 19:06:05 ait sshd[1357713]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.100.217.208


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
country_id: 1269750
description:
2025-02-06 19:07:19 dovecot_login authenticator failed for ([115.247.159.106]) [115.247.159.106]:43460: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.144.60.123
country_id: 6252001
description:
Feb  6 19:07:43 ait sshd[1358356]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.144.60.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.208.221
country_id: 1814991
description:
2025-02-06 19:07:49 dovecot_plain authenticator failed for ([113.64.208.221]) [113.64.208.221]:40851: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
country_id: 1835841
description:
Feb  6 19:07:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 180.100.217.208
country_id: 1814991
description:
Feb  6 19:07:12 ait sshd[1358150]: Failed password for invalid user user from 180.100.217.208 port 52958 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.181.1.49
country_id: 6252001
description:
2025-02-06 19:07:30 dovecot_plain authenticator failed for static-47-181-1-49.lsan.ca.frontiernet.net [47.181.1.49]:33464: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.132.2
country_id: 3017382
description:
2025-02-06 19:07:32 dovecot_plain authenticator failed for vps-6186bf6b.vps.ovh.net [57.129.132.2]:59176: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.226.113
country_id: 290557
description:
2025-02-06 19:07:40 dovecot_plain authenticator failed for ([94.207.226.113]) [94.207.226.113]:60717: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.205.14.196
country_id: 226074
description:
2025-02-06 19:07:44 dovecot_plain authenticator failed for ([129.205.14.196]) [129.205.14.196]:50602: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.90.195.68
country_id: 953987
description:
2025-02-06 19:06:59 dovecot_login authenticator failed for ([197.90.195.68]) [197.90.195.68]:57583: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.54.22.11
country_id: 1835841
description:
Feb  6 19:07:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.54.22.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.220.167.38
country_id: 1814991
description:
Feb  6 19:07:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.220.167.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.170.154
country_id: 1835841
description:
Feb  6 19:07:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.170.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.208.221
country_id: 1814991
description:
Feb  6 19:07:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.208.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.90.195.68
country_id: 953987
description:
Feb  6 19:06:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.90.195.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 19:07:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.144.60.123
country_id: 6252001
description:
Feb  6 19:07:43 ait sshd[1358356]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.144.60.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.132.2
country_id: 3017382
description:
Feb  6 19:07:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.129.132.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.207.226.113
country_id: 290557
description:
Feb  6 19:07:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.207.226.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.205.14.196
country_id: 226074
description:
Feb  6 19:07:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.205.14.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.57.217.38
country_id: 1643084
description:
Feb  6 19:07:01 ait sshd[1358123]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.57.217.38  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2025-02-06 19:07:07 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:36706: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 180.100.217.208
country_id: 1814991
description:
Feb  6 19:07:10 ait sshd[1358150]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.100.217.208


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.220.167.38
country_id: 1814991
description:
2025-02-06 19:07:31 dovecot_plain authenticator failed for ([223.220.167.38]) [223.220.167.38]:55530: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.16.135
country_id: 290557
description:
Feb  6 19:07:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.16.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.16.135
country_id: 290557
description:
2025-02-06 19:07:46 dovecot_login authenticator failed for ([5.31.16.135]) [5.31.16.135]:48327: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.57.217.38
country_id: 1643084
description:
Feb  6 19:07:01 ait sshd[1358123]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.57.217.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.62.34.216
country_id: 6252001
description:
Feb  6 19:07:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.62.34.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-02-06 19:07:21 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:39462: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
country_id: 1835841
description:
2025-02-06 19:07:24 dovecot_plain authenticator failed for ([14.54.22.11]) [14.54.22.11]:19871: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-07.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.170.154
country_id: 1835841
description:
2025-02-06 19:07:44 dovecot_plain authenticator failed for ([211.44.170.154]) [211.44.170.154]:35254: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.247.159.106
country_id: 1269750
description:
Feb  6 19:07:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.247.159.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.181.1.49
country_id: 6252001
description:
Feb  6 19:07:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.181.1.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.53
country_id: 99237
description:
Feb  6 19:08:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.202.59.203
country_id: 2658434
description:
Feb  6 19:08:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.202.59.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.53
country_id: 99237
description:
2025-02-06 19:08:10 dovecot_plain authenticator failed for ([65.20.251.53]) [65.20.251.53]:44130: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.1.239.146
country_id: 1814991
description:
Feb  6 19:08:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.1.239.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.32.253.235
country_id: 99237
description:
Feb  6 19:08:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.32.253.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.164.28
country_id: 294640
description:
2025-02-06 19:08:06 dovecot_plain authenticator failed for ([85.159.164.28]) [85.159.164.28]:52538: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-02-06 19:08:07 dovecot_plain authenticator failed for ([213.32.253.235]) [213.32.253.235]:34459: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.99.168
country_id: 1880251
description:
2025-02-06 19:08:23 dovecot_plain authenticator failed for ([49.245.99.168]) [49.245.99.168]:34888: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.248.55
country_id: 2921044
description:
Feb  6 19:08:05 ait sshd[1358554]: pam_imunify(sshd:auth): [IM360_RBL] The IP 209.38.248.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
country_id: 1835841
description:
Feb  6 19:08:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.239.146
country_id: 1814991
description:
2025-02-06 19:08:24 dovecot_plain authenticator failed for ([116.231.84.13]) [218.1.239.146]:62438: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.33.87.111
country_id: 2017370
description:
Feb  6 19:08:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.33.87.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.249.167.45
country_id: 6252001
description:
Feb  6 19:08:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.249.167.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.178.132
country_id: 3175395
description:
2025-02-06 19:08:10 dovecot_plain authenticator failed for (132-178-53-194.mairnet.net) [194.53.178.132]:58588: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.208.79
country_id: 1819730
description:
2025-02-06 19:08:21 dovecot_plain authenticator failed for (223-197-208-79.static.imsbiz.com) [223.197.208.79]:59619: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.20.166
country_id: 3175395
description:
2025-02-06 19:08:22 dovecot_plain authenticator failed for ([2.192.20.166]) [2.192.20.166]:55790: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 209.38.248.55
country_id: 2921044
description:
Feb  6 19:08:05 ait sshd[1358554]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.248.55


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.93.156.147
country_id: 798544
description:
2025-02-06 19:08:08 dovecot_plain authenticator failed for ip4-193-93-156-147.blue-net.com.pl ([193.93.156.149]) [193.93.156.147]:53148: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.249.167.45
country_id: 6252001
description:
2025-02-06 19:08:11 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:34278: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2025-02-06 19:08:11 dovecot_plain authenticator failed for works.ssc-gr.info [160.251.121.70]:50100: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.99.237.249
country_id: 1835841
description:
Feb  6 19:08:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.99.237.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.218.168.192
country_id: 3996063
description:
Feb  6 19:08:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.218.168.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.53.82
country_id: 1814991
description:
Feb  6 19:08:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.53.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.53.82
country_id: 1814991
description:
2025-02-06 19:08:38 dovecot_plain authenticator failed for ([60.172.53.82]) [60.172.53.82]:58480: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.124.14
country_id: 3469034
description:
Feb  6 19:08:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.124.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-02-06 19:08:08 dovecot_plain authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:52972: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.178.132
country_id: 3175395
description:
Feb  6 19:08:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.178.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.0.200
country_id: 1814991
description:
Feb  6 19:08:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.0.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.54.22.11
country_id: 1835841
description:
Feb  6 19:08:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.54.22.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.52.253.175
country_id: 1814991
description:
Feb  6 19:08:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.52.253.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.14.135
country_id: 1668284
description:
Feb  6 19:08:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.14.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.233.26
country_id: 6252001
description:
2025-02-06 19:08:23 dovecot_plain authenticator failed for ([104.241.233.26]) [104.241.233.26]:41415: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.14.135
country_id: 1668284
description:
2025-02-06 19:08:25 dovecot_plain authenticator failed for 111-70-14-135.emome-ip.hinet.net [111.70.14.135]:49703: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.214.52.214
country_id: 1835841
description:
Feb  6 19:08:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.214.52.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.168.192
country_id: 3996063
description:
2025-02-06 19:08:16 dovecot_plain authenticator failed for (189.218.168.192-clientes-izzi.mx) [189.218.168.192]:36348: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.11
country_id: 1819730
description:
2025-02-06 19:08:19 dovecot_plain authenticator failed for (m121-202-205-11.smartone.com) [121.202.205.11]:30985: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.99.168
country_id: 1880251
description:
Feb  6 19:08:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.99.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.52.253.175
country_id: 1814991
description:
2025-02-06 19:08:26 dovecot_plain authenticator failed for ([111.52.253.175]) [111.52.253.175]:58260: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.49.179.157
country_id: 6252001
description:
Feb  6 19:08:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.49.179.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.237.249
country_id: 1835841
description:
2025-02-06 19:08:14 dovecot_plain authenticator failed for ([222.99.237.249]) [222.99.237.249]:41436: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.208.79
country_id: 1819730
description:
Feb  6 19:08:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.208.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.233.26
country_id: 6252001
description:
Feb  6 19:08:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.233.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
country_id: 1835841
description:
2025-02-06 19:08:24 dovecot_plain authenticator failed for ([14.54.22.11]) [14.54.22.11]:24103: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
country_id: 1269750
description:
2025-02-06 19:08:27 dovecot_plain authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:43786: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.31.80.222
country_id: 1814991
description:
Feb  6 19:08:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.31.80.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.159.164.28
country_id: 294640
description:
Feb  6 19:08:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.159.164.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.248.1.199
country_id: 3144096
description:
2025-02-06 19:08:07 dovecot_plain authenticator failed for (ip-199-1-248-87.eidsiva.net) [87.248.1.199]:54678: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.0.200
country_id: 1814991
description:
2025-02-06 19:08:11 dovecot_plain authenticator failed for ([218.22.0.200]) [218.22.0.200]:60734: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.234.165.73
country_id: 1835841
description:
2025-02-06 19:08:14 dovecot_plain authenticator failed for ([58.234.165.73]) [58.234.165.73]:51322: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.164.188
country_id: 1819730
description:
Feb  6 19:08:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.164.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.80.222
country_id: 1814991
description:
2025-02-06 19:08:29 dovecot_plain authenticator failed for ([1.31.80.222]) [1.31.80.222]:48290: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.248.1.199
country_id: 3144096
description:
Feb  6 19:08:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.248.1.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
country_id: 1835841
description:
2025-02-06 19:08:17 dovecot_plain authenticator failed for ([115.22.247.178]) [115.22.247.178]:57149: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.141.194.159
country_id: 1835841
description:
2025-02-06 19:08:22 dovecot_plain authenticator failed for ([121.141.194.159]) [121.141.194.159]:45680: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.239.187.13
country_id: 1819730
description:
Feb  6 19:08:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.239.187.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.11
country_id: 1819730
description:
Feb  6 19:08:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.192.20.166
country_id: 3175395
description:
Feb  6 19:08:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.192.20.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.159.14.187
country_id: 3469034
description:
2025-02-06 19:07:58 dovecot_login authenticator failed for (200-168-190-81.jandaia.com) [200.159.14.187]:40454: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.202.59.203
country_id: 2658434
description:
2025-02-06 19:08:11 dovecot_plain authenticator failed for (dyn-cable-cust.203.59.202.213.quicknet.ch) [213.202.59.203]:47816: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.234.165.73
country_id: 1835841
description:
Feb  6 19:08:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.234.165.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.239.187.13
country_id: 1819730
description:
2025-02-06 19:08:12 dovecot_plain authenticator failed for ([20.239.187.13]) [20.239.187.13]:58292: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.164.188
country_id: 1819730
description:
2025-02-06 19:08:22 dovecot_plain authenticator failed for ([223.197.164.188]) [223.197.164.188]:51855: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.93.156.147
country_id: 798544
description:
Feb  6 19:08:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.93.156.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.33.87.111
country_id: 2017370
description:
2025-02-06 19:08:07 dovecot_plain authenticator failed for (111-86-33-194.intelcom-ug.ru) [194.33.87.111]:52428: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.251.121.70
country_id: 1861060
description:
Feb  6 19:08:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.251.121.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.234
country_id: 1668284
description:
2025-02-06 19:08:35 dovecot_plain authenticator failed for 110-25-105-234.adsl.fetnet.net [110.25.105.234]:49452: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.30.217.31
country_id: 2017370
description:
2025-02-06 19:08:23 dovecot_plain authenticator failed for 95-30-217-31.broadband.corbina.ru [95.30.217.31]:56876: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.214.52.214
country_id: 1835841
description:
2025-02-06 19:08:32 dovecot_plain authenticator failed for ([175.214.52.214]) [175.214.52.214]:53657: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.159.14.187
country_id: 3469034
description:
Feb  6 19:07:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.159.14.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.49.179.157
country_id: 6252001
description:
2025-02-06 19:08:11 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:54871: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.141.194.159
country_id: 1835841
description:
Feb  6 19:08:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.141.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.65.21
country_id: 1814991
description:
Feb  6 19:08:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.65.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.35.117.110
country_id: 2510769
description:
Feb  6 19:08:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.35.117.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.35.117.110
country_id: 2510769
description:
2025-02-06 19:08:58 dovecot_plain authenticator failed for ([46.35.117.110]) [46.35.117.110]:35634: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 5.160.247.200
country_id: 130758
domain: ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:19-09.5.160.247.200


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.30.20.98
country_id: 1814991
description:
Feb  6 19:08:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.30.20.98 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.231.105.154
country_id: 6252001
description:
Feb  6 19:08:55 ait sshd[1358753]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.231.105.154


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
country_id: 1814991
description:
2025-02-06 19:08:52 dovecot_plain authenticator failed for ([1.30.20.98]) [1.30.20.98]:44520: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.184.58
country_id: 1814991
description:
Feb  6 19:09:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.184.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.184.58
country_id: 1814991
description:
2025-02-06 19:09:17 dovecot_plain authenticator failed for ([120.237.184.58]) [120.237.184.58]:59677: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 19:09:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.2.214.145
country_id: 1562822
description:
Feb  6 19:08:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.2.214.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.65.21
country_id: 1814991
description:
2025-02-06 19:08:55 dovecot_plain authenticator failed for ([183.220.65.21]) [183.220.65.21]:56404: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.2.214.145
country_id: 1562822
description:
2025-02-06 19:08:57 dovecot_plain authenticator failed for ([27.2.214.145]) [27.2.214.145]:44517: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.82.20.241
country_id: 1819730
description:
Feb  6 19:10:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.82.20.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
country_id: 1819730
description:
2025-02-06 19:10:40 dovecot_plain authenticator failed for 202-82-20-241.static.imsbiz.com [202.82.20.241]:58668: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.103.231
country_id: 6252001
description:
Feb  6 19:10:25 ait sshd[1359686]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.103.231  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.182
country_id: 1819730
description:
Feb  6 19:10:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.182
country_id: 1819730
description:
2025-02-06 19:10:37 dovecot_login authenticator failed for (m121-202-155-182.smartone.com) [121.202.155.182]:46325: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.255.21.110
country_id: 6252001
description:
2025-02-06 19:10:49 dovecot_login authenticator failed for (static.162.255.21.110.macminivault.com) [162.255.21.110]:62470: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.103.231
country_id: 6252001
description:
Feb  6 19:10:25 ait sshd[1359686]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.103.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.255.21.110
country_id: 6252001
description:
Feb  6 19:10:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.255.21.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.26.64
country_id: 1562822
description:
2025-02-06 19:11:11 dovecot_plain authenticator failed for ([27.71.26.64]) [27.71.26.64]:36032: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.115.125
country_id: 6252001
description:
Feb  6 19:11:31 ait sshd[1360217]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.115.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
country_id: 1814991
description:
Feb  6 19:11:03 ait sshd[1360051]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.26.64
country_id: 1562822
description:
Feb  6 19:11:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.26.64 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.115.125
country_id: 6252001
description:
Feb  6 19:11:31 ait sshd[1360217]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.115.125


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
country_id: 1814991
description:
Feb  6 19:11:03 ait sshd[1360051]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.13.2
country_id: 1814991
description:
2025-02-06 19:12:11 dovecot_plain authenticator failed for ([183.236.13.2]) [183.236.13.2]:36062: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 19:12:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.69.23.79
country_id: 6251999
domain: jaster.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/cache.php||SC:/home/titlemas/public_html/www.jaster.us/images/images


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 19:11:54 ait sshd[1360318]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 19:11:54 ait sshd[1360318]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 19:12:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.175.110.3
country_id: 1814991
description:
Feb  6 19:12:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.175.110.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.175.110.3
country_id: 1814991
description:
2025-02-06 19:12:28 dovecot_plain authenticator failed for ([222.175.110.3]) [222.175.110.3]:60574: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 158.69.23.79
country_id: 6251999
domain: jaster.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:19-12.158.69.23.79||RSV:6.65||T:APACHE||


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-11.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.26.64
country_id: 1562822
description:
Feb  6 19:13:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.26.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.26.64
country_id: 1562822
description:
2025-02-06 19:13:27 dovecot_plain authenticator failed for ([27.71.26.64]) [27.71.26.64]:45198: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.31.73
country_id: 6252001
description:
Feb  6 19:13:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.31.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 19:13:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 19:13:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.31.73
country_id: 6252001
description:
2025-02-06 19:13:38 dovecot_plain authenticator failed for ([65.76.31.73]) [65.76.31.73]:55050: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.199.25.254
country_id: 1269750
description:
Feb  6 19:15:04 ait sshd[1361977]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.25.254  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.138.27.5
country_id: 1880251
description:
Feb  6 19:15:45 ait sshd[1362137]: pam_imunify(sshd:auth): [IM360_RBL] The IP 174.138.27.5 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 174.138.27.5
country_id: 1880251
description:
Feb  6 19:15:45 ait sshd[1362137]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.138.27.5  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 19:15:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.25.254
country_id: 1269750
description:
Feb  6 19:15:04 ait sshd[1361977]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.25.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.68.0.210
country_id: 1814991
description:
Feb  6 19:15:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.68.0.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.68.0.210
country_id: 1814991
description:
2025-02-06 19:15:36 dovecot_plain authenticator failed for ([218.68.0.210]) [218.68.0.210]:56345: 535 Incorrect authentication data (set_id=ads19b00188y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.188.44
country_id: 1814991
description:
2025-02-06 19:16:20 dovecot_login authenticator failed for ([58.16.188.44]) [58.16.188.44]:55302: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.78.119.104
country_id: 1835841
description:
Feb  6 19:16:49 ait sshd[1362498]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.78.119.104


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.236.162.125
country_id: 2077456
description:
Feb  6 19:16:08 ait sshd[1362398]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.236.162.125  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.188.44
country_id: 1814991
description:
Feb  6 19:16:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.188.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.236.162.125
country_id: 2077456
description:
Feb  6 19:16:08 ait sshd[1362398]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.236.162.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.200.239
country_id: 6252001
description:
Feb  6 19:16:15 ait sshd[1362413]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.178.200.239 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.178.200.239
country_id: 6252001
description:
Feb  6 19:16:15 ait sshd[1362413]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.178.200.239  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.78.119.104
country_id: 1835841
description:
Feb  6 19:16:49 ait sshd[1362498]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.78.119.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.200.80.226
country_id: 290557
description:
Feb  6 19:16:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.200.80.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.80.226
country_id: 290557
description:
2025-02-06 19:16:06 dovecot_login authenticator failed for ([94.200.80.226]) [94.200.80.226]:50379: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 143.198.1.143
country_id: 6252001
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-17.143.198.1.143


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 19:16:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.12.68.242
country_id: 1814991
description:
Feb  6 19:17:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.12.68.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.12.68.242
country_id: 1814991
description:
2025-02-06 19:17:09 dovecot_plain authenticator failed for ([210.12.68.242]) [210.12.68.242]:46402: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 19:17:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-17.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.207.241.168
country_id: 2245662
description:
Feb  6 19:16:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.207.241.168 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.78.119.104
country_id: 1835841
description:
Feb  6 19:16:51 ait sshd[1362498]: Failed password for invalid user goudirect from 121.78.119.104 port 55552 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.241.168
country_id: 2245662
description:
2025-02-06 19:16:52 dovecot_plain authenticator failed for ([196.207.241.168]) [196.207.241.168]:49446: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.211
country_id: 1819730
description:
Feb  6 19:18:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
country_id: 1819730
description:
2025-02-06 19:18:31 dovecot_login authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:40782: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.91
country_id: 99237
description:
Feb  6 19:18:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.91
country_id: 99237
description:
2025-02-06 19:18:40 dovecot_plain authenticator failed for (unwedly) [65.20.155.91]:42159: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.192.79.179
country_id: 3865483
description:
Feb  6 19:18:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.192.79.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.192.79.179
country_id: 3865483
description:
2025-02-06 19:18:45 dovecot_login authenticator failed for (pppoe-179.79.192.181.in-addr.arpa) [181.192.79.179]:52430: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.81.78
country_id: 1814991
description:
Feb  6 19:18:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.81.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.81.78
country_id: 1814991
description:
2025-02-06 19:18:08 dovecot_plain authenticator failed for ([61.51.81.78]) [61.51.81.78]:32792: 535 Incorrect authentication data (set_id=ads32a00023y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.47
country_id: 1819730
description:
Feb  6 19:19:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.47
country_id: 1819730
description:
2025-02-06 19:19:10 dovecot_plain authenticator failed for (m121-202-155-47.smartone.com) [121.202.155.47]:47065: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.79.249.83
country_id: 6252001
description:
2025-02-06 19:19:24 dovecot_plain authenticator failed for ([50.79.249.83]) [50.79.249.83]:6245: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 159.223.206.253
country_id: 6252001
domain: titopen.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/titlemas/public_html/titopen.us/wp-admin


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 159.223.206.253
country_id: 6252001
domain: titopen.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:19-18.159.223.206.253||RSV:6.65||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.76.250.194
country_id: 1269750
description:
Feb  6 19:20:22 ait sshd[1363986]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.250.194  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.187
country_id: 1562822
description:
Feb  6 19:20:37 ait sshd[1364142]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.106.104.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
country_id: 1269750
description:
2025-02-06 19:20:28 dovecot_plain authenticator failed for ([115.247.159.106]) [115.247.159.106]:35738: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.106.104.187
country_id: 1562822
description:
Feb  6 19:20:37 ait sshd[1364142]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.106.104.187


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.109.33.120
country_id: 690791
description:
Feb  6 19:20:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.109.33.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.109.33.120
country_id: 690791
description:
2025-02-06 19:20:11 dovecot_plain authenticator failed for rplus.dp.ua [77.109.33.120]:47084: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 19:20:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.76.250.194
country_id: 1269750
description:
Feb  6 19:20:22 ait sshd[1363986]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.76.250.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.247.159.106
country_id: 1269750
description:
Feb  6 19:20:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.247.159.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.51.38
country_id: 6252001
description:
Feb  6 19:20:59 ait sshd[1364202]: pam_imunify(sshd:auth): [IM360_RBL] The IP 74.208.51.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 74.208.51.38
country_id: 6252001
description:
Feb  6 19:20:59 ait sshd[1364202]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.208.51.38


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.28.51
country_id: 1814991
description:
2025-02-06 19:21:02 dovecot_plain authenticator failed for ([222.128.28.51]) [222.128.28.51]:44150: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.44
country_id: 3625428
description:
2025-02-06 19:21:42 dovecot_login authenticator failed for (ADMIN) [95.181.237.44]:52900: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.22
country_id: 298795
description:
2025-02-06 19:20:54 dovecot_login authenticator failed for (ADMIN) [188.213.34.22]:57694: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.7
country_id: 1819730
description:
Feb  6 19:21:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.55.177.39
country_id: 1835841
description:
2025-02-06 19:21:14 dovecot_plain authenticator failed for ([218.55.177.39]) [218.55.177.39]:41696: 535 Incorrect authentication data (set_id=ads07b99022y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.231.105.154
country_id: 6252001
description:
Feb  6 19:21:13 ait sshd[1364199]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.231.105.154


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.213.34.22
country_id: 298795
description:
Feb  6 19:20:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.213.34.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.186.221.174
country_id: 1269750
description:
Feb  6 19:21:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.186.221.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.165.230
country_id: 1814991
description:
2025-02-06 19:21:01 dovecot_plain authenticator failed for ([183.237.165.230]) [183.237.165.230]:34598: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.55.177.39
country_id: 1835841
description:
Feb  6 19:21:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.55.177.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
country_id: 1880251
description:
2025-02-06 19:21:12 dovecot_plain authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:2029: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.7
country_id: 1819730
description:
2025-02-06 19:21:12 dovecot_plain authenticator failed for ([121.202.152.7]) [121.202.152.7]:14454: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.165.230
country_id: 1814991
description:
Feb  6 19:20:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.165.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.28.51
country_id: 1814991
description:
Feb  6 19:21:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.28.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.221.174
country_id: 1269750
description:
2025-02-06 19:21:02 dovecot_plain authenticator failed for ([103.186.221.174]) [103.186.221.174]:56476: 535 Incorrect authentication data (set_id=ads07b99022y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-02-06 19:22:26 dovecot_login authenticator failed for ([102.53.15.180]) [102.53.15.180]:40018: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.202.250.46
country_id: 3469034
description:
Feb  6 19:21:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.202.250.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-02-06 19:21:54 dovecot_login authenticator failed for ([200.202.250.46]) [200.202.250.46]:53228: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.192.20.137
country_id: 3175395
description:
Feb  6 19:22:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.192.20.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.20.137
country_id: 3175395
description:
2025-02-06 19:22:02 dovecot_login authenticator failed for ([2.192.20.137]) [2.192.20.137]:40010: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.170
country_id: 1814991
description:
Feb  6 19:22:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.170
country_id: 1814991
description:
2025-02-06 19:22:14 dovecot_login authenticator failed for ([116.114.84.170]) [116.114.84.170]:33301: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.180
country_id: 2542007
description:
Feb  6 19:22:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.245.29.237
country_id: 1835841
description:
Feb  6 19:23:30 ait sshd[1365079]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.245.29.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.149.233.247
country_id: 1835841
description:
Feb  6 19:23:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.149.233.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.233.247
country_id: 1835841
description:
2025-02-06 19:23:43 dovecot_plain authenticator failed for ([221.149.233.247]) [221.149.233.247]:36788: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
country_id: 1835841
description:
2025-02-06 19:22:56 dovecot_plain authenticator failed for ([1.227.228.136]) [1.227.228.136]:40435: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.32.209.51
country_id: 2635167
description:
Feb  6 19:23:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.32.209.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.32.209.51
country_id: 2635167
description:
2025-02-06 19:23:06 dovecot_plain authenticator failed for ([217.32.209.50]) [217.32.209.51]:28883: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 70.37.89.177
country_id: 6252001
description:
Feb  6 19:23:09 ait sshd[1364900]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.37.89.177


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.17.80
country_id: 2921044
description:
Feb  6 19:23:50 ait sshd[1365178]: pam_imunify(sshd:auth): [IM360_RBL] The IP 57.129.17.80 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 57.129.17.80
country_id: 2921044
description:
Feb  6 19:23:50 ait sshd[1365178]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=57.129.17.80


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.245.29.237
country_id: 1835841
description:
Feb  6 19:23:30 ait sshd[1365079]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.245.29.237


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
country_id: 1835841
description:
Feb  6 19:22:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.37.89.177
country_id: 6252001
description:
Feb  6 19:23:09 ait sshd[1364900]: pam_imunify(sshd:auth): [IM360_RBL] The IP 70.37.89.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.149.106
country_id: 1814991
description:
2025-02-06 19:24:03 dovecot_plain authenticator failed for ([124.114.149.106]) [124.114.149.106]:45659: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-24.194.163.182.227


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.129.17.80
country_id: 2921044
description:
Feb  6 19:23:52 ait sshd[1365178]: Failed password for invalid user goudirect from 57.129.17.80 port 56796 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.34.73.139
country_id: 1814991
description:
2025-02-06 19:25:12 dovecot_plain authenticator failed for (139.73.34.171.adsl-pool.jx.chinaunicom.com) [171.34.73.139]:1050: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.155.105
country_id: 1814991
description:
2025-02-06 19:25:22 dovecot_plain authenticator failed for ([222.68.155.105]) [222.68.155.105]:60388: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.12.219
country_id: 1668284
description:
Feb  6 19:25:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.12.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.12.219
country_id: 1668284
description:
2025-02-06 19:25:40 dovecot_plain authenticator failed for 111-70-12-219.emome-ip.hinet.net [111.70.12.219]:38350: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.11.119
country_id: 1269750
description:
2025-02-06 19:24:58 dovecot_plain authenticator failed for ([122.175.11.119]) [122.175.11.119]:38237: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.109.10.69
country_id: 1880251
description:
Feb  6 19:26:25 ait sshd[1366710]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.109.10.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.33.247.159
country_id: 2661886
description:
2025-02-06 19:26:38 dovecot_plain authenticator failed for 92-33-247-159.customers.ownit.se (bileine) [92.33.247.159]:45996: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.241.102
country_id: 1835841
description:
2025-02-06 19:26:40 dovecot_plain authenticator failed for ([112.186.241.102]) [112.186.241.102]:40563: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.241.15
country_id: 2017370
description:
2025-02-06 19:26:45 dovecot_plain authenticator failed for broadband-5-228-241-15.ip.moscow.rt.ru [5.228.241.15]:53990: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.131.163.41
country_id: 6252001
description:
Feb  6 19:26:07 ait sshd[1366503]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.131.163.41 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.231.105.154
country_id: 6252001
description:
Feb  6 19:26:37 ait sshd[1366747]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.231.105.154


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.131.163.41
country_id: 6252001
description:
Feb  6 19:26:07 ait sshd[1366503]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.163.41


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.10.69
country_id: 1880251
description:
Feb  6 19:26:25 ait sshd[1366710]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.10.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.226.113
country_id: 290557
description:
2025-02-06 19:26:26 dovecot_plain authenticator failed for ([94.207.226.113]) [94.207.226.113]:55454: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.39.187.16
country_id: 3469034
description:
Feb  6 19:27:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.39.187.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.39.187.16
country_id: 3469034
description:
2025-02-06 19:27:09 dovecot_plain authenticator failed for ([189.39.187.16]) [189.39.187.16]:32792: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  6 19:27:26 ait sshd[1367139]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.215.195.65
country_id: 6252001
description:
2025-02-06 19:26:58 dovecot_plain authenticator failed for (162-215-195-65.unifiedlayer.com) [162.215.195.65]:61828: 535 Incorrect authentication data (set_id=mawunyo)


plugin: modsec
rule: 77140880
name: IM360 WAF: Infectors: PHP Injection Attack
abuser: 204.10.194.175
country_id: 2921044
domain: oum.ait-edu.us
description:
IM360 WAF: Infectors: PHP Injection Attack||MVN:ARGS:fw||MV:fwrite||RSV:6.65||T:APACHE||SC:/home/titlemas/public_html/oum/wp-content/plugins/wp-ver.php


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  6 19:27:26 ait sshd[1367139]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 19:27:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
country_id: 1814991
description:
2025-02-06 19:26:59 dovecot_plain authenticator failed for ([27.223.100.92]) [27.223.100.90]:41524: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.24.33
country_id: 3508796
description:
Feb  6 19:28:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.24.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.36.24.33
country_id: 3508796
description:
2025-02-06 19:28:49 dovecot_login authenticator failed for ([138.36.24.33]) [138.36.24.33]:48820: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.61.6
country_id: 290557
description:
Feb  6 19:28:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.61.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
country_id: 294640
description:
2025-02-06 19:29:18 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:37576: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
country_id: 294640
description:
Feb  6 19:29:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.239.187.13
country_id: 1819730
description:
Feb  6 19:29:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.239.187.13 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-29.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.239.187.13
country_id: 1819730
description:
2025-02-06 19:29:38 dovecot_plain authenticator failed for ([20.239.187.13]) [20.239.187.13]:50126: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 81.241.179.229
country_id: 2802361
description:
Feb  6 19:29:15 ait sshd[1367931]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.241.179.229


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.241.179.229
country_id: 2802361
description:
Feb  6 19:29:15 ait sshd[1367931]: pam_imunify(sshd:auth): [IM360_RBL] The IP 81.241.179.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.242.78
country_id: 1814991
description:
Feb  6 19:29:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.242.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.242.78
country_id: 1814991
description:
2025-02-06 19:29:31 dovecot_plain authenticator failed for ([120.224.242.78]) [120.224.242.78]:37067: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2025-02-06 19:29:00 dovecot_login authenticator failed for ([5.32.61.6]) [5.32.61.6]:39637: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.98.90
country_id: 1880251
description:
47.128.98.90 - - [06/Feb/2025:19:29:05 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23247187 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/b11006?panel=db" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.98.90


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
country_id: 3469034
description:
Feb  6 19:29:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
country_id: 3469034
description:
2025-02-06 19:29:25 dovecot_plain authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:61894: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
country_id: 1835841
description:
Feb  6 19:30:34 ait sshd[1368740]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
country_id: 1835841
description:
Feb  6 19:30:34 ait sshd[1368740]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.174.229.206
country_id: 2017370
description:
Feb  6 19:31:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.174.229.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.174.229.206
country_id: 2017370
description:
2025-02-06 19:31:17 dovecot_plain authenticator failed for ([93.174.229.206]) [93.174.229.206]:52439: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 19:31:24 ait sshd[1369025]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
country_id: 294640
description:
Feb  6 19:30:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.112.154.174
country_id: 1269750
description:
2025-02-06 19:30:54 dovecot_plain authenticator failed for ([203.112.154.174]) [203.112.154.174]:55956: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.21.113
country_id: 1814991
description:
2025-02-06 19:31:03 dovecot_plain authenticator failed for ([117.158.21.113]) [117.158.21.113]:42274: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.47.20.229
country_id: 1861060
description:
Feb  6 19:31:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.47.20.229 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 19:31:24 ait sshd[1369025]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.96
country_id: 1814991
description:
Feb  6 19:31:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.96 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.41
country_id: 1269750
description:
Feb  6 19:31:11 ait sshd[1368819]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.41  user=ftp


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.17.6.119
country_id: 1814991
description:
Feb  6 19:30:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.17.6.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.112.154.174
country_id: 1269750
description:
Feb  6 19:30:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.112.154.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.21.113
country_id: 1814991
description:
Feb  6 19:31:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.21.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 19:31:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.17.6.119
country_id: 1814991
description:
2025-02-06 19:30:52 dovecot_plain authenticator failed for (119.6.17.58.adsl-pool.jx.chinaunicom.com) [58.17.6.119]:37827: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
country_id: 294640
description:
2025-02-06 19:30:56 dovecot_plain authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:61963: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.112.103.62
country_id: 1861060
description:
Feb  6 19:31:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.112.103.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.112.103.62
country_id: 1861060
description:
2025-02-06 19:31:22 dovecot_plain authenticator failed for p160063-obmd01.osaka.ocn.ne.jp [61.112.103.62]:49227: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.129.92
country_id: 1814991
description:
2025-02-06 19:31:47 dovecot_plain authenticator failed for ([111.53.129.92]) [111.53.129.92]:33206: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.41
country_id: 1269750
description:
Feb  6 19:31:11 ait sshd[1368819]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.143.30.155
country_id: 1814991
description:
2025-02-06 19:31:19 dovecot_plain authenticator failed for ([222.143.30.155]) [222.143.30.155]:53778: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.20.229
country_id: 1861060
description:
2025-02-06 19:31:34 dovecot_plain authenticator failed for ([92.202.82.102]) [154.47.20.229]:47396: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.129.92
country_id: 1814991
description:
Feb  6 19:31:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.129.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.96
country_id: 1814991
description:
2025-02-06 19:31:08 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:40242: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.143.30.155
country_id: 1814991
description:
Feb  6 19:31:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.143.30.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.239.202
country_id: 1269750
description:
Feb  6 19:31:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.239.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2025-02-06 19:31:55 dovecot_plain authenticator failed for ([117.247.239.202]) [117.247.239.202]:40848: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.17.125.28
country_id: 1814991
description:
Feb  6 19:32:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.17.125.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.17.125.28
country_id: 1814991
description:
2025-02-06 19:32:06 dovecot_plain authenticator failed for ([120.55.170.138]) [183.17.125.28]:8463: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2025-02-06 19:33:26 dovecot_login authenticator failed for ([182.42.113.10]) [182.42.113.10]:34322: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.28.137.25
country_id: 1814991
description:
2025-02-06 19:33:29 dovecot_plain authenticator failed for ([112.28.137.25]) [112.28.137.25]:52330: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.205.218
country_id: 1269750
description:
Feb  6 19:33:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.205.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.113.10
country_id: 1814991
description:
Feb  6 19:33:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.42.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.28.137.25
country_id: 1814991
description:
Feb  6 19:33:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.28.137.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.205.218
country_id: 1269750
description:
2025-02-06 19:33:40 dovecot_plain authenticator failed for ([122.169.205.218]) [122.169.205.218]:47144: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.192.17
country_id: 3469034
description:
Feb  6 19:34:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.192.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.192.17
country_id: 3469034
description:
2025-02-06 19:34:48 dovecot_plain authenticator failed for ([191.59.192.17]) [191.59.192.17]:34016: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.233.177.34
country_id: 1814991
description:
Feb  6 19:33:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.233.177.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.142.39.13
country_id: 1835841
description:
Feb  6 19:34:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.142.39.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 204.93.149.224
country_id: 6252001
description:
Feb  6 19:34:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 204.93.149.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.115.211
country_id: 1880251
description:
2025-02-06 19:34:20 dovecot_plain authenticator failed for (211.115.156.175.unknown.m1.com.sg) [175.156.115.211]:48578: 535 Incorrect authentication data (set_id=ds18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.15.104
country_id: 2017370
description:
Feb  6 19:34:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.15.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.112.100.119
country_id: 1861060
description:
2025-02-06 19:34:17 dovecot_login authenticator failed for p157120-obmd01.osaka.ocn.ne.jp [61.112.100.119]:56907: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.115.211
country_id: 1880251
description:
Feb  6 19:34:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.115.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.93.149.224
country_id: 6252001
description:
2025-02-06 19:34:25 dovecot_login authenticator failed for (ADMIN) [204.93.149.224]:37154: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.142.39.13
country_id: 1835841
description:
2025-02-06 19:34:27 dovecot_login authenticator failed for ([125.142.39.13]) [125.142.39.13]:46898: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.15.104
country_id: 2017370
description:
2025-02-06 19:34:35 dovecot_login authenticator failed for 95-31-15-104.static.corbina.ru [95.31.15.104]:38285: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.244.113.178
country_id: 2017370
description:
Feb  6 19:34:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.244.113.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.244.113.178
country_id: 2017370
description:
2025-02-06 19:34:41 dovecot_plain authenticator failed for (91.244.113.178.wirenet.tv) [91.244.113.178]:53731: 535 Incorrect authentication data (set_id=ds18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 19:34:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.233.177.34
country_id: 1814991
description:
2025-02-06 19:33:55 dovecot_login authenticator failed for ([183.233.177.34]) [183.233.177.34]:49821: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.112.100.119
country_id: 1861060
description:
Feb  6 19:34:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.112.100.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.25.18.18
country_id: 1814991
description:
Feb  6 19:35:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.25.18.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.32.227.248
country_id: 3469034
description:
Feb  6 19:35:28 ait sshd[1370709]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.32.227.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.133.50
country_id: 2413451
description:
2025-02-06 19:35:37 dovecot_plain authenticator failed for ([197.231.133.50]) [197.231.133.50]:53509: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.218.58
country_id: 1835841
description:
Feb  6 19:35:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 86.81.117.20
country_id: 2750405
description:
Feb  6 19:35:44 ait sshd[1370818]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=86.81.117.20  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.11.119
country_id: 1269750
description:
2025-02-06 19:35:20 dovecot_plain authenticator failed for ([122.175.11.119]) [122.175.11.119]:49574: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.32.227.248
country_id: 3469034
description:
Feb  6 19:35:28 ait sshd[1370709]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.32.227.248


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.231.133.50
country_id: 2413451
description:
Feb  6 19:35:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.231.133.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.25.18.18
country_id: 1814991
description:
2025-02-06 19:35:34 dovecot_plain authenticator failed for ([1.25.18.18]) [1.25.18.18]:55506: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 86.81.117.20
country_id: 2750405
description:
Feb  6 19:35:44 ait sshd[1370818]: pam_imunify(sshd:auth): [IM360_RBL] The IP 86.81.117.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.93.177.228
country_id: 1269750
description:
Feb  6 19:34:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.93.177.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2025-02-06 19:34:59 dovecot_plain authenticator failed for ([111.93.177.228]) [111.93.177.228]:52856: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.175.11.119
country_id: 1269750
description:
Feb  6 19:35:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.175.11.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.100.18.224
country_id: 1835841
description:
Feb  6 19:36:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.100.18.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.188.177.46
country_id: 1643084
description:
Feb  6 19:36:44 ait sshd[1371235]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.188.177.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.200.9.182
country_id: 1814991
description:
2025-02-06 19:36:47 dovecot_login authenticator failed for ([218.200.9.182]) [218.200.9.182]:37708: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.44.120
country_id: 6251999
description:
Feb  6 19:35:59 ait sshd[1370893]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.203.44.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.68.194.54
country_id: 1835841
description:
Feb  6 19:36:26 ait sshd[1371171]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.68.194.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.100.18.224
country_id: 1835841
description:
2025-02-06 19:36:31 dovecot_plain authenticator failed for ([183.100.18.224]) [183.100.18.224]:36428: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.200.9.182
country_id: 1814991
description:
Feb  6 19:36:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.200.9.182 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-35.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.218.58
country_id: 1835841
description:
2025-02-06 19:35:50 dovecot_plain authenticator failed for ([14.35.218.58]) [14.35.218.58]:59422: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.188.177.46
country_id: 1643084
description:
Feb  6 19:36:44 ait sshd[1371235]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.188.177.46


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 79.127.182.74
country_id: 719819
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:StephenAJnr||WPU:StephenAJnr||RSV:6.65||T:APACHE||MV:19-36.79.127.182.74


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.95.161.26
country_id: 1814991
description:
2025-02-06 19:36:32 dovecot_login authenticator failed for ([223.95.161.26]) [223.95.161.26]:47496: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.68.194.54
country_id: 1835841
description:
Feb  6 19:36:26 ait sshd[1371171]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.68.194.54


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.95.161.26
country_id: 1814991
description:
Feb  6 19:36:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.95.161.26 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.203.44.120
country_id: 6251999
description:
Feb  6 19:35:59 ait sshd[1370893]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.44.120  user=ftp


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.90.99.29
country_id: 6252001
description:
Feb  6 19:36:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.90.99.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
country_id: 6252001
description:
2025-02-06 19:36:39 dovecot_plain authenticator failed for (70-90-99-29-ma-ne.hfc.comcastbusiness.net) [70.90.99.29]:54707: 535 Incorrect authentication data (set_id=assdas3)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 204.10.194.33
country_id: 2921044
domain: lemass.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ADM-CEL-2222||WPU:ADM-CEL-2222||RSV:6.65||T:APACHE||MV:19-35.204.10.194.33


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 19:36:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.103.187.12
country_id: 3077311
description:
2025-02-06 19:37:20 dovecot_plain authenticator failed for (opindemp) [88.103.187.12]:46150: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.60.194.189
country_id: 2510769
description:
2025-02-06 19:37:36 dovecot_plain authenticator failed for 81.60.194.189.dyn.user.ono.com [81.60.194.189]:49559: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 158.69.23.79
country_id: 6251999
domain: www.ait.edu.gh
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:19-37.158.69.23.79||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.249.131
country_id: 1814991
description:
2025-02-06 19:37:32 dovecot_login authenticator failed for ([60.31.249.131]) [60.31.249.131]:35064: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.60.194.189
country_id: 2510769
description:
Feb  6 19:37:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.60.194.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-02-06 19:37:46 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:45826: 535 Incorrect authentication data (set_id=dm)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.69.23.79
country_id: 6251999
domain: ait.edu.gh
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/cache.php||SC:/home/ait02/public_html/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.103.187.12
country_id: 3077311
description:
Feb  6 19:37:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.103.187.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.161.217.228
country_id: 2510769
description:
Feb  6 19:37:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.161.217.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.249.131
country_id: 1814991
description:
Feb  6 19:37:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.249.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
country_id: 6252001
description:
Feb  6 19:37:52 ait sshd[1371723]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.85.4
country_id: 294640
description:
Feb  6 19:38:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.85.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.69.163.102
country_id: 2413451
description:
Feb  6 19:38:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.69.163.102 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.33.251
country_id: 1880251
description:
47.128.33.251 - - [06/Feb/2025:19:37:57 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=22292886 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=79%2C121&filtering=1&instructor=1%2C2" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.33.251


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.247.159.106
country_id: 1269750
description:
Feb  6 19:38:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.247.159.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.62
country_id: 1819730
description:
Feb  6 19:38:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.85.4
country_id: 294640
description:
2025-02-06 19:38:11 dovecot_plain authenticator failed for ([2.55.85.4]) [2.55.85.4]:51990: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.62
country_id: 1819730
description:
2025-02-06 19:38:22 dovecot_plain authenticator failed for (m121-202-153-62.smartone.com) [121.202.153.62]:46254: 535 Incorrect authentication data (set_id=ads21a00042y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.30
country_id: 1814991
description:
Feb  6 19:37:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.30
country_id: 1814991
description:
2025-02-06 19:37:55 dovecot_login authenticator failed for ([60.167.19.30]) [60.167.19.30]:40356: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.65.21
country_id: 1814991
description:
2025-02-06 19:37:58 dovecot_plain authenticator failed for ([183.220.65.21]) [183.220.65.21]:49210: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.237.178.130
country_id: 3996063
description:
Feb  6 19:38:05 ait sshd[1371762]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.237.178.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
country_id: 1269750
description:
2025-02-06 19:38:04 dovecot_login authenticator failed for ([115.247.159.106]) [115.247.159.106]:37346: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.59.236.77
country_id: 3017382
description:
Feb  6 19:38:25 ait sshd[1371934]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.59.236.77 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.59.236.77
country_id: 3017382
description:
Feb  6 19:38:25 ait sshd[1371934]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.236.77


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
country_id: 6252001
description:
Feb  6 19:37:52 ait sshd[1371723]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.65.21
country_id: 1814991
description:
Feb  6 19:37:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.65.21 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.237.178.130
country_id: 3996063
description:
Feb  6 19:38:05 ait sshd[1371762]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.237.178.130


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 19:38:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.69.163.102
country_id: 2413451
description:
2025-02-06 19:38:47 dovecot_plain authenticator failed for ([102.69.163.102]) [102.69.163.102]:40421: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
country_id: 3017382
description:
Feb  6 19:39:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 19:39:44 ait sshd[1372329]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.2.234.106
country_id: 2921044
description:
Feb  6 19:38:59 ait sshd[1372026]: pam_imunify(sshd:auth): [IM360_RBL] The IP 212.2.234.106 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 212.2.234.106
country_id: 2921044
description:
Feb  6 19:38:59 ait sshd[1372026]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.2.234.106  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.97.132.7
country_id: 1562822
description:
Feb  6 19:39:21 ait sshd[1372142]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.97.132.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 19:39:44 ait sshd[1372329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 19:38:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.126.34.84
country_id: 2017370
description:
Feb  6 19:38:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.126.34.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
country_id: 3017382
description:
2025-02-06 19:39:05 dovecot_plain authenticator failed for (whearyterd) [185.113.51.55]:33505: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.126.34.84
country_id: 2017370
description:
2025-02-06 19:38:56 dovecot_plain authenticator failed for (109-126-34-84.pptp.vladlink.net) [109.126.34.84]:58842: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.97.132.7
country_id: 1562822
description:
Feb  6 19:39:21 ait sshd[1372142]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.97.132.7


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
country_id: 1835841
description:
Feb  6 19:40:31 ait sshd[1372934]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
country_id: 1835841
description:
Feb  6 19:40:31 ait sshd[1372934]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.199.209.60
country_id: 1269750
description:
Feb  6 19:40:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.199.209.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.199.209.60
country_id: 1269750
description:
2025-02-06 19:40:34 dovecot_plain authenticator failed for (ws60-209.199.103.rcil.gov.in) [103.199.209.60]:58414: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.175.122
country_id: 1814991
description:
Feb  6 19:40:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.175.122 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.123
country_id: 6252001
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:bitha8128@gmail.com||WPU:bitha8128@gmail.com||RSV:6.65||T:APACHE||MV:19-40.170.205.31.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.135
country_id: 2017370
description:
Feb  6 19:41:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.135 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.59.236.77
country_id: 3017382
description:
Feb  6 19:41:15 ait sshd[1373061]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.236.77


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.35.63.27
country_id: 1835841
description:
Feb  6 19:41:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.35.63.27 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-41.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.175.122
country_id: 1814991
description:
2025-02-06 19:40:51 dovecot_plain authenticator failed for ([120.236.175.122]) [120.236.175.122]:53060: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.59.236.77
country_id: 3017382
description:
Feb  6 19:41:15 ait sshd[1373061]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.59.236.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
country_id: 2017370
description:
Feb  6 19:41:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-41.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.35.63.27
country_id: 1835841
description:
2025-02-06 19:41:27 dovecot_plain authenticator failed for ([110.35.63.27]) [110.35.63.27]:58898: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.135
country_id: 2017370
description:
2025-02-06 19:41:08 dovecot_login authenticator failed for ([178.178.194.135]) [178.178.194.135]:42794: 535 Incorrect authentication data (set_id=webmaster@aitonline.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  6 19:41:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-06 19:41:10 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-173.static.tpgi.com.au) [110.175.220.250]:52002: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
country_id: 2017370
description:
2025-02-06 19:41:19 dovecot_login authenticator failed for (13-78-123-185.host.cirex.ru) [185.123.78.13]:64898: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.166.214
country_id: 1814991
description:
Feb  6 19:42:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.166.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.82.93.192
country_id: 1643084
description:
Feb  6 19:41:57 ait sshd[1373338]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.82.93.192


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.82.93.192
country_id: 1643084
description:
Feb  6 19:41:57 ait sshd[1373338]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.82.93.192 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.188.177.46
country_id: 1643084
description:
Feb  6 19:42:10 ait sshd[1373359]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.188.177.46


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.82
country_id: 1880251
description:
47.128.122.82 - - [06/Feb/2025:19:42:18 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077777 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/7/?duration=short%2Cmedium&filter_course-category=61&filtering=1&instructor=2&level=intermediate%2Call_levels" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.82


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.59.236.77
country_id: 3017382
description:
Feb  6 19:42:27 ait sshd[1373424]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.236.77


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.53
country_id: 99237
description:
Feb  6 19:41:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.53 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.236.77
country_id: 3017382
description:
Feb  6 19:42:29 ait sshd[1373424]: Failed password for invalid user ubuntu from 146.59.236.77 port 33934 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.230.33
country_id: 2562770
description:
2025-02-06 19:42:07 dovecot_login authenticator failed for (ADMIN) [176.125.230.33]:11057: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.166.214
country_id: 1814991
description:
2025-02-06 19:42:09 dovecot_plain authenticator failed for ([220.180.166.214]) [220.180.166.214]:52476: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.188.177.46
country_id: 1643084
description:
Feb  6 19:42:10 ait sshd[1373359]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.188.177.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.59.236.77
country_id: 3017382
description:
Feb  6 19:42:27 ait sshd[1373424]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.59.236.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.53
country_id: 99237
description:
2025-02-06 19:41:56 dovecot_plain authenticator failed for ([65.20.251.53]) [65.20.251.53]:51524: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.10.127.167
country_id: 1814991
description:
2025-02-06 19:43:18 dovecot_plain authenticator failed for ([116.10.127.167]) [116.10.127.167]:33433: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
country_id: 6252001
description:
Feb  6 19:43:10 ait sshd[1373707]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
country_id: 6252001
description:
Feb  6 19:43:10 ait sshd[1373707]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.45.114.161
country_id: 2077456
description:
2025-02-06 19:43:12 dovecot_plain authenticator failed for 121-45-114-161.tpgi.com.au [121.45.114.161]:38115: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.10.127.167
country_id: 1814991
description:
Feb  6 19:43:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.10.127.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
country_id: 1269750
description:
Feb  6 19:43:37 ait sshd[1373935]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
country_id: 1269750
description:
Feb  6 19:43:37 ait sshd[1373935]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.188.177.46
country_id: 1643084
description:
Feb  6 19:43:38 ait sshd[1373933]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.188.177.46


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
country_id: 1814991
description:
Feb  6 19:43:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
country_id: 1814991
description:
2025-02-06 19:43:42 dovecot_plain authenticator failed for ([112.111.61.232]) [112.111.61.229]:59498: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.85.164
country_id: 6252001
description:
2025-02-06 19:43:28 dovecot_plain authenticator failed for (23-94-85-164-host.colocrossing.com) [23.94.85.164]:36750: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.183.225.156
country_id: 3658394
description:
Feb  6 19:43:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.183.225.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.35.63.27
country_id: 1835841
description:
Feb  6 19:43:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.35.63.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.35.63.27
country_id: 1835841
description:
2025-02-06 19:43:34 dovecot_plain authenticator failed for ([110.35.63.27]) [110.35.63.27]:42394: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.45.15
country_id: 1880251
description:
47.128.45.15 - - [06/Feb/2025:19:43:45 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23781656 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C30%2C205&filter_course-language=79%2C183%2C121&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.45.15


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-02-06 19:43:08 dovecot_plain authenticator failed for ([201.183.225.156]) [201.183.225.156]:34585: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.45.114.161
country_id: 2077456
description:
Feb  6 19:43:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.45.114.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.188.177.46
country_id: 1643084
description:
Feb  6 19:43:38 ait sshd[1373933]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.188.177.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.82.93.192
country_id: 1643084
description:
Feb  6 19:43:49 ait sshd[1374036]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.82.93.192 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.82.93.192
country_id: 1643084
description:
Feb  6 19:43:49 ait sshd[1374036]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.82.93.192


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.110.58
country_id: 1880251
description:
47.128.110.58 - - [06/Feb/2025:19:42:58 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17864571 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/main/index.php?Itemid=62&id=71&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.110.58


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.85.164
country_id: 6252001
description:
Feb  6 19:43:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.85.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.222.171.6
country_id: 3017382
description:
Feb  6 19:44:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.222.171.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.222.171.6
country_id: 3017382
description:
2025-02-06 19:44:07 dovecot_plain authenticator failed for 6.ip-92-222-171.eu [92.222.171.6]:55272: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.125.14.122
country_id: 3439705
description:
Feb  6 19:44:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.125.14.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.124.119.7
country_id: 1814991
description:
2025-02-06 19:44:31 dovecot_plain authenticator failed for ([118.122.255.5]) [118.124.119.7]:64780: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
country_id: 3895114
description:
2025-02-06 19:44:12 dovecot_login authenticator failed for ([190.211.250.118]) [190.211.250.122]:36166: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.215.133.102
country_id: 6252001
description:
Feb  6 19:44:18 ait sshd[1374150]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.215.133.102  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
country_id: 3895114
description:
Feb  6 19:44:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.212.32.5
country_id: 3996063
description:
Feb  6 19:44:29 ait sshd[1374238]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.212.32.5


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.124.119.7
country_id: 1814991
description:
Feb  6 19:44:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.124.119.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.212.32.5
country_id: 3996063
description:
Feb  6 19:44:29 ait sshd[1374238]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.212.32.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.125.14.122
country_id: 3439705
description:
2025-02-06 19:44:34 dovecot_login authenticator failed for (r200-125-14-122.ae-static.anteldata.net.uy) [200.125.14.122]:57728: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.93.192
country_id: 1643084
description:
Feb  6 19:43:50 ait sshd[1374036]: Failed password for invalid user debian from 103.82.93.192 port 50930 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.133.102
country_id: 6252001
description:
Feb  6 19:44:18 ait sshd[1374150]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.215.133.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.157.107.67
country_id: 2921044
description:
Feb  6 19:45:26 ait sshd[1374824]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.157.107.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.174.229.206
country_id: 2017370
description:
Feb  6 19:45:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.174.229.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.106.187
country_id: 6252001
description:
Feb  6 19:45:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.106.187 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.157.107.67
country_id: 2921044
description:
Feb  6 19:45:26 ait sshd[1374824]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.157.107.67


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.188.207.151
country_id: 6252001
description:
Feb  6 19:45:37 ait sshd[1375122]: pam_imunify(sshd:auth): [IM360_RBL] The IP 199.188.207.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
country_id: 1835841
description:
Feb  6 19:45:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2025-02-06 19:45:44 dovecot_plain authenticator failed for ([203.252.10.3]) [203.252.10.3]:48742: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.63
country_id: 1880251
description:
47.128.121.63 - - [06/Feb/2025:19:45:21 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=24558883 HTTP/2.0" 302 0 mail.ait-edu.us "https://mail.ait-edu.us/quickLink.php?career_id=4&menu=career&sub_career_id=61&sub_name=Teaching%20Licensure" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.63


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.174.229.206
country_id: 2017370
description:
2025-02-06 19:45:50 dovecot_plain authenticator failed for ([93.174.229.206]) [93.174.229.206]:52742: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.66
country_id: 1036973
description:
Feb  6 19:44:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.66 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.82.93.192
country_id: 1643084
description:
Feb  6 19:45:33 ait sshd[1374991]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.82.93.192


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.34.73.139
country_id: 1814991
description:
Feb  6 19:45:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.34.73.139 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 199.188.207.151
country_id: 6252001
description:
Feb  6 19:45:37 ait sshd[1375122]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=199.188.207.151  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.106.187
country_id: 6252001
description:
2025-02-06 19:45:10 dovecot_plain authenticator failed for ([65.76.106.187]) [65.76.106.187]:45398: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.225.215.173
country_id: 1562822
description:
Feb  6 19:45:26 ait sshd[1374819]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.225.215.173 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.225.215.173
country_id: 1562822
description:
Feb  6 19:45:26 ait sshd[1374819]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.225.215.173  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.34.73.139
country_id: 1814991
description:
2025-02-06 19:45:38 dovecot_plain authenticator failed for (139.73.34.171.adsl-pool.jx.chinaunicom.com) [171.34.73.139]:1133: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2025-02-06 19:45:00 dovecot_plain authenticator failed for ([196.28.226.66]) [196.28.226.66]:56364: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.82.93.192
country_id: 1643084
description:
Feb  6 19:45:33 ait sshd[1374991]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.82.93.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.242.170.10
country_id: 1036973
description:
Feb  6 19:46:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.242.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.129.157.189
country_id: 1814991
description:
2025-02-06 19:46:04 dovecot_plain authenticator failed for ([124.129.157.189]) [124.129.157.189]:56429: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.210.107.22
country_id: 3017382
description:
Feb  6 19:46:15 ait sshd[1375328]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.210.107.22


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.19.149
country_id: 1668284
description:
Feb  6 19:46:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.19.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.129.157.189
country_id: 1814991
description:
Feb  6 19:46:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.129.157.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.210.107.22
country_id: 3017382
description:
Feb  6 19:46:15 ait sshd[1375328]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.210.107.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2025-02-06 19:46:43 dovecot_plain authenticator failed for ([197.242.170.10]) [197.242.170.10]:65177: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.194.71.195
country_id: 1269750
description:
Feb  6 19:47:18 ait sshd[1375670]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.194.71.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.41
country_id: 1269750
description:
Feb  6 19:47:04 ait sshd[1375634]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.41


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.110.77
country_id: 6252001
description:
Feb  6 19:47:09 ait sshd[1375654]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.110.77 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.194.71.195
country_id: 1269750
description:
Feb  6 19:47:18 ait sshd[1375670]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.194.71.195


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.212.32.5
country_id: 3996063
description:
Feb  6 19:47:33 ait sshd[1375755]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.212.32.5 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.212.32.5
country_id: 3996063
description:
Feb  6 19:47:33 ait sshd[1375755]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.212.32.5


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.47
country_id: 1819730
description:
2025-02-06 19:46:54 dovecot_plain authenticator failed for (m121-202-155-47.smartone.com) [121.202.155.47]:12765: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.41
country_id: 1269750
description:
Feb  6 19:47:04 ait sshd[1375634]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.41 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.110.77
country_id: 6252001
description:
Feb  6 19:47:09 ait sshd[1375654]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.110.77  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.47
country_id: 1819730
description:
Feb  6 19:46:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.47 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.184.162.237
country_id: 1814991
description:
Feb  6 19:47:00 ait sshd[1375617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.184.162.237


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.251.95
country_id: 3469034
description:
2025-02-06 19:47:57 dovecot_plain authenticator failed for ([191.59.251.95]) [191.59.251.95]:34126: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.248.31.142
country_id: 1835841
description:
2025-02-06 19:47:58 dovecot_plain authenticator failed for ([211.248.31.142]) [211.248.31.142]:59626: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.193.92
country_id: 3017382
description:
2025-02-06 19:48:15 dovecot_plain authenticator failed for vps-de4e2f27.vps.ovh.net [51.77.193.92]:37540: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.3
country_id: 99237
description:
2025-02-06 19:47:54 dovecot_plain authenticator failed for ([65.20.233.3]) [65.20.233.3]:40506: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 19:47:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
country_id: 6252001
description:
Feb  6 19:48:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2025-02-06 19:48:20 dovecot_plain authenticator failed for ([183.99.89.74]) [183.99.89.74]:51152: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.193.92
country_id: 3017382
description:
Feb  6 19:48:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.77.193.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.99.89.74
country_id: 1835841
description:
Feb  6 19:48:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.99.89.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-02-06 19:48:20 dovecot_plain authenticator failed for ([216.194.174.103]) [216.194.174.27]:62613: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.199.172.66
country_id: 1814991
description:
Feb  6 19:48:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.199.172.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.33.207.58
country_id: 1814991
description:
Feb  6 19:48:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.33.207.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.63
country_id: 1819730
description:
Feb  6 19:47:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.92.193
country_id: 2017370
description:
2025-02-06 19:48:05 dovecot_plain authenticator failed for broadband-5-228-92-193.ip.moscow.rt.ru [5.228.92.193]:56904: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.33.207.58
country_id: 1814991
description:
2025-02-06 19:48:47 dovecot_login authenticator failed for ([121.33.207.58]) [121.33.207.58]:56679: 535 Incorrect authentication data (set_id=ixlqnabzu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-02-06 19:48:11 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:42365: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.41.137
country_id: 337996
description:
Feb  6 19:48:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.41.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.233.3
country_id: 99237
description:
Feb  6 19:47:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.233.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
country_id: 6252001
description:
Feb  6 19:48:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.63
country_id: 1819730
description:
2025-02-06 19:47:54 dovecot_plain authenticator failed for (m121-202-154-63.smartone.com) [121.202.154.63]:25486: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.111.59.146
country_id: 6252001
description:
2025-02-06 19:48:33 dovecot_plain authenticator failed for ([75.111.59.146]) [75.111.59.146]:44458: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2025-02-06 19:48:36 dovecot_login authenticator failed for ([221.199.172.66]) [221.199.172.66]:55800: 535 Incorrect authentication data (set_id=ixlqnabzu@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.227.200.201
country_id: 1562822
description:
2025-02-06 19:48:00 dovecot_plain authenticator failed for ([171.227.200.201]) [171.227.200.201]:58186: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.92.193
country_id: 2017370
description:
Feb  6 19:48:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.92.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.227.200.201
country_id: 1562822
description:
Feb  6 19:47:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.227.200.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2025-02-06 19:48:15 dovecot_plain authenticator failed for ([196.190.43.138]) [196.190.41.137]:20455: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.111.59.146
country_id: 6252001
description:
Feb  6 19:48:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.111.59.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.251.95
country_id: 3469034
description:
Feb  6 19:47:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.251.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.248.31.142
country_id: 1835841
description:
Feb  6 19:47:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.248.31.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-02-06 19:49:23 dovecot_plain authenticator failed for ([65.20.205.197]) [65.20.205.197]:42095: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2025-02-06 19:49:24 dovecot_plain authenticator failed for (www.nettlinx.com) [202.53.94.242]:37678: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.152.108.61
country_id: 6252001
description:
Feb  6 19:49:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.152.108.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.66.228.194
country_id: 1880251
description:
Feb  6 19:49:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.66.228.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.31.93.182
country_id: 1814991
description:
Feb  6 19:49:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.31.93.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.189.234.28
country_id: 6252001
description:
Feb  6 19:49:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.189.234.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.255.34.171
country_id: 2017370
description:
2025-02-06 19:49:11 dovecot_plain authenticator failed for broadband-188-255-34-171.ip.moscow.rt.ru [188.255.34.171]:50252: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.66.228.194
country_id: 1880251
description:
2025-02-06 19:49:30 dovecot_plain authenticator failed for bb115-66-228-194.singnet.com.sg [115.66.228.194]:44569: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.39.187.16
country_id: 3469034
description:
Feb  6 19:49:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.39.187.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
country_id: 3017382
description:
2025-02-06 19:49:30 dovecot_plain authenticator failed for 51.174.157.77.rev.sfr.net [77.157.174.51]:54418: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.20.166
country_id: 3175395
description:
2025-02-06 19:49:37 dovecot_plain authenticator failed for ([2.192.20.166]) [2.192.20.166]:47458: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.144.82.250
country_id: 6252001
description:
2025-02-06 19:49:42 dovecot_plain authenticator failed for syn-098-144-082-250.res.spectrum.com [98.144.82.250]:44604: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.206
country_id: 1835841
description:
Feb  6 19:49:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.62.233.146
country_id: 1168579
description:
2025-02-06 19:49:26 dovecot_plain authenticator failed for ([103.62.233.146]) [103.62.233.146]:33010: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.126.114.239
country_id: 1880251
description:
2025-02-06 19:49:30 dovecot_plain authenticator failed for 239.114.126.34.bc.googleusercontent.com [34.126.114.239]:49998: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.120.208.148
country_id: 2017370
description:
2025-02-06 19:49:32 dovecot_plain authenticator failed for ([146.120.208.148]) [146.120.208.148]:57885: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.35.237.38
country_id: 1835841
description:
2025-02-06 19:49:33 dovecot_plain authenticator failed for ([183.105.138.168]) [211.35.237.38]:38980: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
country_id: 1269750
description:
Feb  6 19:49:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.49.179.157
country_id: 6252001
description:
Feb  6 19:49:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.49.179.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.189.234.28
country_id: 6252001
description:
2025-02-06 19:49:14 dovecot_plain authenticator failed for ([12.189.234.28]) [12.189.234.28]:34696: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.227.87.29
country_id: 1814991
description:
Feb  6 19:49:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.227.87.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.83.71.207
country_id: 3175395
description:
Feb  6 19:49:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.83.71.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.119.61
country_id: 1814991
description:
2025-02-06 19:49:32 dovecot_plain authenticator failed for ([61.184.119.61]) [61.184.119.61]:38734: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.14.135
country_id: 1668284
description:
Feb  6 19:49:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.14.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.194.128.158
country_id: 1269750
description:
Feb  6 19:49:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.194.128.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.107.189
country_id: 3469034
description:
2025-02-06 19:49:14 dovecot_plain authenticator failed for (biophormula.static.gvt.net.br) [186.215.107.189]:39014: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.177.96.5
country_id: 1814991
description:
2025-02-06 19:49:41 dovecot_plain authenticator failed for ([117.177.96.5]) [117.177.96.5]:37359: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2025-02-06 19:49:11 dovecot_plain authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:47829: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.38.136.162
country_id: 6252001
description:
2025-02-06 19:49:13 dovecot_plain authenticator failed for syn-047-038-136-162.res.spectrum.com [47.38.136.162]:58378: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.115.19.225
country_id: 6252001
description:
Feb  6 19:49:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.115.19.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.11.119
country_id: 1269750
description:
2025-02-06 19:49:25 dovecot_plain authenticator failed for ([122.175.11.119]) [122.175.11.119]:45260: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.20.111.164
country_id: 6251999
description:
Feb  6 19:49:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.20.111.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.136.172.98
country_id: 192950
description:
2025-02-06 19:49:39 dovecot_plain authenticator failed for ([197.136.236.1]) [197.136.172.98]:44178: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.242.71.107
country_id: 1814991
description:
2025-02-06 19:49:35 dovecot_plain authenticator failed for ([36.32.223.199]) [58.242.71.107]:47130: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2025-02-06 19:49:14 dovecot_plain authenticator failed for ([221.209.48.203]) [221.209.48.203]:45046: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.200.14.2
country_id: 1814991
description:
Feb  6 19:49:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.200.14.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.111.99
country_id: 1835841
description:
Feb  6 19:49:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.111.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.35.237.38
country_id: 1835841
description:
Feb  6 19:49:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.35.237.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.40.85
country_id: 1269750
description:
2025-02-06 19:49:32 dovecot_plain authenticator failed for ([103.177.40.85]) [103.177.40.85]:60713: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.57.111.99
country_id: 1835841
description:
2025-02-06 19:49:33 dovecot_plain authenticator failed for ([211.57.111.99]) [211.57.111.99]:57916: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.179.85.98
country_id: 1269750
description:
2025-02-06 19:49:38 dovecot_plain authenticator failed for ([202.179.85.98]) [202.179.85.98]:21582: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.229.51.206
country_id: 1835841
description:
2025-02-06 19:49:16 dovecot_plain authenticator failed for ([58.229.51.206]) [58.229.51.206]:60342: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
country_id: 1835841
description:
Feb  6 19:49:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.134.126.162
country_id: 6252001
description:
Feb  6 19:49:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.134.126.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.241.150
country_id: 1814991
description:
2025-02-06 19:49:36 dovecot_plain authenticator failed for ([61.143.241.150]) [61.143.241.150]:42748: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.239.23.149
country_id: 458258
description:
2025-02-06 19:49:13 dovecot_plain authenticator failed for ([91.239.23.149]) [91.239.23.149]:58342: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.49.179.157
country_id: 6252001
description:
2025-02-06 19:49:13 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:49317: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.220.168.116
country_id: 2017370
description:
2025-02-06 19:49:17 dovecot_plain authenticator failed for ([31.220.168.116]) [31.220.168.116]:58568: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.20.159.141
country_id: 1835841
description:
Feb  6 19:49:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.20.159.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.173.2.140
country_id: 298795
description:
2025-02-06 19:49:34 dovecot_plain authenticator failed for ([95.173.2.140]) [95.173.2.140]:39773: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.216.85.119
country_id: 1835841
description:
2025-02-06 19:49:37 dovecot_plain authenticator failed for ([211.216.85.119]) [211.216.85.119]:47532: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.188.103.179
country_id: 6252001
description:
2025-02-06 19:49:14 dovecot_plain authenticator failed for (tagsdev.click) [199.188.103.179]:59340: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
country_id: 99237
description:
Feb  6 19:49:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.120.208.148
country_id: 2017370
description:
Feb  6 19:49:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.120.208.148 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-48.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.124.225.252
country_id: 1835841
description:
2025-02-06 19:49:16 dovecot_plain authenticator failed for ([220.124.225.252]) [220.124.225.252]:50616: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.174.229.206
country_id: 2017370
description:
2025-02-06 19:49:26 dovecot_plain authenticator failed for ([93.174.229.206]) [93.174.229.206]:59772: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.71.8
country_id: 1522867
description:
2025-02-06 19:49:23 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:36415: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.54.115.46
country_id: 1512440
description:
Feb  6 19:49:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.54.115.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.34.17.130
country_id: 1814991
description:
Feb  6 19:49:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.34.17.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.31.47.232
country_id: 6252001
description:
2025-02-06 19:49:15 dovecot_plain authenticator failed for syn-065-031-047-232.res.spectrum.com [65.31.47.232]:37681: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2025-02-06 19:49:22 dovecot_plain authenticator failed for ([182.42.113.10]) [182.42.113.10]:51768: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.111.164
country_id: 6251999
description:
2025-02-06 19:49:29 dovecot_plain authenticator failed for ([38.20.111.164]) [38.20.111.164]:50152: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.14.135
country_id: 1668284
description:
2025-02-06 19:49:50 dovecot_plain authenticator failed for 111-70-14-135.emome-ip.hinet.net [111.70.14.135]:43972: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.255.34.171
country_id: 2017370
description:
Feb  6 19:49:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.255.34.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.239.23.149
country_id: 458258
description:
Feb  6 19:49:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.239.23.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.188.103.179
country_id: 6252001
description:
Feb  6 19:49:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.188.103.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
country_id: 1269750
description:
2025-02-06 19:49:16 dovecot_plain authenticator failed for ([14.194.128.158]) [14.194.128.158]:48574: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
country_id: 1835841
description:
Feb  6 19:49:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.91.178.253
country_id: 1835841
description:
Feb  6 19:49:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.91.178.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.163.154
country_id: 1210997
description:
2025-02-06 19:49:44 dovecot_plain authenticator failed for ([103.231.163.154]) [103.231.163.154]:45156: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.215.211.223
country_id: 1814991
description:
Feb  6 19:49:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.215.211.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.230.100.252
country_id: 2287781
description:
2025-02-06 19:49:23 dovecot_plain authenticator failed for ([38.230.100.252]) [38.230.100.252]:57551: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.190.110.210
country_id: 1814991
description:
2025-02-06 19:49:30 dovecot_plain authenticator failed for ([222.190.110.210]) [222.190.110.210]:50699: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.227.87.29
country_id: 1814991
description:
2025-02-06 19:49:17 dovecot_plain authenticator failed for ([106.227.87.29]) [106.227.87.29]:41466: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
country_id: 3017382
description:
Feb  6 19:49:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.177.96.5
country_id: 1814991
description:
Feb  6 19:49:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.177.96.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.180.129.87
country_id: 1668284
description:
Feb  6 19:49:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.180.129.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.176.41.40
country_id: 2017370
description:
2025-02-06 19:49:21 dovecot_plain authenticator failed for ([178.176.41.40]) [178.176.41.40]:37775: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.44.241.183
country_id: 6252001
description:
2025-02-06 19:49:45 dovecot_plain authenticator failed for ([130.44.241.183]) [130.44.241.183]:53029: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.54.150
country_id: 1814991
description:
2025-02-06 19:49:39 dovecot_plain authenticator failed for (150.54.169.61.dial.xw.sh.dynamic.163data.com.cn) [61.169.54.150]:42505: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.241.232.14
country_id: 2921044
description:
Feb  6 19:49:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.241.232.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.156.2.212
country_id: 1861060
description:
2025-02-06 19:49:16 dovecot_plain authenticator failed for 212.2.156.220.rev.iijmobile.jp [220.156.2.212]:39184: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.62
country_id: 1819730
description:
2025-02-06 19:49:19 dovecot_plain authenticator failed for (m121-202-153-62.smartone.com) [121.202.153.62]:12113: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.20.159.141
country_id: 1835841
description:
2025-02-06 19:49:27 dovecot_plain authenticator failed for ([115.20.159.141]) [115.20.159.141]:47033: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.177.40.85
country_id: 1269750
description:
Feb  6 19:49:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.177.40.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.119.61
country_id: 1814991
description:
Feb  6 19:49:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.119.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2025-02-06 19:49:31 dovecot_plain authenticator failed for ([190.223.36.108]) [190.223.36.108]:33294: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.94.0.159
country_id: 1861060
description:
Feb  6 19:49:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.94.0.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-02-06 19:49:14 dovecot_plain authenticator failed for ([216.194.174.27]) [216.194.174.27]:42189: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.132.42.170
country_id: 1814991
description:
2025-02-06 19:49:17 dovecot_plain authenticator failed for ([116.132.42.170]) [116.132.42.170]:47259: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.71.109
country_id: 1835841
description:
2025-02-06 19:49:17 dovecot_plain authenticator failed for ([112.168.71.109]) [112.168.71.109]:46864: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.206.95.195
country_id: 6252001
description:
Feb  6 19:49:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.206.95.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.91.178.253
country_id: 1835841
description:
2025-02-06 19:49:33 dovecot_plain authenticator failed for ([111.91.178.253]) [111.91.178.253]:34282: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.216.85.119
country_id: 1835841
description:
Feb  6 19:49:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.216.85.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.38.136.162
country_id: 6252001
description:
Feb  6 19:49:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.38.136.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.160.128.46
country_id: 3144096
description:
Feb  6 19:49:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.160.128.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.173.2.140
country_id: 298795
description:
Feb  6 19:49:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.173.2.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.136.172.98
country_id: 192950
description:
Feb  6 19:49:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.136.172.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.231.163.154
country_id: 1210997
description:
Feb  6 19:49:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.231.163.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.199.172.66
country_id: 1814991
description:
Feb  6 19:49:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.199.172.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.200.14.2
country_id: 1814991
description:
2025-02-06 19:49:17 dovecot_plain authenticator failed for ([202.200.14.2]) [202.200.14.2]:52699: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.230.100.252
country_id: 2287781
description:
Feb  6 19:49:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.230.100.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.175.11.119
country_id: 1269750
description:
Feb  6 19:49:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.175.11.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.215.211.223
country_id: 1814991
description:
2025-02-06 19:49:23 dovecot_plain authenticator failed for ([114.215.211.223]) [114.215.211.223]:57616: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.192.20.166
country_id: 3175395
description:
Feb  6 19:49:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.192.20.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.93.182
country_id: 1814991
description:
2025-02-06 19:49:38 dovecot_plain authenticator failed for ([112.31.93.182]) [112.31.93.182]:46578: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.44.241.183
country_id: 6252001
description:
Feb  6 19:49:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.44.241.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-02-06 19:49:13 dovecot_plain authenticator failed for ([84.54.115.46]) [84.54.115.46]:34574: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.115.19.225
country_id: 6252001
description:
2025-02-06 19:49:26 dovecot_plain authenticator failed for 24.115.19.225.res-cmts.sm3.ptd.net [24.115.19.225]:55456: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.0.180
country_id: 1819730
description:
Feb  6 19:49:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.0.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.39.187.16
country_id: 3469034
description:
2025-02-06 19:49:40 dovecot_plain authenticator failed for ([189.39.187.16]) [189.39.187.16]:56397: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.103.248.120
country_id: 174982
description:
Feb  6 19:49:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.103.248.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.156.2.212
country_id: 1861060
description:
Feb  6 19:49:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.156.2.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.192.20.137
country_id: 3175395
description:
Feb  6 19:49:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.192.20.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.160.128.46
country_id: 3144096
description:
2025-02-06 19:49:23 dovecot_plain authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:52307: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
country_id: 2464461
description:
Feb  6 19:49:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.179.85.98
country_id: 1269750
description:
Feb  6 19:49:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.179.85.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.243.62
country_id: 1814991
description:
Feb  6 19:49:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.243.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.62.233.146
country_id: 1168579
description:
Feb  6 19:49:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.62.233.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
country_id: 1835841
description:
Feb  6 19:49:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.83.71.207
country_id: 3175395
description:
2025-02-06 19:49:26 dovecot_plain authenticator failed for ([151.83.71.207]) [151.83.71.207]:52248: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.134.126.162
country_id: 6252001
description:
2025-02-06 19:49:28 dovecot_plain authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:1557: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.152.108.61
country_id: 6252001
description:
2025-02-06 19:49:29 dovecot_plain authenticator failed for syn-098-152-108-061.biz.spectrum.com [98.152.108.61]:34207: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.0.180
country_id: 1819730
description:
2025-02-06 19:49:38 dovecot_plain authenticator failed for 110-4-0-180.static.pccw-hkt.com [110.4.0.180]:14809: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.151.71.8
country_id: 1522867
description:
Feb  6 19:49:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.151.71.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
country_id: 6252001
description:
Feb  6 19:49:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.51.222.234
country_id: 2264397
description:
2025-02-06 19:49:12 dovecot_plain authenticator failed for a109-51-222-234.cpe.netcabo.pt [109.51.222.234]:36664: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.31.47.232
country_id: 6252001
description:
Feb  6 19:49:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.31.47.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.168.71.109
country_id: 1835841
description:
Feb  6 19:49:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.168.71.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.34.17.130
country_id: 1814991
description:
2025-02-06 19:49:16 dovecot_plain authenticator failed for ([59.34.17.130]) [59.34.17.130]:57734: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.62
country_id: 1819730
description:
Feb  6 19:49:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.176.41.40
country_id: 2017370
description:
Feb  6 19:49:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.176.41.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.95.195
country_id: 6252001
description:
2025-02-06 19:49:26 dovecot_plain authenticator failed for ([47.206.95.195]) [47.206.95.195]:55270: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.144.82.250
country_id: 6252001
description:
Feb  6 19:49:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.144.82.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.113.10
country_id: 1814991
description:
Feb  6 19:49:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.42.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.243.62
country_id: 1814991
description:
2025-02-06 19:49:19 dovecot_plain authenticator failed for ([183.220.243.62]) [183.220.243.62]:53952: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2025-02-06 19:49:21 dovecot_plain authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:56526: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.174.229.206
country_id: 2017370
description:
Feb  6 19:49:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.174.229.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.126.114.239
country_id: 1880251
description:
Feb  6 19:49:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.126.114.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.242.71.107
country_id: 1814991
description:
Feb  6 19:49:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.242.71.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.54.150
country_id: 1814991
description:
Feb  6 19:49:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.54.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.124.225.252
country_id: 1835841
description:
Feb  6 19:49:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.124.225.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.236.156.129
country_id: 1835841
description:
2025-02-06 19:49:16 dovecot_plain authenticator failed for ([1.236.156.129]) [1.236.156.129]:39196: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.241.150
country_id: 1814991
description:
Feb  6 19:49:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.241.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.190.110.210
country_id: 1814991
description:
Feb  6 19:49:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.190.110.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.51.222.234
country_id: 2264397
description:
Feb  6 19:49:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.51.222.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.215.107.189
country_id: 3469034
description:
Feb  6 19:49:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.215.107.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
country_id: 1814991
description:
Feb  6 19:49:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.220.168.116
country_id: 2017370
description:
Feb  6 19:49:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.220.168.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.20.137
country_id: 3175395
description:
2025-02-06 19:49:20 dovecot_plain authenticator failed for ([2.192.20.137]) [2.192.20.137]:34918: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.53.94.242
country_id: 1269750
description:
Feb  6 19:49:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.53.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
country_id: 1835841
description:
2025-02-06 19:49:27 dovecot_plain authenticator failed for ([218.147.6.84]) [218.147.6.84]:45082: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-02-06 19:49:39 dovecot_plain authenticator failed for ([196.203.231.220]) [196.203.231.220]:49004: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.6.109
country_id: 2017370
description:
Feb  6 19:49:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.6.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.236.156.129
country_id: 1835841
description:
Feb  6 19:49:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.236.156.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.223.36.108
country_id: 3932488
description:
Feb  6 19:49:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.223.36.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.103.248.120
country_id: 174982
description:
2025-02-06 19:49:13 dovecot_plain authenticator failed for ([91.103.248.120]) [91.103.248.120]:51360: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.6.109
country_id: 2017370
description:
2025-02-06 19:49:13 dovecot_plain authenticator failed for 95-31-6-109.static.corbina.ru [95.31.6.109]:56038: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.132.42.170
country_id: 1814991
description:
Feb  6 19:49:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.132.42.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2025-02-06 19:49:17 dovecot_plain authenticator failed for ([221.199.172.66]) [221.199.172.66]:36032: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
country_id: 1835841
description:
2025-02-06 19:49:21 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:37248: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.179.129.110
country_id: 1269750
description:
Feb  6 19:49:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.179.129.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.212.32.5
country_id: 3996063
description:
Feb  6 19:50:03 ait sshd[1376855]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.212.32.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
country_id: 1269750
description:
2025-02-06 19:49:52 dovecot_plain authenticator failed for ([59.98.150.190]) [122.160.68.46]:50528: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
country_id: 1814991
description:
2025-02-06 19:49:54 dovecot_plain authenticator failed for ([27.223.100.90]) [27.223.100.90]:57578: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.212.32.5
country_id: 3996063
description:
Feb  6 19:50:03 ait sshd[1376855]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.212.32.5


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
country_id: 1814991
description:
Feb  6 19:49:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
country_id: 1861060
description:
2025-02-06 19:49:51 dovecot_plain authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:19249: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.129.110
country_id: 1269750
description:
2025-02-06 19:49:55 dovecot_plain authenticator failed for (abts-mum-static-110.129.179.122.airtelbroadband.in) [122.179.129.110]:51442: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.236.156.129
country_id: 1835841
description:
Feb  6 19:49:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.236.156.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.236.156.129
country_id: 1835841
description:
2025-02-06 19:50:01 dovecot_plain authenticator failed for ([1.236.156.129]) [1.236.156.129]:59768: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.114.61.50
country_id: 2750405
description:
Feb  6 19:50:20 ait sshd[1376978]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.114.61.50


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.212.32.5
country_id: 3996063
description:
Feb  6 19:50:05 ait sshd[1376855]: Failed password for invalid user debian from 187.212.32.5 port 56180 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.114.61.50
country_id: 2750405
description:
Feb  6 19:50:20 ait sshd[1376978]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.114.61.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.213.34.22
country_id: 298795
description:
Feb  6 19:51:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.213.34.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.22
country_id: 298795
description:
2025-02-06 19:51:02 dovecot_login authenticator failed for (ADMIN) [188.213.34.22]:40860: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.240.73.64
country_id: 1269750
description:
Feb  6 19:51:43 ait sshd[1377655]: pam_imunify(sshd:auth): [IM360_RBL] The IP 4.240.73.64 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 4.240.73.64
country_id: 1269750
description:
Feb  6 19:51:43 ait sshd[1377655]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=4.240.73.64  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
country_id: 1814991
description:
Feb  6 19:52:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.235.25.35
country_id: 1527747
description:
Feb  6 19:52:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.235.25.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.211.47.66
country_id: 2328926
description:
Feb  6 19:52:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.211.47.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.193.152.64
country_id: 1668284
description:
Feb  6 19:52:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.193.152.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.57.111.99
country_id: 1835841
description:
2025-02-06 19:52:23 dovecot_plain authenticator failed for ([211.57.111.99]) [211.57.111.99]:35264: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.192.254
country_id: 3469034
description:
2025-02-06 19:52:39 dovecot_plain authenticator failed for ([200.223.193.9]) [200.223.192.254]:51226: 535 Incorrect authentication data (set_id=adsby@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.175.201.58
country_id: 1814991
description:
Feb  6 19:52:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.175.201.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
country_id: 1814991
description:
2025-02-06 19:52:48 dovecot_plain authenticator failed for ([218.98.160.117]) [218.98.160.117]:22586: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.199.98.51
country_id: 690791
description:
2025-02-06 19:52:50 dovecot_plain authenticator failed for ([185.199.98.51]) [185.199.98.51]:43077: 535 Incorrect authentication data (set_id=adsby)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.52
country_id: 2017370
description:
Feb  6 19:52:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.191.27
country_id: 1835841
description:
Feb  6 19:52:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.191.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.175.201.58
country_id: 1814991
description:
2025-02-06 19:52:45 dovecot_plain authenticator failed for ([59.175.201.58]) [59.175.201.58]:32891: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.52
country_id: 2017370
description:
2025-02-06 19:52:27 dovecot_plain authenticator failed for ([178.178.222.52]) [178.178.222.52]:53700: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.111.99
country_id: 1835841
description:
Feb  6 19:52:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.111.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.223.192.254
country_id: 3469034
description:
Feb  6 19:52:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.223.192.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.82.33
country_id: 290557
description:
Feb  6 19:52:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.82.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.178.175
country_id: 2661886
description:
2025-02-06 19:52:48 dovecot_plain authenticator failed for 94-255-178-175.cust.bredband2.com [94.255.178.175]:57218: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-02-06 19:52:14 dovecot_plain authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:46754: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.123.220.10
country_id: 3996063
description:
Feb  6 19:52:34 ait sshd[1377939]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.123.220.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.193.152.64
country_id: 1668284
description:
2025-02-06 19:52:44 dovecot_plain authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:56120: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.199.98.51
country_id: 690791
description:
Feb  6 19:52:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.199.98.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.47.66
country_id: 2328926
description:
2025-02-06 19:52:37 dovecot_plain authenticator failed for ([197.211.47.66]) [197.211.47.66]:47626: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.82.33
country_id: 290557
description:
2025-02-06 19:52:39 dovecot_plain authenticator failed for ([94.205.82.33]) [94.205.82.33]:57105: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
country_id: 1831722
description:
Feb  6 19:52:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.53.168.198
country_id: 1605651
description:
2025-02-06 19:52:24 dovecot_plain authenticator failed for (localhost) [113.53.168.198]:47997: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.235.25.35
country_id: 1527747
description:
2025-02-06 19:52:24 dovecot_plain authenticator failed for ([77.235.25.35]) [77.235.25.35]:36537: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.123.220.10
country_id: 3996063
description:
Feb  6 19:52:34 ait sshd[1377939]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.123.220.10


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
country_id: 1835841
description:
2025-02-06 19:52:42 dovecot_plain authenticator failed for ([175.205.191.27]) [175.205.191.27]:54248: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.255.178.175
country_id: 2661886
description:
Feb  6 19:52:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.255.178.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
country_id: 1819730
description:
Feb  6 19:53:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.128.162.146
country_id: 1814991
description:
Feb  6 19:52:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.128.162.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
country_id: 1835841
description:
Feb  6 19:52:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2025-02-06 19:52:54 dovecot_plain authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:38644: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.135.188.125
country_id: 1835841
description:
Feb  6 19:53:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.135.188.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.135.188.125
country_id: 1835841
description:
2025-02-06 19:53:08 dovecot_plain authenticator failed for ([121.135.188.125]) [121.135.188.125]:56724: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.27.171.154
country_id: 1814991
description:
2025-02-06 19:53:16 dovecot_login authenticator failed for ([1.27.171.154]) [1.27.171.154]:50524: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
country_id: 1819730
description:
2025-02-06 19:53:38 dovecot_login authenticator failed for ([121.202.153.186]) [121.202.153.186]:50354: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.189
country_id: 1814991
description:
2025-02-06 19:53:47 dovecot_plain authenticator failed for ([60.167.19.189]) [60.167.19.189]:58397: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.124.221.2
country_id: 2750405
description:
Feb  6 19:52:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.124.221.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.165
country_id: 1819730
description:
Feb  6 19:53:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.165
country_id: 1819730
description:
2025-02-06 19:53:02 dovecot_plain authenticator failed for ([121.202.152.165]) [121.202.152.165]:26883: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
country_id: 1694008
description:
Feb  6 19:53:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
country_id: 1694008
description:
2025-02-06 19:53:30 dovecot_plain authenticator failed for ([58.69.17.18]) [58.69.17.18]:54766: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.117.144.194
country_id: 1835841
description:
2025-02-06 19:53:02 dovecot_plain authenticator failed for ([211.117.144.194]) [211.117.144.194]:41174: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.198.101.47
country_id: 2661886
description:
Feb  6 19:53:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.198.101.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.189
country_id: 1814991
description:
Feb  6 19:53:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.128.162.146
country_id: 1814991
description:
2025-02-06 19:52:54 dovecot_login authenticator failed for ([27.128.162.146]) [27.128.162.146]:34672: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2025-02-06 19:52:56 dovecot_plain authenticator failed for ([220.80.223.144]) [220.80.223.144]:54148: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.117.144.194
country_id: 1835841
description:
Feb  6 19:53:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.117.144.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.27.171.154
country_id: 1814991
description:
Feb  6 19:53:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.27.171.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.198.101.47
country_id: 2661886
description:
2025-02-06 19:53:45 dovecot_login authenticator failed for ([195.198.101.47]) [195.198.101.47]:42034: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.252.197.3
country_id: 732800
description:
Feb  6 19:54:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.252.197.3 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.22.214.214
country_id: 1269750
description:
Feb  6 19:53:51 ait sshd[1378429]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.214.214  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.52.89.218
country_id: 2017370
description:
Feb  6 19:54:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.52.89.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.52.89.218
country_id: 2017370
description:
2025-02-06 19:54:19 dovecot_plain authenticator failed for ([84.52.89.218]) [84.52.89.218]:46540: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.205.14.196
country_id: 226074
description:
Feb  6 19:54:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.205.14.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.252.197.3
country_id: 732800
description:
2025-02-06 19:54:28 dovecot_plain authenticator failed for ([151.252.197.3]) [151.252.197.3]:47549: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.22.214.214
country_id: 1269750
description:
Feb  6 19:53:51 ait sshd[1378429]: pam_imunify(sshd:auth): [IM360_RBL] The IP 165.22.214.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.205.14.196
country_id: 226074
description:
2025-02-06 19:54:29 dovecot_plain authenticator failed for ([129.205.14.196]) [129.205.14.196]:60476: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.147.25.111
country_id: 1835841
description:
2025-02-06 19:54:32 dovecot_plain authenticator failed for ([121.147.25.111]) [121.147.25.111]:37602: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.147.25.111
country_id: 1835841
description:
Feb  6 19:54:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.147.25.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.95.67.92
country_id: 6252001
description:
Feb  6 19:55:25 ait sshd[1379049]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.95.67.92


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.78
country_id: 298795
description:
Feb  6 19:54:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.220.168.116
country_id: 2017370
description:
2025-02-06 19:54:53 dovecot_plain authenticator failed for ([31.220.168.116]) [31.220.168.116]:43085: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.0.60.158
country_id: 1835841
description:
2025-02-06 19:54:55 dovecot_plain authenticator failed for ([59.0.60.158]) [59.0.60.158]:46440: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.208.79
country_id: 1819730
description:
2025-02-06 19:55:09 dovecot_plain authenticator failed for (223-197-208-79.static.imsbiz.com) [223.197.208.79]:59761: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.95.67.92
country_id: 6252001
description:
Feb  6 19:55:25 ait sshd[1379049]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.95.67.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.220.168.116
country_id: 2017370
description:
Feb  6 19:54:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.220.168.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.78
country_id: 298795
description:
2025-02-06 19:54:52 dovecot_plain authenticator failed for ([95.0.252.78]) [95.0.252.78]:35806: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.0.60.158
country_id: 1835841
description:
Feb  6 19:54:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.0.60.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.208.79
country_id: 1819730
description:
Feb  6 19:55:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.208.79 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.176.170.160
country_id: 2510769
description:
Feb  6 19:55:59 ait sshd[1379458]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.176.170.160


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.52.202.92
country_id: 1814991
description:
Feb  6 19:56:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.52.202.92 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.203.23.172
country_id: 6251999
description:
Feb  6 19:56:18 ait sshd[1379539]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.23.172  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.151.218.110
country_id: 6251999
description:
Feb  6 19:55:49 ait sshd[1379216]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.151.218.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.176.170.160
country_id: 2510769
description:
Feb  6 19:55:59 ait sshd[1379458]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.176.170.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.175.146.138
country_id: 1814991
description:
2025-02-06 19:56:14 dovecot_plain authenticator failed for ([60.175.146.138]) [60.175.146.138]:33040: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.23.172
country_id: 6251999
description:
Feb  6 19:56:18 ait sshd[1379539]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.203.23.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.175.146.138
country_id: 1814991
description:
Feb  6 19:56:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.175.146.138 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-56.194.163.182.227


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.151.218.110
country_id: 6251999
description:
Feb  6 19:55:49 ait sshd[1379216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.151.218.110


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.52.202.92
country_id: 1814991
description:
2025-02-06 19:56:04 dovecot_plain authenticator failed for ([123.52.202.92]) [123.52.202.92]:52758: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-56.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.184.194
country_id: 1814991
description:
2025-02-06 19:57:15 dovecot_plain authenticator failed for ([114.242.172.76]) [61.51.184.194]:44142: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.63.112
country_id: 1880251
description:
47.128.63.112 - - [06/Feb/2025:19:57:23 +0100] "GET /images/facebook.png HTTP/2.0" 415 176 mail.ait-edu.us "https://mail.ait-edu.us/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18641539" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.63.112


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2025-02-06 19:57:39 dovecot_plain authenticator failed for ([169.211.232.182]) [169.211.232.182]:55180: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.230.176.152
country_id: 1269750
description:
Feb  6 19:56:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.230.176.152 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.125
country_id: 6252001
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:UG24M1150078||WPU:UG24M1150078||RSV:6.65||T:APACHE||MV:19-57.170.205.31.125


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.184.194
country_id: 1814991
description:
Feb  6 19:57:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.184.194 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.127.68.180
country_id: 2077456
description:
Feb  6 19:57:19 ait sshd[1379891]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.68.180  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
country_id: 1835841
description:
Feb  6 19:57:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 47.254.198.202
country_id: 1733045
description:
Feb  6 19:57:18 ait sshd[1379889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.254.198.202


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.127.68.180
country_id: 2077456
description:
Feb  6 19:57:19 ait sshd[1379891]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.127.68.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.101.234.240
country_id: 1861060
description:
2025-02-06 19:58:48 dovecot_plain authenticator failed for p100240-obmd01.tokyo.ocn.ne.jp [124.101.234.240]:43019: 535 Incorrect authentication data (set_id=ads20b00288y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2025-02-06 19:57:54 dovecot_plain authenticator failed for ([213.230.127.217]) [213.230.127.217]:49168: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.70.166.51
country_id: 298795
description:
Feb  6 19:57:56 ait sshd[1380173]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.70.166.51


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 163.47.172.133
country_id: 1831722
description:
Feb  6 19:58:06 ait sshd[1380192]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.47.172.133  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 19:58:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.10.44.126
country_id: 1562822
description:
Feb  6 19:58:39 ait sshd[1380261]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.10.44.126


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.127.217
country_id: 1512440
description:
Feb  6 19:57:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.127.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.165
country_id: 1819730
description:
Feb  6 19:58:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.47.172.133
country_id: 1831722
description:
Feb  6 19:58:06 ait sshd[1380192]: pam_imunify(sshd:auth): [IM360_RBL] The IP 163.47.172.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.10.44.126
country_id: 1562822
description:
Feb  6 19:58:39 ait sshd[1380261]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.10.44.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.101.234.240
country_id: 1861060
description:
Feb  6 19:58:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.101.234.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.70.166.51
country_id: 298795
description:
Feb  6 19:57:56 ait sshd[1380173]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.70.166.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.165
country_id: 1819730
description:
2025-02-06 19:58:03 dovecot_plain authenticator failed for ([121.202.152.165]) [121.202.152.165]:62014: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.237.178.130
country_id: 3996063
description:
Feb  6 19:59:49 ait sshd[1380659]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.237.178.130


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.57.154.146
country_id: 1814991
description:
Feb  6 19:58:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.57.154.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.57.154.146
country_id: 1814991
description:
2025-02-06 19:58:55 dovecot_plain authenticator failed for ([58.57.154.146]) [58.57.154.146]:25732: 535 Incorrect authentication data (set_id=ads20b00288y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.50.39
country_id: 1814991
description:
Feb  6 19:59:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.50.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.50.39
country_id: 1814991
description:
2025-02-06 19:59:12 dovecot_plain authenticator failed for ([120.194.50.39]) [120.194.50.39]:11554: 535 Incorrect authentication data (set_id=ads20b00288y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.237.178.130
country_id: 3996063
description:
Feb  6 19:59:49 ait sshd[1380659]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.237.178.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.148.197.119
country_id: 2750405
description:
Feb  6 20:00:04 ait sshd[1380873]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.148.197.119  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.192.131
country_id: 1835841
description:
Feb  6 20:00:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.192.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.131
country_id: 1835841
description:
2025-02-06 20:00:14 dovecot_plain authenticator failed for ([1.235.192.131]) [1.235.192.131]:59156: 535 Incorrect authentication data (set_id=paakow2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
country_id: 1814991
description:
Feb  6 20:00:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.34.17.130
country_id: 1814991
description:
2025-02-06 20:00:41 dovecot_plain authenticator failed for ([59.34.17.130]) [59.34.17.130]:39470: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.237.178.130
country_id: 3996063
description:
Feb  6 19:59:50 ait sshd[1380659]: Failed password for invalid user goudirect from 187.237.178.130 port 32350 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.22.99.2
country_id: 1814991
description:
Feb  6 20:00:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.22.99.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.22.99.2
country_id: 1814991
description:
2025-02-06 20:00:02 dovecot_plain authenticator failed for ([121.22.99.2]) [121.22.99.2]:35632: 535 Incorrect authentication data (set_id=paakow2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.34.17.130
country_id: 1814991
description:
Feb  6 20:00:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.34.17.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
country_id: 1814991
description:
2025-02-06 20:00:30 dovecot_plain authenticator failed for ([112.111.61.231]) [112.111.61.229]:41088: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: modsec
rule: 77140165
name: IM360 WAF: Block .suspected files
abuser: 94.103.125.240
country_id: 732800
domain: gvu.titopen.us
description:
IM360 WAF: Block .suspected files||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/plugins/content/apismtp/apismtp.php.suspected||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 20:01:02 ait sshd[1381419]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.149.93
country_id: 99237
description:
Feb  6 20:01:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.149.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
country_id: 1835841
description:
2025-02-06 20:01:45 dovecot_login authenticator failed for ([175.202.82.251]) [175.202.82.251]:51496: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
country_id: 1835841
description:
Feb  6 20:01:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
country_id: 6252001
description:
Feb  6 20:00:57 ait sshd[1381245]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 20:01:02 ait sshd[1381419]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49  user=gvu


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
country_id: 1269750
description:
Feb  6 20:01:05 ait sshd[1381431]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.232.193.44
country_id: 3469034
description:
Feb  6 20:01:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.232.193.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
country_id: 1269750
description:
Feb  6 20:01:05 ait sshd[1381431]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-02-06 20:01:12 dovecot_plain authenticator failed for (evely) [65.20.149.93]:34508: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
country_id: 6252001
description:
Feb  6 20:00:57 ait sshd[1381245]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.232.193.44
country_id: 3469034
description:
2025-02-06 20:01:31 dovecot_login authenticator failed for (186-232-193-44.PROXXIMA.NET) [186.232.193.44]:53861: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.62
country_id: 1819730
description:
2025-02-06 20:02:27 dovecot_plain authenticator failed for (m121-202-153-62.smartone.com) [121.202.153.62]:31861: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.169.13
country_id: 2328926
description:
Feb  6 20:02:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.169.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.213.49.15
country_id: 2510769
description:
Feb  6 20:02:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.213.49.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
country_id: 3469034
description:
Feb  6 20:02:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
country_id: 3469034
description:
2025-02-06 20:02:12 dovecot_plain authenticator failed for ([186.247.238.25]) [200.149.51.186]:49860: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.235.246
country_id: 2661886
description:
2025-02-06 20:02:13 dovecot_plain authenticator failed for h77-53-235-246.cust.bredband2.com [77.53.235.246]:45208: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.6.250.109
country_id: 2635167
description:
Feb  6 20:02:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.6.250.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.62
country_id: 1819730
description:
Feb  6 20:02:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.96.101
country_id: 6252001
description:
[2025-02-06 20:02:47 +0100] info [cpaneld] 156.228.96.101 - ads20a00244y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20a00244y (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.13
country_id: 2328926
description:
2025-02-06 20:02:36 dovecot_login authenticator failed for ([41.216.169.13]) [41.216.169.13]:55438: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.55.86
country_id: 6252001
description:
[2025-02-06 20:02:39 +0100] info [cpaneld] 104.207.55.86 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.115.76.186
country_id: 6252001
description:
Feb  6 20:02:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.115.76.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.247.88
country_id: 1814991
description:
Feb  6 20:02:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.247.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.247.88
country_id: 1814991
description:
2025-02-06 20:02:09 dovecot_plain authenticator failed for ([183.220.247.88]) [183.220.247.88]:53930: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.238.206
country_id: 2017370
description:
Feb  6 20:02:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.238.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.238.206
country_id: 2017370
description:
2025-02-06 20:02:22 dovecot_plain authenticator failed for ([95.221.238.206]) [95.221.238.206]:41466: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.6.250.109
country_id: 2635167
description:
2025-02-06 20:02:22 dovecot_plain authenticator failed for 109.250.6.51.dyn.plus.net [51.6.250.109]:37584: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.213.49.15
country_id: 2510769
description:
2025-02-06 20:02:49 dovecot_plain authenticator failed for 15.49.213.185.dynamic.electronicamartinez.es [185.213.49.15]:50143: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.20.22.58
country_id: 6252001
description:
Feb  6 20:02:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.20.22.58 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.86.124
country_id: 6252001
description:
[2025-02-06 20:02:40 +0100] info [cpaneld] 156.228.86.124 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.60.247
country_id: 6252001
description:
[2025-02-06 20:02:38 +0100] info [cpaneld] 104.207.60.247 - ads20a00244y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20a00244y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 165.154.247.53
country_id: 1605651
description:
[2025-02-06 20:02:11 +0100] info [cpaneld] 165.154.247.53 - lemassne "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.235.246
country_id: 2661886
description:
Feb  6 20:02:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.235.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 20:02:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.20.22.58
country_id: 6252001
description:
2025-02-06 20:02:25 dovecot_login authenticator failed for (8-20-22-58.hwccustomers.com) [8.20.22.58]:52170: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.165.171
country_id: 6251999
description:
Feb  6 20:03:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.165.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.141.194.159
country_id: 1835841
description:
Feb  6 20:02:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.141.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.147.184
country_id: 3469034
description:
Feb  6 20:02:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.147.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.79
country_id: 1819730
description:
Feb  6 20:03:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2025-02-06 20:03:06 dovecot_plain authenticator failed for ([222.120.176.6]) [222.120.176.6]:37502: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.216.198.213
country_id: 2661886
description:
Feb  6 20:03:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.216.198.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.169.13
country_id: 2328926
description:
Feb  6 20:03:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.169.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.15.177.173
country_id: 1814991
description:
Feb  6 20:03:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.15.177.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.187.62.248
country_id: 2017370
description:
Feb  6 20:02:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.187.62.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.107.168.206
country_id: 1269750
description:
Feb  6 20:03:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.107.168.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.254.44.30
country_id: 597427
description:
Feb  6 20:03:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.254.44.30 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.95.32
country_id: 6252001
description:
[2025-02-06 20:03:08 +0100] info [whostmgrd] 156.228.95.32 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.23.199.129
country_id: 2017370
description:
Feb  6 20:03:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.23.199.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
country_id: 1210997
description:
2025-02-06 20:03:20 dovecot_plain authenticator failed for ([103.103.35.130]) [103.103.35.130]:39364: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.203.210.119
country_id: 1269750
description:
2025-02-06 20:03:29 dovecot_plain authenticator failed for ([103.203.210.119]) [103.203.210.119]:52129: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.38.21
country_id: 6252001
description:
2025-02-06 20:02:55 dovecot_plain authenticator failed for ([158.140.38.21]) [158.140.38.21]:52628: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.206.153
country_id: 6252001
description:
Feb  6 20:02:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.206.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.254.44.30
country_id: 597427
description:
2025-02-06 20:03:07 dovecot_plain authenticator failed for cl-185-254-44-30.b4net.lt [185.254.44.30]:49828: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.39.187.16
country_id: 3469034
description:
Feb  6 20:03:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.39.187.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
country_id: 1819730
description:
2025-02-06 20:03:29 dovecot_plain authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:45079: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.204.214
country_id: 1814991
description:
2025-02-06 20:02:59 dovecot_plain authenticator failed for ([117.176.204.214]) [117.176.204.214]:58762: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.245.232.31
country_id: 1814991
description:
2025-02-06 20:03:19 dovecot_plain authenticator failed for ([183.245.232.31]) [183.245.232.31]:50122: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.147.184
country_id: 3469034
description:
2025-02-06 20:02:52 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.147.184]:33772: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.148.173.150
country_id: 3469034
description:
Feb  6 20:03:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.148.173.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-02-06 20:03:06 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:17277: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.192.20.137
country_id: 3175395
description:
Feb  6 20:03:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.192.20.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.13
country_id: 2328926
description:
2025-02-06 20:03:17 dovecot_plain authenticator failed for ([41.216.169.13]) [41.216.169.13]:60688: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.148.173.150
country_id: 3469034
description:
2025-02-06 20:03:06 dovecot_plain authenticator failed for ([189.108.24.17]) [200.148.173.150]:36118: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.20.207.154
country_id: 1269750
description:
Feb  6 20:03:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.20.207.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.230.83.162
country_id: 2661886
description:
2025-02-06 20:03:13 dovecot_plain authenticator failed for 81-230-83-162-no600.tbcn.telia.com (ceatint) [81.230.83.162]:59259: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
country_id: 1562822
description:
Feb  6 20:03:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.149.123
country_id: 1819730
description:
Feb  6 20:02:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.149.123 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.38.91
country_id: 6252001
description:
[2025-02-06 20:02:58 +0100] info [whostmgrd] 104.207.38.91 - ads20a00244y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.126.227
country_id: 1835841
description:
2025-02-06 20:03:08 dovecot_plain authenticator failed for ([114.108.126.227]) [114.108.126.227]:45874: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.39.187.16
country_id: 3469034
description:
2025-02-06 20:03:13 dovecot_plain authenticator failed for ([189.39.187.16]) [189.39.187.16]:44398: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
country_id: 1835841
description:
2025-02-06 20:03:32 dovecot_plain authenticator failed for ([115.22.247.178]) [115.22.247.178]:54869: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.165.171
country_id: 6251999
description:
2025-02-06 20:03:35 dovecot_plain authenticator failed for 198-91-165-171.cpe.distributel.net [198.91.165.171]:60986: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.92
country_id: 1835841
description:
2025-02-06 20:02:59 dovecot_plain authenticator failed for ([1.241.64.92]) [1.241.64.92]:45173: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.96.66
country_id: 6252001
description:
[2025-02-06 20:03:05 +0100] info [whostmgrd] 156.228.96.66 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.242.86.203
country_id: 1814991
description:
Feb  6 20:03:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.242.86.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.161.16.240
country_id: 1835841
description:
Feb  6 20:03:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.161.16.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
country_id: 1210997
description:
Feb  6 20:03:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.203.210.119
country_id: 1269750
description:
Feb  6 20:03:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.203.210.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.211
country_id: 1819730
description:
Feb  6 20:03:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.115.76.186
country_id: 6252001
description:
2025-02-06 20:02:51 dovecot_plain authenticator failed for ool-45734cba.dyn.optonline.net [69.115.76.186]:39020: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 197.243.16.120
country_id: 49518
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:iric_admin||WPU:iric_admin||RSV:6.65||T:APACHE||MV:20-02.197.243.16.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.187.62.248
country_id: 2017370
description:
2025-02-06 20:02:52 dovecot_plain authenticator failed for ([188.187.62.248]) [188.187.62.248]:55172: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.149.123
country_id: 1819730
description:
2025-02-06 20:02:53 dovecot_plain authenticator failed for 123.149.48.116.static.netvigator.com [116.48.149.123]:51117: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.250
country_id: 1835841
description:
2025-02-06 20:03:01 dovecot_plain authenticator failed for ([211.247.127.250]) [211.247.127.250]:56392: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.23.199.129
country_id: 2017370
description:
2025-02-06 20:03:19 dovecot_plain authenticator failed for (tativider) [89.23.199.129]:60863: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.93.67
country_id: 6252001
description:
[2025-02-06 20:02:57 +0100] info [whostmgrd] 156.228.93.67 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.241.64.92
country_id: 1835841
description:
Feb  6 20:02:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.241.64.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.247.127.250
country_id: 1835841
description:
Feb  6 20:02:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.247.127.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.233.3
country_id: 99237
description:
Feb  6 20:03:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.233.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
country_id: 1835841
description:
Feb  6 20:03:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.107.168.206
country_id: 1269750
description:
2025-02-06 20:03:06 dovecot_plain authenticator failed for (static-206.168.107.27-tataidc.co.in) [27.107.168.206]:55600: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.245.232.31
country_id: 1814991
description:
Feb  6 20:03:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.245.232.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.15.177.173
country_id: 1814991
description:
2025-02-06 20:03:18 dovecot_plain authenticator failed for ([121.15.177.173]) [121.15.177.173]:57946: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.31.80.222
country_id: 1814991
description:
Feb  6 20:02:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.31.80.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.79
country_id: 1819730
description:
2025-02-06 20:03:02 dovecot_plain authenticator failed for 079.42.246.220.static.netvigator.com [220.246.42.79]:51320: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.89.247
country_id: 6252001
description:
[2025-02-06 20:03:10 +0100] info [whostmgrd] 156.228.89.247 - ads20a00244y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.124.66
country_id: 1835841
description:
Feb  6 20:03:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.124.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.119.2
country_id: 1814991
description:
2025-02-06 20:03:14 dovecot_plain authenticator failed for ([180.168.119.2]) [180.168.119.2]:43240: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.20.137
country_id: 3175395
description:
2025-02-06 20:03:16 dovecot_plain authenticator failed for ([2.192.20.137]) [2.192.20.137]:45242: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.82
country_id: 1819730
description:
2025-02-06 20:03:17 dovecot_plain authenticator failed for (m121-202-152-82.smartone.com) [121.202.152.82]:38803: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
country_id: 732800
description:
Feb  6 20:03:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.242.86.203
country_id: 1814991
description:
2025-02-06 20:03:08 dovecot_plain authenticator failed for ([58.242.86.203]) [58.242.86.203]:49843: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.161.16.240
country_id: 1835841
description:
2025-02-06 20:03:15 dovecot_plain authenticator failed for ([221.161.16.240]) [221.161.16.240]:47971: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.216.198.213
country_id: 2661886
description:
2025-02-06 20:03:16 dovecot_plain authenticator failed for c-84-216-198-213.bbcust.telenor.se (boodonums) [84.216.198.213]:39966: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.161.242.146
country_id: 1814991
description:
Feb  6 20:03:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.161.242.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.141.194.159
country_id: 1835841
description:
2025-02-06 20:02:52 dovecot_plain authenticator failed for ([121.141.194.159]) [121.141.194.159]:57510: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.204.214
country_id: 1814991
description:
Feb  6 20:02:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.204.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.3
country_id: 99237
description:
2025-02-06 20:03:04 dovecot_plain authenticator failed for ([65.20.233.3]) [65.20.233.3]:60372: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.230.83.162
country_id: 2661886
description:
Feb  6 20:03:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.230.83.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.101.223
country_id: 6252001
description:
[2025-02-06 20:03:17 +0100] info [whostmgrd] 156.228.101.223 - ads20a00244y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
country_id: 1835841
description:
Feb  6 20:03:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.118.157
country_id: 1562822
description:
Feb  6 20:03:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.118.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
country_id: 1562822
description:
2025-02-06 20:03:22 dovecot_plain authenticator failed for ([171.244.63.170]) [171.244.63.170]:30973: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.234.48.147
country_id: 1814991
description:
Feb  6 20:02:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.234.48.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.129
country_id: 1835841
description:
2025-02-06 20:02:52 dovecot_plain authenticator failed for ([118.220.149.129]) [118.220.149.129]:40632: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.234.48.147
country_id: 1814991
description:
2025-02-06 20:02:53 dovecot_plain authenticator failed for ([221.234.48.147]) [221.234.48.147]:51715: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.38.21
country_id: 6252001
description:
Feb  6 20:02:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.38.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.222
country_id: 1819730
description:
2025-02-06 20:02:58 dovecot_plain authenticator failed for ([121.202.205.222]) [121.202.205.222]:13990: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.104.103
country_id: 1668284
description:
Feb  6 20:03:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.104.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.104.103
country_id: 1668284
description:
2025-02-06 20:03:16 dovecot_plain authenticator failed for 110-25-104-103.adsl.fetnet.net [110.25.104.103]:55504: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.80.222
country_id: 1814991
description:
2025-02-06 20:03:00 dovecot_plain authenticator failed for ([1.31.80.222]) [1.31.80.222]:45930: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.82
country_id: 1819730
description:
Feb  6 20:03:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.124.66
country_id: 1835841
description:
2025-02-06 20:03:16 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:51588: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.220.149.129
country_id: 1835841
description:
Feb  6 20:02:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.220.149.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.222
country_id: 1819730
description:
Feb  6 20:02:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.206.153
country_id: 6252001
description:
2025-02-06 20:03:01 dovecot_plain authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:34413: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.119.2
country_id: 1814991
description:
Feb  6 20:03:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.119.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.112.104.162
country_id: 1814991
description:
Feb  6 20:03:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.112.104.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.104.162
country_id: 1814991
description:
2025-02-06 20:03:21 dovecot_plain authenticator failed for ([36.112.104.162]) [36.112.104.162]:57098: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.161.242.146
country_id: 1814991
description:
2025-02-06 20:03:22 dovecot_login authenticator failed for (146.242.161.222.adsl-pool.jlccptt.net.cn) [222.161.242.146]:8015: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.230.98
country_id: 1814991
description:
Feb  6 20:03:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.230.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.43.109
country_id: 1819730
description:
Feb  6 20:04:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.43.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
country_id: 294640
description:
2025-02-06 20:04:47 dovecot_plain authenticator failed for (nonics) [147.235.97.158]:22159: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.190.222.124
country_id: 1819730
description:
Feb  6 20:04:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.190.222.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.190.222.124
country_id: 1819730
description:
2025-02-06 20:04:37 dovecot_plain authenticator failed for ([94.190.222.124]) [94.190.222.124]:49377: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.237.199
country_id: 6252001
description:
Feb  6 20:04:39 ait sshd[1382390]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.89.237.199 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.89.237.199
country_id: 6252001
description:
Feb  6 20:04:39 ait sshd[1382390]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.237.199


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.118.157
country_id: 1562822
description:
2025-02-06 20:03:50 dovecot_login authenticator failed for ([118.70.118.157]) [118.70.118.157]:34971: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
country_id: 294640
description:
Feb  6 20:04:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
country_id: 1819730
description:
2025-02-06 20:04:18 dovecot_login authenticator failed for 109.43.246.220.static.netvigator.com [220.246.43.109]:55339: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.102.39.138
country_id: 3077311
description:
Feb  6 20:03:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.102.39.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.138
country_id: 3077311
description:
2025-02-06 20:03:57 dovecot_login authenticator failed for (ADMIN) [212.102.39.138]:42504: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.230.98
country_id: 1814991
description:
2025-02-06 20:04:00 dovecot_login authenticator failed for ([1.180.230.112]) [1.180.230.98]:54924: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.175.194.139
country_id: 6252001
description:
Feb  6 20:04:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.175.194.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.175.194.139
country_id: 6252001
description:
2025-02-06 20:04:05 dovecot_login authenticator failed for syn-072-175-194-139.res.spectrum.com [72.175.194.139]:62597: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.24.194.207
country_id: 1835841
description:
2025-02-06 20:04:54 dovecot_plain authenticator failed for ([59.24.194.207]) [59.24.194.207]:34391: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.186.241.102
country_id: 1835841
description:
Feb  6 20:05:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.186.241.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.241.102
country_id: 1835841
description:
2025-02-06 20:05:26 dovecot_plain authenticator failed for ([112.186.241.102]) [112.186.241.102]:36355: 535 Incorrect authentication data (set_id=nyarko)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
country_id: 2017370
description:
Feb  6 20:05:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.24.194.207
country_id: 1835841
description:
Feb  6 20:04:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.24.194.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.126.10
country_id: 337996
description:
Feb  6 20:05:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.126.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.10
country_id: 337996
description:
2025-02-06 20:05:04 dovecot_plain authenticator failed for ([196.189.126.10]) [196.189.126.10]:34158: 535 Incorrect authentication data (set_id=nyarko@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.172.86
country_id: 2635167
description:
2025-02-06 20:05:20 dovecot_login authenticator failed for (ADMIN) [45.133.172.86]:35474: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
country_id: 2017370
description:
2025-02-06 20:05:40 dovecot_plain authenticator failed for (imiticted) [88.87.84.104]:40786: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.44.217.237
country_id: 2077456
description:
Feb  6 20:06:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.44.217.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.44.217.237
country_id: 2077456
description:
2025-02-06 20:06:23 dovecot_plain authenticator failed for ([121.44.217.237]) [121.44.217.237]:54962: 535 Incorrect authentication data (set_id=baah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.136.243
country_id: 1562822
description:
Feb  6 20:06:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.136.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.65.21
country_id: 1814991
description:
Feb  6 20:06:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.65.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.126.223.175
country_id: 2017370
description:
Feb  6 20:06:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.126.223.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
country_id: 2017370
description:
2025-02-06 20:06:11 dovecot_plain authenticator failed for ([92.126.223.175]) [92.126.223.175]:43494: 535 Incorrect authentication data (set_id=baah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.231.249
country_id: 6252001
description:
2025-02-06 20:05:59 dovecot_login authenticator failed for ([104.241.231.249]) [104.241.231.249]:50266: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.65.21
country_id: 1814991
description:
2025-02-06 20:06:37 dovecot_plain authenticator failed for ([183.220.65.21]) [183.220.65.21]:51754: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.136.243
country_id: 1562822
description:
2025-02-06 20:06:14 dovecot_login authenticator failed for ([45.118.136.243]) [45.118.136.243]:50272: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.66.222
country_id: 2017370
description:
Feb  6 20:06:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.66.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.66.222
country_id: 2017370
description:
2025-02-06 20:06:25 dovecot_plain authenticator failed for ([31.173.66.222]) [31.173.66.222]:55786: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.151.150
country_id: 3469034
description:
2025-02-06 20:05:50 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.151.150]:34840: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.231.249
country_id: 6252001
description:
Feb  6 20:05:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.231.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.109.217.15
country_id: 783754
description:
2025-02-06 20:07:19 dovecot_plain authenticator failed for (meterter) [192.109.217.15]:44960: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
country_id: 3469034
description:
2025-02-06 20:07:33 dovecot_plain authenticator failed for ([187.51.234.239]) [189.108.147.210]:41910: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.188.169
country_id: 1861060
description:
2025-02-06 20:07:34 dovecot_login authenticator failed for ([180.7.188.169]) [180.7.188.169]:56281: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-06 20:07:44 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-168.static.tpgi.com.au) [110.175.220.250]:44823: 535 Incorrect authentication data (set_id=abs18a00023y)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 178.128.123.111
country_id: 1880251
domain: www.ait.edu.gh
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:20-07.178.128.123.111||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.142.8
country_id: 2017370
description:
Feb  6 20:07:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.142.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.109.217.15
country_id: 783754
description:
Feb  6 20:07:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.109.217.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.218.102.225
country_id: 1668284
description:
Feb  6 20:07:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.218.102.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.3.159.176
country_id: 6252001
description:
Feb  6 20:07:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.3.159.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.251.214
country_id: 1835841
description:
Feb  6 20:07:32 ait sshd[1383884]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.239.251.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  6 20:07:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
country_id: 3469034
description:
Feb  6 20:07:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 20:07:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.159.176
country_id: 6252001
description:
2025-02-06 20:07:31 dovecot_plain authenticator failed for (192-3-159-176-host.colocrossing.com) [192.3.159.176]:35822: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.239.251.214
country_id: 1835841
description:
Feb  6 20:07:32 ait sshd[1383884]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.239.251.214  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.218.102.225
country_id: 1668284
description:
2025-02-06 20:07:42 dovecot_login authenticator failed for (180-218-102-225.dynamic.twmbroadband.net) [180.218.102.225]:36416: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 178.128.123.111
country_id: 1880251
domain: www.ait.edu.gh
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/atomlib.php||SC:/home/ait02/public_html/images


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.142.8
country_id: 2017370
description:
2025-02-06 20:07:18 dovecot_plain authenticator failed for 95-165-142-8.static.spd-mgts.ru [95.165.142.8]:44941: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.91.67
country_id: 1814991
description:
2025-02-06 20:07:53 dovecot_login authenticator failed for ([39.164.91.67]) [39.164.91.67]:41824: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.216.119.13
country_id: 1835841
description:
Feb  6 20:08:04 ait sshd[1384082]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.216.119.13


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.200.239
country_id: 6252001
description:
Feb  6 20:08:16 ait sshd[1384109]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.178.200.239 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.178.200.239
country_id: 6252001
description:
Feb  6 20:08:16 ait sshd[1384109]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.178.200.239


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.91.67
country_id: 1814991
description:
Feb  6 20:07:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.91.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.216.119.13
country_id: 1835841
description:
Feb  6 20:08:04 ait sshd[1384082]: pam_imunify(sshd:auth): [IM360_RBL] The IP 118.216.119.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.28
country_id: 99237
description:
Feb  6 20:09:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-02-06 20:09:49 dovecot_plain authenticator failed for (pling) [65.20.129.28]:50014: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.231.90
country_id: 2921044
description:
Feb  6 20:09:53 ait sshd[1384528]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.205.231.90 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.231.90
country_id: 2921044
description:
Feb  6 20:09:53 ait sshd[1384528]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.231.90


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 20:10:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.52.139
country_id: 1880251
description:
47.128.52.139 - - [06/Feb/2025:20:11:08 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16603643 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61&filter_course-language=99%2C198%2C79&instructor=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.52.139


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.99.13.82
country_id: 6251999
description:
Feb  6 20:11:13 ait sshd[1385260]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.99.13.82 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.99.13.82
country_id: 6251999
description:
Feb  6 20:11:13 ait sshd[1385260]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.99.13.82


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.173.85.161
country_id: 6252001
description:
Feb  6 20:11:02 ait sshd[1385114]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.173.85.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.24.154.232
country_id: 2510769
description:
Feb  6 20:11:43 ait sshd[1385427]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.24.154.232 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.173.85.161
country_id: 6252001
description:
Feb  6 20:11:02 ait sshd[1385114]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.173.85.161


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:20-11.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.85.15.251
country_id: 3686110
description:
Feb  6 20:11:15 ait sshd[1385321]: pam_imunify(sshd:auth): [IM360_RBL] The IP 190.85.15.251 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 190.85.15.251
country_id: 3686110
description:
Feb  6 20:11:15 ait sshd[1385321]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.85.15.251


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.24.154.232
country_id: 2510769
description:
Feb  6 20:11:43 ait sshd[1385427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.24.154.232


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.132.207
country_id: 2077456
description:
2025-02-06 20:12:18 dovecot_plain authenticator failed for 207.132.220.111.sta.wbroadband.net.au [111.220.132.207]:44246: 535 Incorrect authentication data (set_id=eng20a00022y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.120.70
country_id: 1814991
description:
Feb  6 20:12:47 ait sshd[1385739]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.120.70 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.120.70
country_id: 1814991
description:
Feb  6 20:12:47 ait sshd[1385739]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.120.70


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.181.133.153
country_id: 3469034
description:
Feb  6 20:12:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.181.133.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2025-02-06 20:12:02 dovecot_plain authenticator failed for ([179.181.135.1]) [179.181.133.153]:45519: 535 Incorrect authentication data (set_id=eng20a00022y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.132.207
country_id: 2077456
description:
Feb  6 20:12:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.132.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.155.116
country_id: 3469034
description:
Feb  6 20:13:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.155.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.231.159
country_id: 2921044
description:
Feb  6 20:13:04 ait sshd[1385960]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.205.231.159 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.231.159
country_id: 2921044
description:
Feb  6 20:13:04 ait sshd[1385960]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.231.159  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.155.116
country_id: 3469034
description:
2025-02-06 20:13:05 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.155.116]:44817: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.85.251.16
country_id: 1835841
description:
Feb  6 20:13:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.85.251.16 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.203.44.120
country_id: 6251999
description:
Feb  6 20:13:00 ait sshd[1385930]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.44.120  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.85.251.16
country_id: 1835841
description:
2025-02-06 20:13:17 dovecot_plain authenticator failed for ([220.85.251.16]) [220.85.251.16]:49046: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.80.209
country_id: 294640
description:
Feb  6 20:13:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.80.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.80.209
country_id: 294640
description:
2025-02-06 20:13:45 dovecot_login authenticator failed for (2-55-80-209.orange.net.il) [2.55.80.209]:40639: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.44.120
country_id: 6251999
description:
Feb  6 20:13:00 ait sshd[1385930]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.203.44.120 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.103.120.70
country_id: 1814991
description:
Feb  6 20:12:52 ait sshd[1385739]: Disconnected from invalid user user1 14.103.120.70 port 60254 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.77.25.247
country_id: 6252001
description:
2025-02-06 20:14:30 dovecot_plain authenticator failed for ([76.77.25.247]) [76.77.25.247]:47528: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.115.100.144
country_id: 272103
description:
2025-02-06 20:14:39 dovecot_plain authenticator failed for 3pc100-144.rconx.com [185.115.100.144]:44772: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.10.27.190
country_id: 1814991
description:
Feb  6 20:14:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.10.27.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.115.100.144
country_id: 272103
description:
Feb  6 20:14:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.115.100.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.231.90
country_id: 2921044
description:
Feb  6 20:14:47 ait sshd[1386396]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.205.231.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.19.131
country_id: 3923057
description:
Feb  6 20:13:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.19.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.111.113
country_id: 1814991
description:
2025-02-06 20:13:55 dovecot_plain authenticator failed for ([221.0.111.113]) [221.0.111.113]:60266: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.99.36.130
country_id: 6251999
description:
Feb  6 20:14:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.99.36.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.99.36.130
country_id: 6251999
description:
2025-02-06 20:14:26 dovecot_plain authenticator failed for ([50.99.36.130]) [50.99.36.130]:60290: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.77.25.247
country_id: 6252001
description:
Feb  6 20:14:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.77.25.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.111.113
country_id: 1814991
description:
Feb  6 20:13:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.111.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.181.19.131
country_id: 3923057
description:
2025-02-06 20:13:54 dovecot_login authenticator failed for static-190-181-19-131.acelerate.net [190.181.19.131]:62314: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.10.27.190
country_id: 1814991
description:
2025-02-06 20:14:44 dovecot_plain authenticator failed for ([218.10.27.190]) [218.10.27.190]:55428: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.231.90
country_id: 2921044
description:
Feb  6 20:14:47 ait sshd[1386396]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.231.90


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.96.43.25
country_id: 1562822
description:
Feb  6 20:15:35 ait sshd[1386865]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.43.25


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.205.231.90
country_id: 2921044
description:
Feb  6 20:14:51 ait sshd[1386396]: Disconnected from invalid user admin 92.205.231.90 port 45960 [preauth]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.172.79.206
country_id: 1835841
description:
Feb  6 20:14:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.172.79.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2025-02-06 20:15:02 dovecot_plain authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:55022: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.161.52.149
country_id: 1814991
description:
Feb  6 20:15:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.161.52.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
country_id: 1814991
description:
2025-02-06 20:15:16 dovecot_login authenticator failed for ([220.161.52.149]) [220.161.52.149]:43493: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.68.229.201
country_id: 6252001
description:
Feb  6 20:15:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.68.229.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.96.43.25
country_id: 1562822
description:
Feb  6 20:15:35 ait sshd[1386865]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.96.43.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.173.85.161
country_id: 6252001
description:
Feb  6 20:15:39 ait sshd[1386911]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.173.85.161 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.173.85.161
country_id: 6252001
description:
Feb  6 20:15:39 ait sshd[1386911]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.173.85.161


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.172.79.206
country_id: 1835841
description:
2025-02-06 20:15:01 dovecot_plain authenticator failed for ([211.172.79.206]) [211.172.79.206]:39926: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.228.100
country_id: 6252001
description:
Feb  6 20:15:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.228.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.68.52.210
country_id: 1269750
description:
Feb  6 20:14:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.68.52.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.72.9.151
country_id: 1269750
description:
Feb  6 20:15:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.72.9.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.228.100
country_id: 6252001
description:
2025-02-06 20:15:34 dovecot_login authenticator failed for ([104.241.228.100]) [104.241.228.100]:33583: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 20:15:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2025-02-06 20:14:53 dovecot_plain authenticator failed for ([103.68.52.210]) [103.68.52.210]:56456: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.68.229.201
country_id: 6252001
description:
2025-02-06 20:15:20 dovecot_login authenticator failed for s201-229-68-64.ssvec.az.wi-power.com [64.68.229.201]:37480: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 20:15:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.10.46
country_id: 1814991
description:
Feb  6 20:15:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.10.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.10.46
country_id: 1814991
description:
2025-02-06 20:15:30 dovecot_login authenticator failed for ([120.197.10.46]) [120.197.10.46]:60524: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.205.231.90
country_id: 2921044
description:
Feb  6 20:15:59 ait sshd[1387021]: Failed password for invalid user es from 92.205.231.90 port 36306 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.80.68
country_id: 1835841
description:
Feb  6 20:16:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.80.68 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 180.76.166.82
country_id: 1814991
description:
Feb  6 20:16:10 ait sshd[1387230]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.166.82


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.119.2
country_id: 1814991
description:
2025-02-06 20:16:18 dovecot_plain authenticator failed for ([180.168.119.2]) [180.168.119.2]:36929: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 20:15:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.231.90
country_id: 2921044
description:
Feb  6 20:15:57 ait sshd[1387021]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.205.231.90 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.231.90
country_id: 2921044
description:
Feb  6 20:15:57 ait sshd[1387021]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.231.90


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.80.68
country_id: 1835841
description:
2025-02-06 20:16:07 dovecot_plain authenticator failed for ([211.44.80.68]) [211.44.80.68]:39642: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.119.2
country_id: 1814991
description:
Feb  6 20:16:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.119.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.211.31.222
country_id: 2510769
description:
Feb  6 20:17:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.211.31.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.173.85.161
country_id: 6252001
description:
Feb  6 20:16:51 ait sshd[1387453]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.173.85.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.180.162.23
country_id: 1814991
description:
Feb  6 20:17:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.180.162.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.17.80
country_id: 2921044
description:
Feb  6 20:17:18 ait sshd[1387678]: pam_imunify(sshd:auth): [IM360_RBL] The IP 57.129.17.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.253.28.238
country_id: 1835841
description:
Feb  6 20:17:34 ait sshd[1387734]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.253.28.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.238
country_id: 337996
description:
Feb  6 20:17:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.238 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.253.28.238
country_id: 1835841
description:
Feb  6 20:17:34 ait sshd[1387734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.253.28.238


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.173.85.161
country_id: 6252001
description:
Feb  6 20:16:51 ait sshd[1387453]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.173.85.161


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.180.162.23
country_id: 1814991
description:
2025-02-06 20:17:07 dovecot_plain authenticator failed for ([42.180.162.23]) [42.180.162.23]:45319: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.182.71.73
country_id: 3017382
description:
Feb  6 20:17:36 ait sshd[1387737]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.182.71.73  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
country_id: 2510769
description:
2025-02-06 20:17:48 dovecot_plain authenticator failed for ([77.211.31.222]) [77.211.31.222]:37102: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 57.129.17.80
country_id: 2921044
description:
Feb  6 20:17:18 ait sshd[1387678]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=57.129.17.80


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.238
country_id: 337996
description:
2025-02-06 20:17:22 dovecot_plain authenticator failed for ([196.191.212.238]) [196.191.212.238]:58412: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 20:17:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.182.71.73
country_id: 3017382
description:
Feb  6 20:17:36 ait sshd[1387737]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.182.71.73 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 102.218.215.240
country_id: 953987
description:
Feb  6 20:18:14 ait sshd[1387948]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.218.215.240  user=ftp


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.216.168.226
country_id: 3469034
description:
Feb  6 20:18:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.216.168.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.168.235
country_id: 99237
description:
Feb  6 20:18:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.168.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.218.215.240
country_id: 953987
description:
Feb  6 20:18:14 ait sshd[1387948]: pam_imunify(sshd:auth): [IM360_RBL] The IP 102.218.215.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.165.243.10
country_id: 1643084
description:
Feb  6 20:18:36 ait sshd[1388014]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.165.243.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.168.226
country_id: 3469034
description:
2025-02-06 20:18:03 dovecot_plain authenticator failed for (200-217-53-25.host.telemar.net.br) [200.216.168.226]:38141: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.165.243.10
country_id: 1643084
description:
Feb  6 20:18:36 ait sshd[1388014]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.165.243.10


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.168.235
country_id: 99237
description:
2025-02-06 20:18:19 dovecot_plain authenticator failed for (reculpism) [65.20.168.235]:45756: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.19.80.138
country_id: 6252001
description:
2025-02-06 20:19:07 dovecot_plain authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:57419: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.85.15.251
country_id: 3686110
description:
Feb  6 20:19:33 ait sshd[1388267]: pam_imunify(sshd:auth): [IM360_RBL] The IP 190.85.15.251 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.120.70
country_id: 1814991
description:
Feb  6 20:19:16 ait sshd[1388223]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.120.70


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.19.80.138
country_id: 6252001
description:
Feb  6 20:19:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.19.80.138 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 20:19:12 ait sshd[1388220]: Invalid user universitypublishing from 211.108.234.111 port 49144


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 20:19:13 ait sshd[1388220]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 20:19:13 ait sshd[1388220]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.79
country_id: 1819730
description:
2025-02-06 20:19:14 dovecot_plain authenticator failed for 079.42.246.220.static.netvigator.com [220.246.42.79]:60560: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 100.37.1.10
country_id: 6252001
description:
Feb  6 20:19:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 100.37.1.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 190.85.15.251
country_id: 3686110
description:
Feb  6 20:19:33 ait sshd[1388267]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.85.15.251


plugin: modsec
rule: 77140880
name: IM360 WAF: Infectors: PHP Injection Attack
abuser: 204.10.194.175
country_id: 2921044
domain: gou.university
description:
IM360 WAF: Infectors: PHP Injection Attack||MVN:ARGS:fw||MV:fwrite||RSV:6.65||T:APACHE||SC:/home/gou002/public_html/wp-content/plugins/wp-ver.php


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.79
country_id: 1819730
description:
Feb  6 20:19:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
country_id: 2017370
description:
Feb  6 20:19:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.73.188.213
country_id: 1269750
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:20-19.103.73.188.213


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.120.70
country_id: 1814991
description:
Feb  6 20:19:16 ait sshd[1388223]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.120.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 100.37.1.10
country_id: 6252001
description:
2025-02-06 20:19:17 dovecot_plain authenticator failed for pool-100-37-1-10.nycmny.fios.verizon.net [100.37.1.10]:57246: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
country_id: 2017370
description:
2025-02-06 20:19:46 dovecot_plain authenticator failed for (13-78-123-185.host.cirex.ru) [185.123.78.13]:32173: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.38.5
country_id: 1835841
description:
Feb  6 20:20:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.38.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.240.204.168
country_id: 2077456
description:
2025-02-06 20:20:17 dovecot_plain authenticator failed for 60-240-204-168.static.tpgi.com.au [60.240.204.168]:37916: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.172.157.163
country_id: 1814991
description:
Feb  6 20:20:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.172.157.163 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 116.118.51.209
country_id: 1562822
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:20-19.116.118.51.209


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.23.77.27
country_id: 1814991
description:
2025-02-06 20:19:58 dovecot_plain authenticator failed for ([14.23.77.27]) [14.23.77.27]:56688: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.240.204.168
country_id: 2077456
description:
Feb  6 20:20:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.240.204.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.116.150
country_id: 1835841
description:
2025-02-06 20:20:27 dovecot_login authenticator failed for ([121.168.116.150]) [121.168.116.150]:57951: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.38.5
country_id: 1835841
description:
2025-02-06 20:20:05 dovecot_plain authenticator failed for ([211.169.38.5]) [211.169.38.5]:58392: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.172.157.163
country_id: 1814991
description:
2025-02-06 20:20:25 dovecot_plain authenticator failed for ([219.140.170.34]) [59.172.157.163]:53844: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.243.79.22
country_id: 3469034
description:
Feb  6 20:20:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.243.79.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.23.77.27
country_id: 1814991
description:
Feb  6 20:19:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.23.77.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.116.150
country_id: 1835841
description:
Feb  6 20:20:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.116.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.217.229
country_id: 614540
description:
Feb  6 20:20:32 ait sshd[1388806]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.217.229 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.217.229
country_id: 614540
description:
Feb  6 20:20:32 ait sshd[1388806]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.217.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.243.79.22
country_id: 3469034
description:
2025-02-06 20:20:40 dovecot_login authenticator failed for 191-243-79-22.telecomconectividade.net.br [191.243.79.22]:42046: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-02-06 20:21:10 dovecot_plain authenticator failed for ([189.57.81.137]) [186.201.54.90]:49050: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.198.60
country_id: 1835841
description:
Feb  6 20:21:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.198.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.198.60
country_id: 1835841
description:
2025-02-06 20:21:25 dovecot_plain authenticator failed for ([121.189.198.60]) [121.189.198.60]:59544: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.57.104.252
country_id: 1522867
description:
2025-02-06 20:21:33 dovecot_plain authenticator failed for 95.57.104.252.dynamic.telecom.kz [95.57.104.252]:37359: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.85.15.251
country_id: 3686110
description:
Feb  6 20:21:40 ait sshd[1389341]: pam_imunify(sshd:auth): [IM360_RBL] The IP 190.85.15.251 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.248.27.95
country_id: 2921044
description:
Feb  6 20:21:43 ait sshd[1389380]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.27.95


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.93
country_id: 1819730
description:
Feb  6 20:21:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.189
country_id: 1814991
description:
Feb  6 20:21:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.57.104.252
country_id: 1522867
description:
Feb  6 20:21:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.57.104.252 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.42.80
country_id: 3144096
description:
Feb  6 20:21:33 ait sshd[1389317]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.42.80  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.248.27.95
country_id: 2921044
description:
Feb  6 20:21:43 ait sshd[1389380]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.248.27.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.201.54.90
country_id: 3469034
description:
Feb  6 20:21:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.201.54.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.100
country_id: 1819730
description:
2025-02-06 20:21:37 dovecot_plain authenticator failed for (m121-202-154-100.smartone.com) [121.202.154.100]:13802: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 190.85.15.251
country_id: 3686110
description:
Feb  6 20:21:40 ait sshd[1389341]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.85.15.251


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.231.137.153
country_id: 1835841
description:
Feb  6 20:21:40 ait sshd[1389340]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.231.137.153  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.189
country_id: 1814991
description:
2025-02-06 20:21:32 dovecot_plain authenticator failed for ([60.167.19.189]) [60.167.19.189]:50634: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.42.80
country_id: 3144096
description:
Feb  6 20:21:33 ait sshd[1389317]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.42.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.100
country_id: 1819730
description:
Feb  6 20:21:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.231.137.153
country_id: 1835841
description:
Feb  6 20:21:40 ait sshd[1389340]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.231.137.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.235.240
country_id: 6252001
description:
2025-02-06 20:22:32 dovecot_login authenticator failed for (ADMIN) [102.129.235.240]:7175: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.49.60.24
country_id: 2017370
description:
Feb  6 20:22:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.49.60.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.93
country_id: 1819730
description:
2025-02-06 20:21:51 dovecot_plain authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:41407: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.97.219.60
country_id: 1269750
description:
Feb  6 20:22:22 ait sshd[1389813]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.97.219.60 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.97.219.60
country_id: 1269750
description:
Feb  6 20:22:22 ait sshd[1389813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.97.219.60


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.235.240
country_id: 6252001
description:
Feb  6 20:22:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.235.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.49.60.24
country_id: 2017370
description:
2025-02-06 20:22:51 dovecot_plain authenticator failed for (l49-60-24.novotelecom.ru) [178.49.60.24]:54770: 535 Incorrect authentication data (set_id=ads20a00141y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.93
country_id: 1819730
description:
Feb  6 20:23:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.113.101
country_id: 1835841
description:
2025-02-06 20:23:39 dovecot_plain authenticator failed for ([211.48.113.101]) [211.48.113.101]:38794: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.7.100
country_id: 2264397
description:
2025-02-06 20:23:48 dovecot_plain authenticator failed for 100.7.61.94.rev.vodafone.pt [94.61.7.100]:36316: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.232.115
country_id: 6252001
description:
Feb  6 20:23:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.229.232.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.239.78.124
country_id: 1819730
description:
Feb  6 20:23:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.239.78.124 has been locked due to Imunify RBL


