# incident

plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.65
country_id: 732800
description:
Feb  6 22:28:21 ait sshd[1447461]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.178.110.65 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.178.110.65
country_id: 732800
description:
Feb  6 22:28:21 ait sshd[1447461]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.178.110.65


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.164.176.167
country_id: 390903
description:
2025-02-06 22:28:25 dovecot_login authenticator failed for ([95.164.176.167]) [95.164.176.167]:36994: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.236.156.129
country_id: 1835841
description:
Feb  6 22:28:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.236.156.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.199.98.51
country_id: 690791
description:
Feb  6 22:28:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.199.98.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.199.98.51
country_id: 690791
description:
2025-02-06 22:28:42 dovecot_login authenticator failed for ([185.199.98.51]) [185.199.98.51]:57620: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.227.219.90
country_id: 2510769
description:
Feb  6 22:29:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.227.219.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.80.166
country_id: 1880251
description:
Feb  6 22:29:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.80.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.83.205
country_id: 290557
description:
2025-02-06 22:29:30 dovecot_login authenticator failed for ([94.205.83.205]) [94.205.83.205]:51838: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.225.31.134
country_id: 6252001
description:
Feb  6 22:29:36 ait sshd[1447804]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.225.31.134


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.165.130.61
country_id: 1643084
description:
Feb  6 22:29:36 ait sshd[1447801]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.165.130.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.69.76.148
country_id: 1814991
description:
2025-02-06 22:29:27 dovecot_plain authenticator failed for (ctw.webcas.net) [125.69.76.148]:55391: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.69.76.148
country_id: 1814991
description:
Feb  6 22:29:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.69.76.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.83.205
country_id: 290557
description:
Feb  6 22:29:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.83.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.115.100.144
country_id: 272103
description:
Feb  6 22:28:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.115.100.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.80.166
country_id: 1880251
description:
2025-02-06 22:29:04 dovecot_plain authenticator failed for (166.80.156.175.unknown.m1.com.sg) [175.156.80.166]:39194: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.9.211
country_id: 1814991
description:
Feb  6 22:29:24 ait sshd[1447767]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.9.211 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.165.130.61
country_id: 1643084
description:
Feb  6 22:29:36 ait sshd[1447801]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.165.130.61


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.190
country_id: 1814991
description:
Feb  6 22:29:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.115.100.144
country_id: 272103
description:
2025-02-06 22:28:56 dovecot_login authenticator failed for 3pc100-144.rconx.com [185.115.100.144]:60823: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.186.136.36
country_id: 1814991
description:
2025-02-06 22:28:46 dovecot_plain authenticator failed for ([61.186.136.36]) [61.186.136.36]:57994: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
country_id: 1814991
description:
2025-02-06 22:28:46 dovecot_login authenticator failed for ([27.223.100.94]) [27.223.100.90]:47716: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.207.8.194
country_id: 690791
description:
Feb  6 22:28:58 ait sshd[1447581]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.207.8.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.227.219.90
country_id: 2510769
description:
2025-02-06 22:29:10 dovecot_plain authenticator failed for (kohum) [185.227.219.90]:33836: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.186.136.36
country_id: 1814991
description:
Feb  6 22:28:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.186.136.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
country_id: 1835841
description:
Feb  6 22:29:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.9.211
country_id: 1814991
description:
Feb  6 22:29:24 ait sshd[1447767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.9.211


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.207.8.194
country_id: 690791
description:
Feb  6 22:28:58 ait sshd[1447581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.207.8.194


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.225.31.134
country_id: 6252001
description:
Feb  6 22:29:36 ait sshd[1447804]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.225.31.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
country_id: 1814991
description:
Feb  6 22:28:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.200.202
country_id: 2921044
description:
2025-02-06 22:29:55 dovecot_login authenticator failed for ([161.35.200.202]) [161.35.200.202]:45888: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.231.98.88
country_id: 3469034
description:
[2025-02-06 22:30:04 +0100] info [webmaild] 45.231.98.88 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.207.8.194
country_id: 690791
description:
Feb  6 22:30:30 ait sshd[1448313]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.207.8.194


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
country_id: 1835841
description:
2025-02-06 22:29:45 dovecot_login authenticator failed for ([211.105.213.144]) [211.105.213.144]:35640: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 22:29:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.35.200.202
country_id: 2921044
description:
Feb  6 22:29:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.35.200.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2025-02-06 22:29:45 dovecot_login authenticator failed for ([111.61.177.190]) [111.61.177.190]:28914: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.207.8.194
country_id: 690791
description:
Feb  6 22:30:30 ait sshd[1448313]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.207.8.194 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.16.85.102
country_id: 718075
description:
Feb  6 22:30:53 ait sshd[1448456]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.16.85.102


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Feb  6 22:31:42 ait sshd[1448685]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.225.31.134
country_id: 6252001
description:
Feb  6 22:30:48 ait sshd[1448397]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.225.31.134


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.165.130.61
country_id: 1643084
description:
Feb  6 22:30:57 ait sshd[1448458]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.165.130.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.99
country_id: 1835841
description:
Feb  6 22:31:00 ait sshd[1448479]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.99 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.225.31.134
country_id: 6252001
description:
Feb  6 22:30:50 ait sshd[1448397]: Failed password for invalid user skm from 64.225.31.134 port 56692 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.225.31.134
country_id: 6252001
description:
Feb  6 22:30:48 ait sshd[1448397]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.225.31.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.16.85.102
country_id: 718075
description:
Feb  6 22:30:53 ait sshd[1448456]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.16.85.102 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.165.130.61
country_id: 1643084
description:
Feb  6 22:30:57 ait sshd[1448458]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.165.130.61


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.99
country_id: 1835841
description:
Feb  6 22:31:00 ait sshd[1448479]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.99


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.213.34.22
country_id: 298795
description:
Feb  6 22:31:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.213.34.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.22
country_id: 298795
description:
2025-02-06 22:31:38 dovecot_login authenticator failed for (ADMIN) [188.213.34.22]:46040: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.207.8.194
country_id: 690791
description:
Feb  6 22:31:47 ait sshd[1448730]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.207.8.194


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.69.23.79
country_id: 6251999
domain: elibrary-edu.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/cache.php||SC:/home/titlemas/public_html/elibrary-edu.net/images/images


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 158.69.23.79
country_id: 6251999
domain: elibrary-edu.net
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:22-31.158.69.23.79||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.191.131
country_id: 2017370
description:
Feb  6 22:32:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.191.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.191.131
country_id: 2017370
description:
2025-02-06 22:32:34 dovecot_plain authenticator failed for broadband-178-140-191-131.ip.moscow.rt.ru (chidatted) [178.140.191.131]:48083: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.207.8.194
country_id: 690791
description:
Feb  6 22:31:47 ait sshd[1448730]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.207.8.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
country_id: 226074
description:
Feb  6 22:32:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-02-06 22:32:58 dovecot_plain authenticator failed for ([41.220.3.113]) [41.220.3.101]:4081: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:22-33.35.92.116.235


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.26.65.51
country_id: 1814991
description:
Feb  6 22:33:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.26.65.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.26.65.51
country_id: 1814991
description:
2025-02-06 22:33:11 dovecot_plain authenticator failed for ([112.26.65.51]) [112.26.65.51]:45354: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.9.211
country_id: 1814991
description:
Feb  6 22:33:54 ait sshd[1449518]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.9.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
country_id: 1269750
description:
2025-02-06 22:34:12 dovecot_login authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:55660: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.32.11.3
country_id: 1814991
description:
2025-02-06 22:34:18 dovecot_plain authenticator failed for ([119.32.11.3]) [119.32.11.3]:25985: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.51.129.5
country_id: 6252001
description:
Feb  6 22:33:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.51.129.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.111.59.146
country_id: 6252001
description:
2025-02-06 22:33:53 dovecot_plain authenticator failed for ([75.111.59.146]) [75.111.59.146]:32914: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.195.225.182
country_id: 1668284
description:
2025-02-06 22:34:05 dovecot_plain authenticator failed for 123-195-225-182.dynamic.kbronet.com.tw [123.195.225.182]:37148: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.51.129.5
country_id: 6252001
description:
2025-02-06 22:33:53 dovecot_plain authenticator failed for 206-51-129-5.nktelco.net [206.51.129.5]:58923: 535 Incorrect authentication data (set_id=eng19a00097y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.20.137
country_id: 3175395
description:
2025-02-06 22:34:03 dovecot_login authenticator failed for ([2.192.20.137]) [2.192.20.137]:34626: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
country_id: 3469034
description:
Feb  6 22:34:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.111.59.146
country_id: 6252001
description:
Feb  6 22:33:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.111.59.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.134.3.252
country_id: 6252001
description:
Feb  6 22:34:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.134.3.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-02-06 22:34:14 dovecot_plain authenticator failed for ([196.191.212.226]) [213.55.85.202]:3024: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.3.252
country_id: 6252001
description:
2025-02-06 22:34:05 dovecot_plain authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:53134: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.195.225.182
country_id: 1668284
description:
Feb  6 22:34:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.195.225.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Feb  6 22:34:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-02-06 22:34:38 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (oluvers) [87.103.126.54]:46824: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.3.140.34
country_id: 1562822
description:
Feb  6 22:34:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.3.140.34 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.9.211
country_id: 1814991
description:
Feb  6 22:33:54 ait sshd[1449518]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.9.211


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.192.20.137
country_id: 3175395
description:
Feb  6 22:34:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.192.20.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.99
country_id: 1269750
description:
Feb  6 22:34:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
country_id: 337996
description:
Feb  6 22:34:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.32.11.3
country_id: 1814991
description:
Feb  6 22:34:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.32.11.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
country_id: 3469034
description:
2025-02-06 22:34:24 dovecot_plain authenticator failed for (18776174254.telemar.net.br) [187.76.174.254]:54521: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
country_id: 6252001
description:
Feb  6 22:35:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
country_id: 6252001
description:
2025-02-06 22:35:19 dovecot_login authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:51757: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.180.162.23
country_id: 1814991
description:
2025-02-06 22:35:24 dovecot_plain authenticator failed for ([42.180.162.23]) [42.180.162.23]:53909: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.82.20.241
country_id: 1819730
description:
Feb  6 22:35:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.82.20.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
country_id: 1819730
description:
2025-02-06 22:35:36 dovecot_plain authenticator failed for 202-82-20-241.static.imsbiz.com [202.82.20.241]:64146: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.3.140.34
country_id: 1562822
description:
2025-02-06 22:34:46 dovecot_plain authenticator failed for ([117.3.140.34]) [117.3.140.34]:41470: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.122.255.6
country_id: 1835841
description:
Feb  6 22:34:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.122.255.6 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.69.23.79
country_id: 6251999
domain: aitedu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/cache.php||SC:/home/titlemas/public_html/AITEDU.US/images/images


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 158.69.23.79
country_id: 6251999
domain: aitedu.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:22-35.158.69.23.79||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.122.255.6
country_id: 1835841
description:
2025-02-06 22:34:59 dovecot_login authenticator failed for ([58.122.255.6]) [58.122.255.6]:47124: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.180.162.23
country_id: 1814991
description:
Feb  6 22:35:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.180.162.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.3
country_id: 99237
description:
2025-02-06 22:36:40 dovecot_login authenticator failed for ([65.20.233.3]) [65.20.233.3]:56674: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.97
country_id: 99237
description:
Feb  6 22:36:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.33.74.81
country_id: 3469034
description:
2025-02-06 22:36:27 dovecot_login authenticator failed for (hospitalperpetuosocorro.static.gvt.net.br) [191.33.74.81]:55148: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.46.203.158
country_id: 1835841
description:
Feb  6 22:36:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.46.203.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.126.123.170
country_id: 2750405
description:
Feb  6 22:36:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.126.123.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.243.75.130
country_id: 3469034
description:
2025-02-06 22:36:16 dovecot_plain authenticator failed for 191-243-75-130.telecomconectividade.net.br [191.243.75.130]:34258: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
country_id: 294640
description:
2025-02-06 22:36:38 dovecot_plain authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:50096: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.233.3
country_id: 99237
description:
Feb  6 22:36:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.233.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.46.203.158
country_id: 1835841
description:
2025-02-06 22:36:40 dovecot_plain authenticator failed for ([211.46.203.158]) [211.46.203.158]:37082: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.5.135
country_id: 2017370
description:
2025-02-06 22:36:28 dovecot_plain authenticator failed for ([46.44.5.135]) [46.44.5.135]:60640: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
country_id: 1835841
description:
Feb  6 22:35:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.201.45
country_id: 1814991
description:
Feb  6 22:36:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.201.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.44.5.135
country_id: 2017370
description:
Feb  6 22:36:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.44.5.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.243.75.130
country_id: 3469034
description:
Feb  6 22:36:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.243.75.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.166.239
country_id: 6252001
description:
2025-02-06 22:36:17 dovecot_login authenticator failed for (ADMIN) [181.214.166.239]:48972: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 81.208.105.234
country_id: 3175395
description:
Feb  6 22:36:28 ait sshd[1450625]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.208.105.234


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2025-02-06 22:35:54 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:57766: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.201.45
country_id: 1814991
description:
2025-02-06 22:36:04 dovecot_login authenticator failed for (45.201.33.36.adsl-pool.ah.cnuninet.net) [36.33.201.45]:60560: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.228.195.251
country_id: 1814991
description:
Feb  6 22:36:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.228.195.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.208.105.234
country_id: 3175395
description:
Feb  6 22:36:28 ait sshd[1450625]: pam_imunify(sshd:auth): [IM360_RBL] The IP 81.208.105.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
country_id: 294640
description:
Feb  6 22:36:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.228.195.251
country_id: 1814991
description:
2025-02-06 22:36:15 dovecot_login authenticator failed for ([116.228.195.251]) [116.228.195.251]:32121: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.33.74.81
country_id: 3469034
description:
Feb  6 22:36:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.33.74.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
country_id: 99237
description:
2025-02-06 22:36:26 dovecot_plain authenticator failed for ([65.20.191.97]) [65.20.191.97]:53055: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.126.123.170
country_id: 2750405
description:
2025-02-06 22:36:45 dovecot_login authenticator failed for d57e7baa.static.ziggozakelijk.nl (9Naq87xOu) [213.126.123.170]:4356: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 22:37:42 ait sshd[1451110]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 22:37:42 ait sshd[1451110]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 22:37:44 ait sshd[1451110]: Failed password for invalid user ijari from 185.187.50.49 port 40366 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 22:38:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.237.172
country_id: 6252001
description:
2025-02-06 22:38:54 dovecot_login authenticator failed for ([104.241.237.172]) [104.241.237.172]:50684: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.245.109.37
country_id: 1210997
description:
2025-02-06 22:38:55 dovecot_plain authenticator failed for ([103.245.109.37]) [103.245.109.37]:43104: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.176.249.35
country_id: 1835841
description:
2025-02-06 22:39:08 dovecot_login authenticator failed for ([112.176.249.35]) [112.176.249.35]:38298: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.70.166.51
country_id: 298795
description:
Feb  6 22:39:35 ait sshd[1451995]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.70.166.51  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.109.37
country_id: 1210997
description:
Feb  6 22:38:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.245.109.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.193.152.64
country_id: 1668284
description:
Feb  6 22:39:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.193.152.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.193.152.64
country_id: 1668284
description:
2025-02-06 22:39:10 dovecot_plain authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:57904: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.70.166.51
country_id: 298795
description:
Feb  6 22:39:35 ait sshd[1451995]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.70.166.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.237.172
country_id: 6252001
description:
Feb  6 22:38:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.237.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.176.249.35
country_id: 1835841
description:
Feb  6 22:39:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.176.249.35 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-39.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.117.195
country_id: 1814991
description:
Feb  6 22:40:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.117.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.41.109.250
country_id: 1861060
description:
2025-02-06 22:40:14 dovecot_login authenticator failed for p278251-obmd01.tokyo.ocn.ne.jp [180.41.109.250]:54286: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.141.194.159
country_id: 1835841
description:
Feb  6 22:40:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.141.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
country_id: 1835841
description:
2025-02-06 22:40:37 dovecot_login authenticator failed for ([210.206.24.238]) [210.206.24.234]:59719: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
country_id: 2017370
description:
2025-02-06 22:40:33 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:55246: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.175.12.33
country_id: 1269750
description:
Feb  6 22:39:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.175.12.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.12.33
country_id: 1269750
description:
2025-02-06 22:40:00 dovecot_plain authenticator failed for ([122.175.12.33]) [122.175.12.33]:53769: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.114.194.82
country_id: 1814991
description:
Feb  6 22:40:13 ait sshd[1452250]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.114.194.82


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.117.195
country_id: 1814991
description:
2025-02-06 22:40:14 dovecot_plain authenticator failed for ([112.91.117.195]) [112.91.117.195]:40726: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.141.194.159
country_id: 1835841
description:
2025-02-06 22:40:18 dovecot_plain authenticator failed for ([121.141.194.159]) [121.141.194.159]:38660: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
country_id: 2017370
description:
Feb  6 22:40:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.206.24.234
country_id: 1835841
description:
Feb  6 22:40:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.206.24.234 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:22-40.35.92.116.235


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.53.114.86
country_id: 6252001
description:
Feb  6 22:40:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.53.114.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.53.114.86
country_id: 6252001
description:
2025-02-06 22:40:50 dovecot_login authenticator failed for syn-067-053-114-086.biz.spectrum.com [67.53.114.86]:51387: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 64.227.171.131
country_id: 1269750
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:22-41.64.227.171.131


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.252.152.214
country_id: 3017382
description:
Feb  6 22:41:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.252.152.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.106.15
country_id: 6252001
description:
Feb  6 22:42:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.106.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.106.15
country_id: 6252001
description:
2025-02-06 22:42:13 dovecot_login authenticator failed for pool-108-18-106-15.washdc.fios.verizon.net [108.18.106.15]:38674: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.161.166.113
country_id: 3017382
description:
Feb  6 22:42:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.161.166.113 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.205
country_id: 1814991
description:
Feb  6 22:42:41 ait sshd[1453112]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.205  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
country_id: 3175395
description:
2025-02-06 22:42:03 dovecot_login authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:43276: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.52.202.92
country_id: 1814991
description:
Feb  6 22:42:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.52.202.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2025-02-06 22:42:35 dovecot_plain authenticator failed for ([196.188.187.85]) [196.188.187.85]:38772: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.161.166.113
country_id: 3017382
description:
2025-02-06 22:42:39 dovecot_login authenticator failed for static-css-csu-166113.business.bouyguestelecom.com [176.161.166.113]:57501: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.212.219
country_id: 3175395
description:
Feb  6 22:42:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.212.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.124.54.6
country_id: 3469034
description:
Feb  6 22:42:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.124.54.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.249.224.46
country_id: 2661886
description:
Feb  6 22:42:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.249.224.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.52.202.92
country_id: 1814991
description:
2025-02-06 22:42:09 dovecot_plain authenticator failed for ([123.52.202.92]) [123.52.202.92]:53256: 535 Incorrect authentication data (set_id=ads22b00248y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.249.224.46
country_id: 2661886
description:
2025-02-06 22:42:41 dovecot_plain authenticator failed for c83-249-224-46.bredband.tele2.se (cessibry) [83.249.224.46]:38458: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.252.152.214
country_id: 3017382
description:
2025-02-06 22:41:46 dovecot_plain authenticator failed for ([193.252.152.214]) [193.252.152.214]:44172: 535 Incorrect authentication data (set_id=ads22b00248y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.46.7
country_id: 1819730
description:
Feb  6 22:42:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.46.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.161.119.194
country_id: 3144096
description:
2025-02-06 22:42:39 dovecot_plain authenticator failed for 194.79-161-119.customer.lyse.net (lotli) [79.161.119.194]:56757: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.205
country_id: 1814991
description:
Feb  6 22:42:41 ait sshd[1453112]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.175.76.146
country_id: 6252001
description:
Feb  6 22:42:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.175.76.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.124.54.6
country_id: 3469034
description:
2025-02-06 22:42:06 dovecot_login authenticator failed for ([179.124.54.6]) [179.124.54.6]:60138: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.7
country_id: 1819730
description:
2025-02-06 22:42:28 dovecot_login authenticator failed for 007.46.246.220.static.netvigator.com [220.246.46.7]:62778: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.188.187.85
country_id: 337996
description:
Feb  6 22:42:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.188.187.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.161.119.194
country_id: 3144096
description:
Feb  6 22:42:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.161.119.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 22:42:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.62.184.137
country_id: 1814991
description:
Feb  6 22:42:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.62.184.137 has been locked due to Imunify RBL


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.205
country_id: 1814991
description:
Feb  6 22:43:02 ait sshd[1453112]: error: maximum authentication attempts exceeded for root from 218.92.0.205 port 7792 ssh2 [preauth]


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.205
country_id: 1814991
description:
Feb  6 22:42:49 ait sshd[1453112]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.157.124.84
country_id: 1814991
description:
Feb  6 22:43:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.157.124.84 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.62.164
country_id: 1880251
description:
47.128.62.164 - - [06/Feb/2025:22:43:30 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10896880 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/the-complete-facebook-ads-course-beginner-to-advanced/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.62.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.72.156
country_id: 2017370
description:
2025-02-06 22:42:48 dovecot_login authenticator failed for (95-165-72-156.dynamic.spd-mgts.ru) [95.165.72.156]:56064: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.116.226
country_id: 1814991
description:
Feb  6 22:42:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.116.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.194.21
country_id: 1562822
description:
2025-02-06 22:43:07 dovecot_plain authenticator failed for ([103.48.194.21]) [103.48.194.21]:40682: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.116.226
country_id: 1814991
description:
2025-02-06 22:42:53 dovecot_plain authenticator failed for ([117.176.116.226]) [117.176.116.226]:39444: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.48.194.21
country_id: 1562822
description:
Feb  6 22:43:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.48.194.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.27.4.98
country_id: 1814991
description:
Feb  6 22:43:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.27.4.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
country_id: 6252001
description:
2025-02-06 22:42:45 dovecot_plain authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:60572: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.111
country_id: 3469034
description:
2025-02-06 22:42:49 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.111]:57537: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.43.202.110
country_id: 2017370
description:
2025-02-06 22:43:39 dovecot_login authenticator failed for ([31.43.202.110]) [31.43.202.110]:33109: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 22:43:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.72.156
country_id: 2017370
description:
Feb  6 22:42:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.72.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.111
country_id: 3469034
description:
Feb  6 22:42:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.239.37.36
country_id: 1835841
description:
Feb  6 22:42:51 ait sshd[1453191]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.239.37.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.62.184.137
country_id: 1814991
description:
2025-02-06 22:43:01 dovecot_plain authenticator failed for ([119.62.184.137]) [119.62.184.137]:54401: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.157.124.84
country_id: 1814991
description:
2025-02-06 22:43:32 dovecot_login authenticator failed for (hn.kd.ny.adsl) [219.157.124.84]:48067: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.43.202.110
country_id: 2017370
description:
Feb  6 22:43:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.43.202.110 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.239.37.36
country_id: 1835841
description:
Feb  6 22:42:51 ait sshd[1453191]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.239.37.36


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.27.4.98
country_id: 1814991
description:
2025-02-06 22:43:16 dovecot_login authenticator failed for (98.4.27.218.adsl-pool.jlccptt.net.cn) [218.27.4.98]:62288: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.224.89.112
country_id: 690791
description:
Feb  6 22:44:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.224.89.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.109.211.44
country_id: 1821275
description:
2025-02-06 22:44:19 dovecot_plain authenticator failed for nz211l44.bb27109.ctm.net [27.109.211.44]:49769: 535 Incorrect authentication data (set_id=paakow2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.144.140
country_id: 1814991
description:
Feb  6 22:44:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.144.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.144.140
country_id: 1814991
description:
2025-02-06 22:44:30 dovecot_plain authenticator failed for ([112.15.144.140]) [112.15.144.140]:45360: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2025-02-06 22:44:36 dovecot_plain authenticator failed for ([182.239.78.124]) [182.239.78.124]:48550: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.21.36.188
country_id: 1814991
description:
2025-02-06 22:43:48 dovecot_login authenticator failed for ([210.21.36.188]) [210.21.36.188]:58160: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.215.126.22
country_id: 1814991
description:
Feb  6 22:44:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.215.126.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.233.247
country_id: 1835841
description:
2025-02-06 22:43:54 dovecot_plain authenticator failed for ([221.149.233.247]) [221.149.233.247]:60947: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.199.89
country_id: 1814991
description:
2025-02-06 22:44:04 dovecot_login authenticator failed for ([112.102.199.89]) [112.102.199.89]:60183: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.26.205.154
country_id: 1814991
description:
2025-02-06 22:44:19 dovecot_plain authenticator failed for (154.205.26.218.internet.sx.cn) [218.26.205.154]:39533: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.239.78.124
country_id: 1819730
description:
Feb  6 22:44:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.239.78.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.21.36.188
country_id: 1814991
description:
Feb  6 22:43:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.21.36.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.149.233.247
country_id: 1835841
description:
Feb  6 22:43:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.149.233.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.179.104
country_id: 6252001
description:
2025-02-06 22:44:31 dovecot_plain authenticator failed for ([23.94.179.104]) [23.94.179.104]:47836: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.224.89.112
country_id: 690791
description:
2025-02-06 22:44:35 dovecot_login authenticator failed for (112.89.224.159.triolan.net) [159.224.89.112]:45582: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.223.203
country_id: 1835841
description:
Feb  6 22:44:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.223.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.223.203
country_id: 1835841
description:
2025-02-06 22:44:37 dovecot_plain authenticator failed for ([210.99.223.203]) [210.99.223.203]:46100: 535 Incorrect authentication data (set_id=paakow2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 22:44:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.26.205.154
country_id: 1814991
description:
Feb  6 22:44:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.26.205.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.21.205.4
country_id: 6252001
description:
Feb  6 22:44:21 ait sshd[1454070]: pam_imunify(sshd:auth): [IM360_RBL] The IP 129.21.205.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.177.112
country_id: 1861060
description:
Feb  6 22:44:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.177.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-02-06 22:44:15 dovecot_plain authenticator failed for ([190.121.193.126]) [190.121.193.126]:44810: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.121.193.126
country_id: 3595528
description:
Feb  6 22:44:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.121.193.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.17.165
country_id: 1269750
description:
Feb  6 22:44:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.17.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.177.112
country_id: 1861060
description:
2025-02-06 22:44:15 dovecot_login authenticator failed for ([180.7.177.112]) [180.7.177.112]:51412: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.109.211.44
country_id: 1821275
description:
Feb  6 22:44:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.109.211.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.179.104
country_id: 6252001
description:
Feb  6 22:44:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.179.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.27.234.178
country_id: 6252001
description:
Feb  6 22:44:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.27.234.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.102.199.89
country_id: 1814991
description:
Feb  6 22:44:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.102.199.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.215.126.22
country_id: 1814991
description:
2025-02-06 22:44:10 dovecot_plain authenticator failed for ([60.215.126.22]) [60.215.126.22]:39594: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.27.234.178
country_id: 6252001
description:
2025-02-06 22:44:32 dovecot_login authenticator failed for ([71.27.234.178]) [71.27.234.178]:40738: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 129.21.205.4
country_id: 6252001
description:
Feb  6 22:44:21 ait sshd[1454070]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.21.205.4


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.17.165
country_id: 1269750
description:
2025-02-06 22:44:17 dovecot_plain authenticator failed for (abts-north-static-165.17.160.122.airtelbroadband.in) [122.160.17.165]:33736: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.43.208.134
country_id: 1814991
description:
Feb  6 22:45:42 ait sshd[1454813]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.43.208.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
country_id: 1835841
description:
Feb  6 22:44:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.43.208.134
country_id: 1814991
description:
Feb  6 22:45:42 ait sshd[1454813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.43.208.134


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2025-02-06 22:44:48 dovecot_login authenticator failed for ([218.149.235.152]) [218.149.235.152]:56028: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 22:45:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.48.181
country_id: 2017370
description:
Feb  6 22:46:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.48.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.48.181
country_id: 2017370
description:
2025-02-06 22:46:34 dovecot_plain authenticator failed for broadband-37-110-48-181.ip.moscow.rt.ru [37.110.48.181]:56814: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.41.184.10
country_id: 1814991
description:
2025-02-06 22:46:45 dovecot_plain authenticator failed for ([59.41.184.10]) [59.41.184.10]:38658: 535 Incorrect authentication data (set_id=agbozume1@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.21.221
country_id: 1880251
description:
47.128.21.221 - - [06/Feb/2025:22:46:16 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10511050 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/?page_id=can-you-buy-viagra-in-northern-ireland" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.21.221


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-02-06 22:46:25 dovecot_plain authenticator failed for ([196.191.142.67]) [196.191.142.67]:50242: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.142.67
country_id: 337996
description:
Feb  6 22:46:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.142.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.41.184.10
country_id: 1814991
description:
Feb  6 22:46:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.41.184.10 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.43.208.134
country_id: 1814991
description:
Feb  6 22:45:44 ait sshd[1454813]: Disconnected from invalid user bb 121.43.208.134 port 59718 [preauth]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.38.235.47
country_id: 2658434
description:
Feb  6 22:46:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.38.235.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.38.235.47
country_id: 2658434
description:
2025-02-06 22:46:12 dovecot_login authenticator failed for adsl-178-38-235-47.adslplus.ch [178.38.235.47]:56860: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.239.187.13
country_id: 1819730
description:
Feb  6 22:46:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.239.187.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.239.187.13
country_id: 1819730
description:
2025-02-06 22:46:22 dovecot_login authenticator failed for ([20.239.187.13]) [20.239.187.13]:38766: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
country_id: 2510769
description:
2025-02-06 22:47:26 dovecot_plain authenticator failed for (azidamoil) [207.188.157.230]:43151: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.236.90
country_id: 6252001
description:
Feb  6 22:47:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.236.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.3.16.128
country_id: 2658434
description:
Feb  6 22:47:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.3.16.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.3.16.128
country_id: 2658434
description:
2025-02-06 22:47:23 dovecot_plain authenticator failed for 128.16.3.213.static.wline.lns.sme.cust.swisscom.ch (undirgele) [213.3.16.128]:42404: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.167.140.130
country_id: 2017370
description:
Feb  6 22:47:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.167.140.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.31.93.229
country_id: 1814991
description:
Feb  6 22:47:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.31.93.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.194.128.158
country_id: 1269750
description:
Feb  6 22:46:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.194.128.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
country_id: 1269750
description:
2025-02-06 22:46:54 dovecot_plain authenticator failed for ([14.194.128.158]) [14.194.128.158]:50858: 535 Incorrect authentication data (set_id=agbozume1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.87.49.250
country_id: 1814991
description:
Feb  6 22:47:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.87.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.236.90
country_id: 6252001
description:
2025-02-06 22:47:17 dovecot_login authenticator failed for ([104.241.236.90]) [104.241.236.90]:56790: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.87.49.250
country_id: 1814991
description:
2025-02-06 22:47:19 dovecot_login authenticator failed for ([222.87.49.250]) [222.87.49.250]:52965: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.97.98
country_id: 1269750
description:
Feb  6 22:47:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.97.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.97.98
country_id: 1269750
description:
2025-02-06 22:47:44 dovecot_plain authenticator failed for (undefined.hostname.localhost) [103.90.97.98]:40160: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.74
country_id: 1835841
description:
Feb  6 22:46:54 ait sshd[1455171]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.74 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.227.152.250
country_id: 1814991
description:
Feb  6 22:47:22 ait sshd[1455256]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.227.152.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
country_id: 2510769
description:
Feb  6 22:47:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.167.140.130
country_id: 2017370
description:
2025-02-06 22:47:27 dovecot_login authenticator failed for (109-167-140-130.westcall.net) [109.167.140.130]:54540: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.74
country_id: 1835841
description:
Feb  6 22:46:54 ait sshd[1455171]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.74


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.93.229
country_id: 1814991
description:
2025-02-06 22:47:32 dovecot_login authenticator failed for ([112.31.93.229]) [112.31.93.229]:46633: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 22:48:13 ait sshd[1455643]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 22:48:13 ait sshd[1455643]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.254.115
country_id: 2661886
description:
2025-02-06 22:48:40 dovecot_plain authenticator failed for 217-215-254-115-no2460.tbcn.telia.com (quise) [217.215.254.115]:54108: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.255.252.44
country_id: 1814991
description:
Feb  6 22:47:46 ait sshd[1455437]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.255.252.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.215.254.115
country_id: 2661886
description:
Feb  6 22:48:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.215.254.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.74
country_id: 1835841
description:
Feb  6 22:48:39 ait sshd[1455825]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.61.130
country_id: 6252001
description:
2025-02-06 22:47:49 dovecot_login authenticator failed for (ADMIN) [191.101.61.130]:39260: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.77.213.29
country_id: 174982
description:
Feb  6 22:47:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.77.213.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.241.150
country_id: 1814991
description:
2025-02-06 22:48:41 dovecot_plain authenticator failed for ([61.143.241.150]) [61.143.241.150]:51575: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.255.252.44
country_id: 1814991
description:
Feb  6 22:47:46 ait sshd[1455437]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.255.252.44


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.231.163.154
country_id: 1210997
description:
Feb  6 22:48:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.231.163.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.241.150
country_id: 1814991
description:
Feb  6 22:48:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.241.150 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:22-48.35.92.116.235


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.74
country_id: 1835841
description:
Feb  6 22:48:39 ait sshd[1455825]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.74  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.101.61.130
country_id: 6252001
description:
Feb  6 22:47:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.101.61.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.77.213.29
country_id: 174982
description:
2025-02-06 22:47:53 dovecot_plain authenticator failed for ([5.77.213.29]) [5.77.213.29]:49260: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.163.154
country_id: 1210997
description:
2025-02-06 22:48:27 dovecot_plain authenticator failed for ([103.231.163.154]) [103.231.163.154]:62649: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 22:49:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.165.203
country_id: 1814991
description:
2025-02-06 22:49:07 dovecot_plain authenticator failed for ([183.236.165.203]) [183.236.165.203]:47694: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.8.10.40
country_id: 2017370
description:
Feb  6 22:49:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.8.10.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.128.162.146
country_id: 1814991
description:
Feb  6 22:49:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.128.162.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.228.220
country_id: 1814991
description:
Feb  6 22:49:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.228.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.165.203
country_id: 1814991
description:
Feb  6 22:49:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.165.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.128.162.146
country_id: 1814991
description:
2025-02-06 22:49:33 dovecot_plain authenticator failed for ([27.128.162.146]) [27.128.162.146]:44060: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.228.220
country_id: 1814991
description:
2025-02-06 22:49:42 dovecot_plain authenticator failed for ([60.174.228.220]) [60.174.228.220]:37817: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.69.30.93
country_id: 1835841
description:
Feb  6 22:50:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.69.30.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.69.30.93
country_id: 1835841
description:
2025-02-06 22:50:25 dovecot_login authenticator failed for ([180.69.30.93]) [180.69.30.93]:39708: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.238.213
country_id: 3017382
description:
Feb  6 22:50:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.238.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.252.204.203
country_id: 1835841
description:
Feb  6 22:49:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.252.204.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
country_id: 2017370
description:
2025-02-06 22:50:43 dovecot_plain authenticator failed for (13-78-123-185.host.cirex.ru) [185.123.78.13]:55374: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
country_id: 1210997
description:
2025-02-06 22:50:18 dovecot_login authenticator failed for ([103.103.35.130]) [103.103.35.130]:60441: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
country_id: 2017370
description:
Feb  6 22:50:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.252.204.203
country_id: 1835841
description:
2025-02-06 22:49:53 dovecot_plain authenticator failed for ([1.252.204.203]) [1.252.204.203]:65259: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.184.143.93
country_id: 1814991
description:
Feb  6 22:50:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.184.143.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.184.143.93
country_id: 1814991
description:
2025-02-06 22:50:08 dovecot_plain authenticator failed for ([39.184.143.93]) [39.184.143.93]:54464: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.36.238.213
country_id: 3017382
description:
2025-02-06 22:50:44 dovecot_plain authenticator failed for ip213.ip-54-36-238.eu [54.36.238.213]:36426: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.132.7.7
country_id: 3996063
description:
Feb  6 22:50:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.132.7.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.132.7.7
country_id: 3996063
description:
2025-02-06 22:50:05 dovecot_login authenticator failed for (customer-PUE-MCA-7-7.megared.net.mx) [201.132.7.7]:40645: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.69.157.215
country_id: 3175395
description:
Feb  6 22:51:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.69.157.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
country_id: 3175395
description:
2025-02-06 22:51:37 dovecot_login authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:55497: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.222
country_id: 1819730
description:
Feb  6 22:51:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.222
country_id: 1819730
description:
2025-02-06 22:51:39 dovecot_login authenticator failed for (m121-202-205-222.smartone.com) [121.202.205.222]:56988: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.134.78.162
country_id: 1814991
description:
Feb  6 22:50:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.134.78.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.162
country_id: 1814991
description:
2025-02-06 22:50:51 dovecot_plain authenticator failed for ([36.134.78.162]) [36.134.78.162]:47889: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.82.135.154
country_id: 1814991
description:
Feb  6 22:50:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.82.135.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.112.193
country_id: 3469034
description:
2025-02-06 22:51:36 dovecot_login authenticator failed for 131.108.112.193.pontonetassai.com.br [131.108.112.193]:51609: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.151.45.136
country_id: 1814991
description:
Feb  6 22:51:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.151.45.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.177.106
country_id: 2275384
description:
Feb  6 22:51:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.177.106 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.43.208.134
country_id: 1814991
description:
Feb  6 22:51:01 ait sshd[1456717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.43.208.134


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.212.219
country_id: 3175395
description:
Feb  6 22:51:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.212.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.212.206
country_id: 1835841
description:
Feb  6 22:51:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.43.208.134
country_id: 1814991
description:
Feb  6 22:51:01 ait sshd[1456717]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.43.208.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.177.106
country_id: 2275384
description:
2025-02-06 22:51:03 dovecot_plain authenticator failed for ([196.250.177.106]) [196.250.177.106]:47291: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.148.23.180
country_id: 1282988
description:
[2025-02-06 22:51:22 +0100] info [webmaild] 103.148.23.180 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.108.112.193
country_id: 3469034
description:
Feb  6 22:51:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.108.112.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2025-02-06 22:51:38 dovecot_plain authenticator failed for ([211.169.212.206]) [211.169.212.206]:63778: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.82.135.154
country_id: 1814991
description:
2025-02-06 22:50:58 dovecot_plain authenticator failed for ([1.82.135.154]) [1.82.135.154]:48416: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.69.157.215
country_id: 3175395
description:
2025-02-06 22:51:25 dovecot_plain authenticator failed for ([151.69.157.215]) [151.69.157.215]:39851: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.221.56
country_id: 1814991
description:
Feb  6 22:52:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.221.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.50.67.114
country_id: 3469034
description:
Feb  6 22:52:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.50.67.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.151.45.136
country_id: 1814991
description:
2025-02-06 22:51:46 dovecot_plain authenticator failed for ([182.151.45.136]) [182.151.45.136]:51888: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.110
country_id: 1814991
description:
Feb  6 22:52:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
country_id: 614540
description:
2025-02-06 22:52:25 dovecot_login authenticator failed for ([2.57.219.6]) [2.57.219.2]:53720: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.50.137.84
country_id: 1814991
description:
Feb  6 22:52:38 ait sshd[1457363]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.50.137.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.67.114
country_id: 3469034
description:
2025-02-06 22:52:40 dovecot_plain authenticator failed for (187-50-150-169.customer.tdatabrasil.net.br) [187.50.67.114]:36909: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
country_id: 3469034
description:
Feb  6 22:51:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.89.72
country_id: 1814991
description:
2025-02-06 22:52:00 dovecot_plain authenticator failed for ([112.132.89.72]) [112.132.89.72]:48466: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.156.122
country_id: 1814991
description:
Feb  6 22:52:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.156.122 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.50.137.84
country_id: 1814991
description:
Feb  6 22:52:38 ait sshd[1457363]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.137.84


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.89.72
country_id: 1814991
description:
Feb  6 22:51:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.89.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.156.122
country_id: 1814991
description:
2025-02-06 22:52:28 dovecot_login authenticator failed for ([120.236.156.122]) [120.236.156.122]:47969: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.221.56
country_id: 1814991
description:
2025-02-06 22:52:10 dovecot_login authenticator failed for ([183.236.221.56]) [183.236.221.56]:52110: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
country_id: 614540
description:
Feb  6 22:52:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.110
country_id: 1814991
description:
2025-02-06 22:52:27 dovecot_plain authenticator failed for (110.20.167.124.adsl-pool.sx.cn) [124.167.20.110]:35992: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.107.141.226
country_id: 1814991
description:
Feb  6 22:52:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.107.141.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.26.63.158
country_id: 1814991
description:
Feb  6 22:51:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.26.63.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.190.181
country_id: 6252001
description:
2025-02-06 22:51:49 dovecot_login authenticator failed for ([47.149.190.181]) [47.149.190.181]:56188: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
country_id: 3469034
description:
2025-02-06 22:51:52 dovecot_login authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:29400: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.197.86
country_id: 1819730
description:
Feb  6 22:51:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.197.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.197.86
country_id: 1819730
description:
2025-02-06 22:51:56 dovecot_plain authenticator failed for ([121.202.197.86]) [121.202.197.86]:42875: 535 Incorrect authentication data (set_id=wilfri17@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.190.181
country_id: 6252001
description:
Feb  6 22:51:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.190.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.30.217.31
country_id: 2017370
description:
2025-02-06 22:52:06 dovecot_plain authenticator failed for 95-30-217-31.broadband.corbina.ru [95.30.217.31]:54902: 535 Incorrect authentication data (set_id=wilfri17)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.199.19
country_id: 895949
description:
Feb  6 22:52:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.199.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.39.187.16
country_id: 3469034
description:
2025-02-06 22:52:23 dovecot_login authenticator failed for ([189.39.187.16]) [189.39.187.16]:33272: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.30.217.31
country_id: 2017370
description:
Feb  6 22:52:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.30.217.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.26.63.158
country_id: 1814991
description:
2025-02-06 22:51:55 dovecot_login authenticator failed for ([36.26.63.158]) [36.26.63.158]:39901: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.199.19
country_id: 895949
description:
2025-02-06 22:52:10 dovecot_plain authenticator failed for (ppp19-lumwana.zamnet.zm) [196.46.199.19]:52195: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.39.187.16
country_id: 3469034
description:
Feb  6 22:52:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.39.187.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.107.141.226
country_id: 1814991
description:
2025-02-06 22:52:42 dovecot_login authenticator failed for ([113.107.141.226]) [113.107.141.226]:42016: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.227.152.250
country_id: 1814991
description:
Feb  6 22:51:53 ait sshd[1457050]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.227.152.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.193.121.147
country_id: 690791
description:
Feb  6 22:52:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.193.121.147 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.175.33.240
country_id: 6252001
description:
Feb  6 22:53:24 ait sshd[1457769]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.175.33.240


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.113.101
country_id: 1835841
description:
2025-02-06 22:52:51 dovecot_login authenticator failed for ([211.48.113.101]) [211.48.113.101]:54686: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.197.68.116
country_id: 1880251
description:
Feb  6 22:53:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.197.68.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.175.33.240
country_id: 6252001
description:
Feb  6 22:53:24 ait sshd[1457769]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.175.33.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.66
country_id: 1036973
description:
Feb  6 22:53:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2025-02-06 22:53:36 dovecot_plain authenticator failed for ([196.28.226.66]) [196.28.226.66]:34457: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.152.163
country_id: 3374766
description:
2025-02-06 22:52:56 dovecot_login authenticator failed for ([102.207.152.163]) [102.207.152.163]:39410: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.227.152.250
country_id: 1814991
description:
Feb  6 22:53:19 ait sshd[1457706]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.227.152.250


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.227.152.250
country_id: 1814991
description:
Feb  6 22:53:20 ait sshd[1457706]: Failed password for invalid user vie from 121.227.152.250 port 33180 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2025-02-06 22:52:54 dovecot_plain authenticator failed for ([121.179.93.147]) [121.179.93.147]:56042: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
country_id: 1835841
description:
Feb  6 22:52:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.121.147
country_id: 690791
description:
2025-02-06 22:52:53 dovecot_login authenticator failed for (82.193.121.147.ipnet.ua) [82.193.121.147]:60956: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.207.152.163
country_id: 3374766
description:
Feb  6 22:52:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.207.152.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.68.116
country_id: 1880251
description:
2025-02-06 22:53:10 dovecot_plain authenticator failed for (116.68.197.124.unknown.m1.com.sg) [124.197.68.116]:45926: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.113.101
country_id: 1835841
description:
Feb  6 22:52:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.113.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.193.190.105
country_id: 1643084
description:
Feb  6 22:54:27 ait sshd[1458076]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.193.190.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.161.52.149
country_id: 1814991
description:
Feb  6 22:54:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.161.52.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.72.156
country_id: 2017370
description:
Feb  6 22:54:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.72.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.72.156
country_id: 2017370
description:
2025-02-06 22:54:39 dovecot_plain authenticator failed for ([95.165.72.156]) [95.165.72.156]:43302: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.118.234
country_id: 1880251
description:
Feb  6 22:53:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.199.118.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.222.136.32
country_id: 6251999
description:
Feb  6 22:54:01 ait sshd[1458000]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.222.136.32


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.105.113
country_id: 3469034
description:
Feb  6 22:54:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.105.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.105.113
country_id: 3469034
description:
2025-02-06 22:54:11 dovecot_plain authenticator failed for (177-174-105-113.user.vivozap.com.br) [177.174.105.113]:38296: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.75.243.124
country_id: 130758
description:
Feb  6 22:54:42 ait sshd[1458237]: pam_imunify(sshd:auth): [IM360_RBL] The IP 37.75.243.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.199.5.231
country_id: 1835841
description:
2025-02-06 22:53:56 dovecot_plain authenticator failed for ([211.199.5.231]) [211.199.5.231]:51202: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2025-02-06 22:53:58 dovecot_plain authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:14918: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
country_id: 1814991
description:
2025-02-06 22:54:36 dovecot_login authenticator failed for ([220.161.52.149]) [220.161.52.149]:54872: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 37.75.243.124
country_id: 130758
description:
Feb  6 22:54:42 ait sshd[1458237]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.75.243.124


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.105.206
country_id: 1814991
description:
Feb  6 22:54:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.105.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
country_id: 1814991
description:
2025-02-06 22:54:34 dovecot_login authenticator failed for ([60.173.105.206]) [60.173.105.206]:44496: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.199.5.231
country_id: 1835841
description:
Feb  6 22:53:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.199.5.231 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-53.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.222.136.32
country_id: 6251999
description:
Feb  6 22:54:01 ait sshd[1458000]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.222.136.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.193.190.105
country_id: 1643084
description:
Feb  6 22:54:27 ait sshd[1458076]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.193.190.105 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.75.243.124
country_id: 130758
description:
Feb  6 22:54:45 ait sshd[1458237]: Disconnected from invalid user sas 37.75.243.124 port 56914 [preauth]


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 204.10.194.42
country_id: 2921044
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Borjaytechx||WPU:Borjaytechx||RSV:6.65||T:APACHE||MV:22-54.204.10.194.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
country_id: 1835841
description:
2025-02-06 22:55:30 dovecot_login authenticator failed for ([211.105.213.144]) [211.105.213.144]:36964: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.97.236.1
country_id: 3469034
description:
Feb  6 22:55:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.97.236.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.97.236.1
country_id: 3469034
description:
2025-02-06 22:55:35 dovecot_login authenticator failed for (ip-189-97-236-1.user.vivozap.com.br) [189.97.236.1]:57030: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2025-02-06 22:54:48 dovecot_login authenticator failed for syn-050-074-136-134.biz.spectrum.com [50.74.136.134]:34980: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.230
country_id: 1269750
description:
Feb  6 22:54:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.178.142
country_id: 3469034
description:
2025-02-06 22:55:02 dovecot_login authenticator failed for (187-50-178-142.customer.tdatabrasil.net.br) [187.50.178.142]:46581: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.158.171.3
country_id: 1814991
description:
Feb  6 22:55:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.158.171.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.43.208.134
country_id: 1814991
description:
Feb  6 22:55:24 ait sshd[1458599]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.43.208.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
country_id: 1835841
description:
Feb  6 22:55:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.14
country_id: 2635167
description:
2025-02-06 22:55:26 dovecot_login authenticator failed for (ADMIN) [98.159.234.14]:60142: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.110.120.96
country_id: 3469034
description:
2025-02-06 22:54:50 dovecot_plain authenticator failed for ([189.110.120.96]) [189.110.120.96]:45282: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.50.178.142
country_id: 3469034
description:
Feb  6 22:55:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.50.178.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.230
country_id: 1269750
description:
2025-02-06 22:55:01 dovecot_plain authenticator failed for (nsg-corporate-230.228.187.122.airtel.in) [122.187.228.230]:37134: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.255.221
country_id: 1835841
description:
Feb  6 22:55:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.255.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.255.221
country_id: 1835841
description:
2025-02-06 22:55:15 dovecot_login authenticator failed for ([218.146.255.221]) [218.146.255.221]:63875: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.140.244.144
country_id: 1835841
description:
Feb  6 22:55:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.140.244.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.74.136.134
country_id: 6252001
description:
Feb  6 22:54:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.74.136.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.110.120.96
country_id: 3469034
description:
Feb  6 22:54:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.110.120.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.158.171.3
country_id: 1814991
description:
2025-02-06 22:55:17 dovecot_plain authenticator failed for ([61.158.171.3]) [61.158.171.3]:47633: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.43.208.134
country_id: 1814991
description:
Feb  6 22:55:24 ait sshd[1458599]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.43.208.134


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.72.4.98
country_id: 2029969
description:
2025-02-06 22:56:27 dovecot_login authenticator failed for ([112.72.4.98]) [112.72.4.98]:46184: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.245.238
country_id: 3469034
description:
2025-02-06 22:56:37 dovecot_login authenticator failed for (186-200-63-57.customer.tdatabrasil.net.br) [187.50.245.238]:44099: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.52.109
country_id: 732800
description:
Feb  6 22:56:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
country_id: 3469034
description:
Feb  6 22:56:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.106.49.149
country_id: 3932488
description:
Feb  6 22:56:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.106.49.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.52
country_id: 1819730
description:
Feb  6 22:56:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.212.219
country_id: 3175395
description:
Feb  6 22:56:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.212.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.246.214
country_id: 1269750
description:
2025-02-06 22:56:11 dovecot_plain authenticator failed for (nsg-corporate-214.246.187.122.airtel.in) [122.187.246.214]:54082: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
country_id: 3469034
description:
2025-02-06 22:56:30 dovecot_login authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:2661: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.50.245.238
country_id: 3469034
description:
Feb  6 22:56:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.50.245.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.85.251.16
country_id: 1835841
description:
2025-02-06 22:55:53 dovecot_login authenticator failed for ([220.85.251.16]) [220.85.251.16]:50828: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.52
country_id: 1819730
description:
2025-02-06 22:56:20 dovecot_plain authenticator failed for (m121-202-154-52.smartone.com) [121.202.154.52]:58548: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.204.41.76
country_id: 1814991
description:
2025-02-06 22:56:08 dovecot_login authenticator failed for ([183.204.41.76]) [183.204.41.76]:55570: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
country_id: 3175395
description:
2025-02-06 22:56:09 dovecot_login authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:46330: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.72.4.98
country_id: 2029969
description:
Feb  6 22:56:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.72.4.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.104.101
country_id: 1668284
description:
Feb  6 22:56:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.104.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.246.214
country_id: 1269750
description:
Feb  6 22:56:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.246.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.204.41.76
country_id: 1814991
description:
Feb  6 22:56:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.204.41.76 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:22-56.35.92.116.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.104.101
country_id: 1668284
description:
2025-02-06 22:56:41 dovecot_login authenticator failed for 110-25-104-101.adsl.fetnet.net [110.25.104.101]:36732: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.85.251.16
country_id: 1835841
description:
Feb  6 22:55:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.85.251.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.115.19.225
country_id: 6252001
description:
Feb  6 22:55:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.115.19.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
country_id: 732800
description:
2025-02-06 22:56:14 dovecot_login authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:48529: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.90.99.29
country_id: 6252001
description:
Feb  6 22:56:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.90.99.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
country_id: 6252001
description:
2025-02-06 22:56:22 dovecot_plain authenticator failed for (70-90-99-29-ma-ne.hfc.comcastbusiness.net) [70.90.99.29]:58424: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.188.48.233
country_id: 3625428
description:
[2025-02-06 22:56:26 +0100] info [webmaild] 38.188.48.233 - info@aitsmartschool.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.140.244.144
country_id: 1835841
description:
2025-02-06 22:55:47 dovecot_login authenticator failed for ([125.140.244.144]) [125.140.244.144]:56390: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-02-06 22:56:36 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:35376: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.115.19.225
country_id: 6252001
description:
2025-02-06 22:55:56 dovecot_plain authenticator failed for 24.115.19.225.res-cmts.sm3.ptd.net [24.115.19.225]:55402: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.55.98
country_id: 1814991
description:
2025-02-06 22:56:50 dovecot_login authenticator failed for ([122.225.55.98]) [122.225.55.98]:50479: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.62
country_id: 1819730
description:
2025-02-06 22:57:14 dovecot_plain authenticator failed for (m121-202-153-62.smartone.com) [121.202.153.62]:42590: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 57.128.47.31
country_id: 3017382
domain: ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:22-57.57.128.47.31


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.175.33.240
country_id: 6252001
description:
Feb  6 22:57:26 ait sshd[1459193]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.175.33.240


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.81.78
country_id: 1814991
description:
2025-02-06 22:57:37 dovecot_login authenticator failed for ([61.51.81.78]) [61.51.81.78]:57182: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.187.213.29
country_id: 6252001
description:
Feb  6 22:56:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.187.213.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-02-06 22:56:51 dovecot_plain authenticator failed for ([24.187.213.29]) [24.187.213.29]:51690: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
country_id: 294640
description:
Feb  6 22:56:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.104
country_id: 1819730
description:
Feb  6 22:57:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.9.211
country_id: 1814991
description:
Feb  6 22:57:21 ait sshd[1459182]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.9.211


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.104
country_id: 1819730
description:
2025-02-06 22:57:23 dovecot_login authenticator failed for (m121-202-152-104.smartone.com) [121.202.152.104]:28209: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
country_id: 294640
description:
2025-02-06 22:57:00 dovecot_plain authenticator failed for (anonaling) [147.235.97.158]:55431: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.62
country_id: 1819730
description:
Feb  6 22:57:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.9.211
country_id: 1814991
description:
Feb  6 22:57:21 ait sshd[1459182]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.9.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.175.33.240
country_id: 6252001
description:
Feb  6 22:57:26 ait sshd[1459193]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.175.33.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.225.55.98
country_id: 1814991
description:
Feb  6 22:56:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.225.55.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.149.128.82
country_id: 1814991
description:
Feb  6 22:56:59 ait sshd[1459103]: pam_imunify(sshd:auth): [IM360_RBL] The IP 8.149.128.82 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 8.149.128.82
country_id: 1814991
description:
Feb  6 22:56:59 ait sshd[1459103]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=8.149.128.82


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.81.78
country_id: 1814991
description:
Feb  6 22:57:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.81.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.3.72
country_id: 1668284
description:
2025-02-06 22:57:52 dovecot_login authenticator failed for ([101.13.3.72]) [101.13.3.72]:48970: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.175.33.240
country_id: 6252001
description:
Feb  6 22:58:34 ait sshd[1459663]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.175.33.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.166.179.34
country_id: 1880251
description:
Feb  6 22:58:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.166.179.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.179.34
country_id: 1880251
description:
2025-02-06 22:58:22 dovecot_plain authenticator failed for ([188.166.179.34]) [188.166.179.34]:59912: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.52
country_id: 1819730
description:
2025-02-06 22:58:30 dovecot_login authenticator failed for (m121-202-154-52.smartone.com) [121.202.154.52]:24618: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.193.37.116
country_id: 1835841
description:
2025-02-06 22:58:08 dovecot_login authenticator failed for ([211.193.37.116]) [211.193.37.116]:52174: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.169.151
country_id: 99237
description:
Feb  6 22:58:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.169.151 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.33.240
country_id: 6252001
description:
Feb  6 22:58:36 ait sshd[1459663]: Failed password for invalid user roberto from 107.175.33.240 port 50968 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.3.72
country_id: 1668284
description:
Feb  6 22:57:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.3.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 22:57:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.169.151
country_id: 99237
description:
2025-02-06 22:58:15 dovecot_login authenticator failed for ([65.20.169.151]) [65.20.169.151]:51760: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.229.1.186
country_id: 6252001
description:
Feb  6 22:58:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.229.1.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
country_id: 3469034
description:
Feb  6 22:58:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.222.136.32
country_id: 6251999
description:
Feb  6 22:58:06 ait sshd[1459511]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.222.136.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.30
country_id: 1814991
description:
Feb  6 22:58:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.30 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 87.117.55.4
country_id: 2017370
description:
[2025-02-06 22:58:23 +0100] info [webmaild] 87.117.55.4 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.84.18
country_id: 895949
description:
Feb  6 22:58:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.84.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.106.78.215
country_id: 2017370
description:
Feb  6 22:57:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.106.78.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.52
country_id: 1819730
description:
Feb  6 22:58:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
country_id: 3469034
description:
2025-02-06 22:58:37 dovecot_plain authenticator failed for (187-8-163-70.customer.tdatabrasil.net.br) [187.8.163.70]:35162: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.106.78.215
country_id: 2017370
description:
2025-02-06 22:57:49 dovecot_login authenticator failed for ([77.106.78.215]) [77.106.78.215]:63141: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.169.50.39
country_id: 6252001
description:
2025-02-06 22:58:14 dovecot_plain authenticator failed for 39.sub-166-169-50.myvzw.com [166.169.50.39]:49505: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.175.33.240
country_id: 6252001
description:
Feb  6 22:58:34 ait sshd[1459663]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.175.33.240


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.222.136.32
country_id: 6251999
description:
Feb  6 22:58:06 ait sshd[1459511]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.222.136.32


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.169.50.39
country_id: 6252001
description:
Feb  6 22:58:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.169.50.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2025-02-06 22:58:28 dovecot_plain authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:59210: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.193.37.116
country_id: 1835841
description:
Feb  6 22:58:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.193.37.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.30
country_id: 1814991
description:
2025-02-06 22:58:21 dovecot_login authenticator failed for ([60.167.19.30]) [60.167.19.30]:36513: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.101.234.240
country_id: 1861060
description:
2025-02-06 22:59:02 dovecot_login authenticator failed for p100240-obmd01.tokyo.ocn.ne.jp [124.101.234.240]:45683: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.199.99
country_id: 895949
description:
Feb  6 22:59:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.199.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.218.102.225
country_id: 1668284
description:
Feb  6 22:59:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.218.102.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.24.37.157
country_id: 6251999
description:
2025-02-06 22:59:12 dovecot_login authenticator failed for (192-24-37-157.nftctelecom.com) [192.24.37.157]:35219: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.84.209.146
country_id: 2017370
description:
2025-02-06 22:59:43 dovecot_login authenticator failed for ([88.84.209.146]) [88.84.209.146]:51732: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.84.18
country_id: 895949
description:
2025-02-06 22:58:45 dovecot_login authenticator failed for ([41.216.84.18]) [41.216.84.18]:38324: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.199.99
country_id: 895949
description:
2025-02-06 22:59:04 dovecot_login authenticator failed for (ppp99-lumwana.zamnet.zm) [196.46.199.99]:57231: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-02-06 22:59:23 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:42282: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.117.91.67
country_id: 1835841
description:
Feb  6 22:59:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.117.91.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.189.153.136
country_id: 1814991
description:
Feb  6 22:59:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.189.153.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.117.91.67
country_id: 1835841
description:
2025-02-06 22:59:35 dovecot_login authenticator failed for ([220.117.91.67]) [220.117.91.67]:47850: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.241.253
country_id: 2017370
description:
2025-02-06 22:59:37 dovecot_login authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:49232: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.101.234.240
country_id: 1861060
description:
Feb  6 22:59:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.101.234.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.24.37.157
country_id: 6251999
description:
Feb  6 22:59:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.24.37.157 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.193.190.105
country_id: 1643084
description:
Feb  6 22:59:28 ait sshd[1460093]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.193.190.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.170.225.80
country_id: 1269750
description:
2025-02-06 22:59:36 dovecot_login authenticator failed for ([103.170.225.80]) [103.170.225.80]:32846: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.84.209.146
country_id: 2017370
description:
Feb  6 22:59:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.84.209.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.75.243.124
country_id: 130758
description:
Feb  6 22:58:50 ait sshd[1459907]: pam_imunify(sshd:auth): [IM360_RBL] The IP 37.75.243.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.170.225.80
country_id: 1269750
description:
Feb  6 22:59:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.170.225.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.218.102.225
country_id: 1668284
description:
2025-02-06 22:59:15 dovecot_login authenticator failed for (180-218-102-225.dynamic.twmbroadband.net) [180.218.102.225]:52046: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.193.190.105
country_id: 1643084
description:
Feb  6 22:59:28 ait sshd[1460093]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.193.190.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.159.234.69
country_id: 1814991
description:
2025-02-06 22:59:08 dovecot_login authenticator failed for ([117.159.234.69]) [117.159.234.69]:53986: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.159.234.69
country_id: 1814991
description:
Feb  6 22:59:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.159.234.69 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.222.136.32
country_id: 6251999
description:
Feb  6 22:59:14 ait sshd[1460003]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.222.136.32


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
country_id: 226074
description:
Feb  6 22:59:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.241.253
country_id: 2017370
description:
Feb  6 22:59:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.241.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.189.153.136
country_id: 1814991
description:
2025-02-06 22:59:37 dovecot_login authenticator failed for ([110.189.153.136]) [110.189.153.136]:40828: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.222.136.32
country_id: 6251999
description:
Feb  6 22:59:14 ait sshd[1460003]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.222.136.32 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 37.75.243.124
country_id: 130758
description:
Feb  6 22:58:50 ait sshd[1459907]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.75.243.124


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.245.66
country_id: 1814991
description:
2025-02-06 23:00:40 dovecot_plain authenticator failed for ([120.238.245.66]) [120.238.245.66]:35089: 535 Incorrect authentication data (set_id=eng19b00159y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.130
country_id: 1269750
description:
2025-02-06 22:59:55 dovecot_login authenticator failed for (nsg-corporate-130.230.187.122.airtel.in) [122.187.230.130]:52899: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.99.153.21
country_id: 1269750
description:
Feb  6 23:00:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.99.153.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
country_id: 1269750
description:
2025-02-06 23:00:09 dovecot_plain authenticator failed for ([59.99.153.21]) [59.99.153.21]:58570: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.106.67.50
country_id: 6252001
description:
2025-02-06 23:00:26 dovecot_plain authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:45608: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.70.28
country_id: 1835841
description:
2025-02-06 23:00:37 dovecot_plain authenticator failed for ([110.34.70.28]) [110.34.70.28]:37590: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.149.128.82
country_id: 1814991
description:
Feb  6 22:59:48 ait sshd[1460266]: pam_imunify(sshd:auth): [IM360_RBL] The IP 8.149.128.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.130
country_id: 1269750
description:
Feb  6 22:59:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
country_id: 690791
description:
2025-02-06 22:59:58 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (nonce) [94.45.76.149]:44289: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.70.28
country_id: 1835841
description:
Feb  6 23:00:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.70.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.139
country_id: 1835841
description:
2025-02-06 22:59:52 dovecot_login authenticator failed for ([61.108.83.254]) [61.108.83.139]:39822: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.70.9.114
country_id: 1814991
description:
2025-02-06 23:00:08 dovecot_plain authenticator failed for ([218.70.9.114]) [218.70.9.114]:60009: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.87.10.83
country_id: 953987
description:
2025-02-06 23:00:21 dovecot_plain authenticator failed for ([197.87.10.83]) [197.87.10.83]:44022: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
country_id: 690791
description:
Feb  6 22:59:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.142.41.167
country_id: 732800
description:
2025-02-06 23:00:01 dovecot_plain authenticator failed for ([78.142.41.167]) [78.142.41.167]:52978: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.76.57.200
country_id: 1269750
description:
Feb  6 23:00:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.76.57.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.88.106
country_id: 1814991
description:
2025-02-06 23:00:30 dovecot_plain authenticator failed for ([117.158.88.106]) [117.158.88.106]:18370: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.74.9.190
country_id: 1814991
description:
2025-02-06 23:00:32 dovecot_plain authenticator failed for ([101.230.0.49]) [124.74.9.190]:65448: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.245.66
country_id: 1814991
description:
Feb  6 23:00:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.245.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.121.193.126
country_id: 3595528
description:
Feb  6 23:00:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.121.193.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.156.255.186
country_id: 6252001
description:
Feb  6 23:00:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.156.255.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.156.255.186
country_id: 6252001
description:
2025-02-06 23:00:12 dovecot_plain authenticator failed for syn-098-156-255-186.res.spectrum.com [98.156.255.186]:57668: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.74.9.190
country_id: 1814991
description:
Feb  6 23:00:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.74.9.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.76.57.200
country_id: 1269750
description:
2025-02-06 23:00:04 dovecot_plain authenticator failed for ([103.76.57.200]) [103.76.57.200]:36634: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 8.149.128.82
country_id: 1814991
description:
Feb  6 22:59:48 ait sshd[1460266]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=8.149.128.82


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.139
country_id: 1835841
description:
Feb  6 22:59:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.75.243.124
country_id: 130758
description:
Feb  6 23:00:00 ait sshd[1460311]: pam_imunify(sshd:auth): [IM360_RBL] The IP 37.75.243.124 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 37.75.243.124
country_id: 130758
description:
Feb  6 23:00:00 ait sshd[1460311]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.75.243.124


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.87.10.83
country_id: 953987
description:
Feb  6 23:00:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.87.10.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.239.169.52
country_id: 1814991
description:
Feb  6 23:00:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.239.169.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.239.169.52
country_id: 1814991
description:
2025-02-06 23:00:23 dovecot_plain authenticator failed for ([124.239.169.52]) [124.239.169.52]:51713: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.88.106
country_id: 1814991
description:
Feb  6 23:00:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.88.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.142.41.167
country_id: 732800
description:
Feb  6 22:59:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.142.41.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.70.9.114
country_id: 1814991
description:
Feb  6 23:00:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.70.9.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-02-06 23:00:09 dovecot_plain authenticator failed for ([190.121.193.126]) [190.121.193.126]:48996: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.106.67.50
country_id: 6252001
description:
Feb  6 23:00:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.106.67.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.11.241.139
country_id: 1814991
description:
2025-02-06 23:01:24 dovecot_plain authenticator failed for ([112.11.241.139]) [112.11.241.139]:33689: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.231.133.50
country_id: 2413451
description:
Feb  6 23:01:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.231.133.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
country_id: 2661886
description:
Feb  6 23:01:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.90.34
country_id: 2440476
description:
Feb  6 23:01:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.90.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.163.122.133
country_id: 1210997
description:
Feb  6 23:01:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.163.122.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
country_id: 2077456
description:
2025-02-06 23:01:31 dovecot_plain authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:50971: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.166.162.78
country_id: 1814991
description:
Feb  6 23:01:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.166.162.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.186.122
country_id: 1835841
description:
Feb  6 23:01:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.186.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.93.130
country_id: 1835841
description:
2025-02-06 23:01:27 dovecot_plain authenticator failed for ([211.109.93.130]) [211.109.93.130]:60134: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.84.175
country_id: 1835841
description:
Feb  6 23:01:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.84.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.90.72.14
country_id: 1814991
description:
2025-02-06 23:01:29 dovecot_plain authenticator failed for ([125.90.72.14]) [125.90.72.14]:50755: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.222.190.69
country_id: 1522867
description:
2025-02-06 23:01:31 dovecot_plain authenticator failed for (client.fttb.2day.kz) [176.222.190.69]:47396: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.32.209.51
country_id: 2635167
description:
2025-02-06 23:01:31 dovecot_plain authenticator failed for ([217.32.209.50]) [217.32.209.51]:32955: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.188.180
country_id: 1819730
description:
2025-02-06 23:01:32 dovecot_plain authenticator failed for 180.188.76.219.static.netvigator.com [219.76.188.180]:63564: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.140.240
country_id: 1814991
description:
Feb  6 23:01:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.140.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2025-02-06 23:01:18 dovecot_plain authenticator failed for ([20.46.45.121]) [20.46.45.121]:63568: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.20.131
country_id: 1835841
description:
2025-02-06 23:01:25 dovecot_plain authenticator failed for ([123.212.20.131]) [123.212.20.131]:60446: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.93.182
country_id: 1814991
description:
2025-02-06 23:01:22 dovecot_plain authenticator failed for ([112.31.93.182]) [112.31.93.182]:47042: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.183.178
country_id: 2017370
description:
2025-02-06 23:01:33 dovecot_plain authenticator failed for broadband-5-228-183-178.ip.moscow.rt.ru [5.228.183.178]:43475: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.149.128.82
country_id: 1814991
description:
Feb  6 23:01:13 ait sshd[1461009]: pam_imunify(sshd:auth): [IM360_RBL] The IP 8.149.128.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.161
country_id: 1819730
description:
2025-02-06 23:01:19 dovecot_plain authenticator failed for ([121.202.154.161]) [121.202.154.161]:14837: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.175.194.139
country_id: 6252001
description:
2025-02-06 23:01:34 dovecot_plain authenticator failed for syn-072-175-194-139.res.spectrum.com [72.175.194.139]:22779: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.58.201.106
country_id: 690791
description:
2025-02-06 23:01:19 dovecot_plain authenticator failed for host-5-58-201-106.bitternet.ua [5.58.201.106]:8568: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.40.122.250
country_id: 2629691
description:
Feb  6 23:01:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.40.122.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.159.150.111
country_id: 3469034
description:
2025-02-06 23:01:23 dovecot_plain authenticator failed for ([177.159.150.111]) [177.159.150.111]:37677: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.72.14.152
country_id: 6252001
description:
2025-02-06 23:01:26 dovecot_plain authenticator failed for ([76.72.14.152]) [76.72.14.152]:55670: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.140.240
country_id: 1814991
description:
2025-02-06 23:01:38 dovecot_plain authenticator failed for ([111.48.140.240]) [111.48.140.240]:20338: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.84.122.203
country_id: 3175395
description:
Feb  6 23:01:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.84.122.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.159.150.111
country_id: 3469034
description:
Feb  6 23:01:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.159.150.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
country_id: 1269750
description:
2025-02-06 23:01:25 dovecot_plain authenticator failed for ([103.163.44.118]) [103.163.44.118]:48848: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.201.54.90
country_id: 3469034
description:
Feb  6 23:01:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.201.54.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.58.201.106
country_id: 690791
description:
Feb  6 23:01:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.58.201.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.194.206
country_id: 99237
description:
Feb  6 23:01:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.194.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.194.206
country_id: 99237
description:
2025-02-06 23:01:20 dovecot_plain authenticator failed for ([65.20.194.206]) [65.20.194.206]:41662: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.174.233.64
country_id: 2661886
description:
2025-02-06 23:01:24 dovecot_plain authenticator failed for h-158-174-233-64.a192.priv.bahnhof.se [158.174.233.64]:39332: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
country_id: 3469034
description:
Feb  6 23:01:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.132.42.170
country_id: 1814991
description:
Feb  6 23:01:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.132.42.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.164.165
country_id: 298795
description:
Feb  6 23:01:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.164.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.139.39.106
country_id: 1814991
description:
Feb  6 23:01:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.139.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
country_id: 1814991
description:
Feb  6 23:01:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.76.95.152
country_id: 2017370
description:
2025-02-06 23:01:32 dovecot_plain authenticator failed for ([62.76.95.152]) [62.76.95.152]:55528: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.179.101.202
country_id: 1814991
description:
Feb  6 23:01:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.179.101.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
country_id: 3469034
description:
2025-02-06 23:01:41 dovecot_plain authenticator failed for ([200.205.133.193]) [187.8.163.70]:52122: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
country_id: 1819730
description:
Feb  6 23:01:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.133.50
country_id: 2413451
description:
2025-02-06 23:01:32 dovecot_plain authenticator failed for ([197.231.133.50]) [197.231.133.50]:46921: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.208.108.52
country_id: 1814991
description:
Feb  6 23:01:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.208.108.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.163.5
country_id: 1814991
description:
2025-02-06 23:01:41 dovecot_plain authenticator failed for ([39.164.180.226]) [39.164.163.5]:37268: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
country_id: 1835841
description:
2025-02-06 23:01:42 dovecot_plain authenticator failed for ([222.114.200.160]) [222.114.200.160]:39871: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.221.224.220
country_id: 1814991
description:
Feb  6 23:01:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.221.224.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.6.225.90
country_id: 1820814
description:
2025-02-06 23:01:30 dovecot_plain authenticator failed for (90-225.adsl.static.espeed.com.bn) [61.6.225.90]:49342: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.174.233.64
country_id: 2661886
description:
Feb  6 23:01:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.174.233.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.46.45.121
country_id: 290557
description:
Feb  6 23:01:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.46.45.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.93.156.147
country_id: 798544
description:
2025-02-06 23:01:19 dovecot_plain authenticator failed for ip4-193-93-156-147.blue-net.com.pl ([193.93.156.149]) [193.93.156.147]:40286: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.31.8.12
country_id: 614540
description:
Feb  6 23:01:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.31.8.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.32.209.51
country_id: 2635167
description:
Feb  6 23:01:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.32.209.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.76.188.180
country_id: 1819730
description:
Feb  6 23:01:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.76.188.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.212.238
country_id: 1814991
description:
2025-02-06 23:01:34 dovecot_plain authenticator failed for ([58.18.212.238]) [58.18.212.238]:53106: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.13
country_id: 2328926
description:
2025-02-06 23:01:21 dovecot_plain authenticator failed for ([41.216.169.13]) [41.216.169.13]:43708: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
country_id: 1814991
description:
2025-02-06 23:01:23 dovecot_plain authenticator failed for ([60.166.31.198]) [60.166.31.198]:48206: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.11.241.139
country_id: 1814991
description:
Feb  6 23:01:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.11.241.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
country_id: 1210997
description:
2025-02-06 23:01:22 dovecot_plain authenticator failed for ([182.163.122.133]) [182.163.122.133]:63103: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-02-06 23:01:25 dovecot_plain authenticator failed for ([196.216.81.126]) [196.216.81.126]:44742: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.72.4.98
country_id: 2029969
description:
Feb  6 23:01:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.72.4.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.104.166.110
country_id: 1835841
description:
Feb  6 23:01:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.104.166.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
country_id: 2077456
description:
Feb  6 23:01:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.201.37.210
country_id: 6252001
description:
Feb  6 23:01:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.201.37.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.141.194.159
country_id: 1835841
description:
Feb  6 23:01:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.141.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.201.37.210
country_id: 6252001
description:
2025-02-06 23:01:36 dovecot_plain authenticator failed for ([50.201.37.210]) [50.201.37.210]:51523: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
country_id: 1835841
description:
2025-02-06 23:01:39 dovecot_plain authenticator failed for ([14.54.22.11]) [14.54.22.11]:2140: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.179.101.202
country_id: 1814991
description:
2025-02-06 23:01:42 dovecot_plain authenticator failed for ([163.179.101.202]) [163.179.101.202]:47500: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.72.103.74
country_id: 1562822
description:
Feb  6 23:00:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.72.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.122.203
country_id: 3175395
description:
2025-02-06 23:01:17 dovecot_plain authenticator failed for ([82.84.122.203]) [82.84.122.203]:61039: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.175.194.139
country_id: 6252001
description:
Feb  6 23:01:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.175.194.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.208.108.52
country_id: 1814991
description:
2025-02-06 23:01:41 dovecot_plain authenticator failed for ([60.208.108.52]) [60.208.108.52]:59758: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.247
country_id: 1819730
description:
2025-02-06 23:01:22 dovecot_plain authenticator failed for (m121-202-153-247.smartone.com) [121.202.153.247]:57178: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.92.25.206
country_id: 1835841
description:
2025-02-06 23:01:24 dovecot_plain authenticator failed for ([220.92.25.206]) [220.92.25.206]:49384: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.161
country_id: 1819730
description:
Feb  6 23:01:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.75.233
country_id: 1819730
description:
2025-02-06 23:01:37 dovecot_plain authenticator failed for 42-200-75-233.static.imsbiz.com [42.200.75.233]:51662: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.34.174.90
country_id: 1814991
description:
2025-02-06 23:01:40 dovecot_plain authenticator failed for (90.174.34.58.broad.xw.sh.dynamic.163data.com.cn) [58.34.174.90]:34853: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.36.67
country_id: 1168579
description:
2025-02-06 23:01:42 dovecot_plain authenticator failed for ([203.124.36.67]) [203.124.36.67]:38536: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.83
country_id: 1819730
description:
Feb  6 23:01:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.216.81.126
country_id: 49518
description:
Feb  6 23:01:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.216.81.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.186.57
country_id: 290557
description:
Feb  6 23:01:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.186.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.76.95.152
country_id: 2017370
description:
Feb  6 23:01:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.76.95.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-02-06 23:01:21 dovecot_plain authenticator failed for ([154.127.90.34]) [154.127.90.34]:57086: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.242.165.148
country_id: 1835841
description:
Feb  6 23:01:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.242.165.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.44.118
country_id: 1269750
description:
Feb  6 23:01:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.44.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
country_id: 1835841
description:
2025-02-06 23:01:22 dovecot_plain authenticator failed for ([211.104.166.110]) [211.104.166.110]:33235: 535 Incorrect authentication data (set_id=eng19b00159y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.222.190.69
country_id: 1522867
description:
Feb  6 23:01:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.222.190.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.225.8
country_id: 290557
description:
Feb  6 23:01:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.225.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.212.238
country_id: 1814991
description:
Feb  6 23:01:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.212.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.93.156.147
country_id: 798544
description:
Feb  6 23:01:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.93.156.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.92.25.206
country_id: 1835841
description:
Feb  6 23:01:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.92.25.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-06 23:01:37 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-168.static.tpgi.com.au) [110.175.220.250]:45550: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-02-06 23:01:41 dovecot_plain authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:60966: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.186.57
country_id: 290557
description:
2025-02-06 23:01:32 dovecot_plain authenticator failed for ([91.74.186.57]) [91.74.186.57]:38334: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.199.98.51
country_id: 690791
description:
Feb  6 23:01:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.199.98.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.54.22.11
country_id: 1835841
description:
Feb  6 23:01:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.54.22.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.150.135.19
country_id: 690791
description:
Feb  6 23:01:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.150.135.19 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.193.190.105
country_id: 1643084
description:
Feb  6 23:01:14 ait sshd[1461033]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.193.190.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.72.4.98
country_id: 2029969
description:
2025-02-06 23:01:21 dovecot_plain authenticator failed for ([112.72.4.98]) [112.72.4.98]:56302: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.242.165.148
country_id: 1835841
description:
2025-02-06 23:01:29 dovecot_plain authenticator failed for ([1.242.165.148]) [1.242.165.148]:39514: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.225.8
country_id: 290557
description:
2025-02-06 23:01:31 dovecot_plain authenticator failed for ([5.30.225.8]) [5.30.225.8]:60448: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2025-02-06 23:01:22 dovecot_plain authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:59074: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-02-06 23:01:26 dovecot_plain authenticator failed for ([194.31.8.12]) [194.31.8.12]:50040: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.88.152
country_id: 294640
description:
Feb  6 23:01:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.88.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.163.5
country_id: 1814991
description:
Feb  6 23:01:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.163.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.190.111.104
country_id: 6251999
description:
Feb  6 23:01:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.190.111.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.31.93.182
country_id: 1814991
description:
Feb  6 23:01:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.31.93.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.184.194
country_id: 1814991
description:
2025-02-06 23:01:23 dovecot_plain authenticator failed for ([61.51.184.194]) [61.51.184.194]:55794: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.184.194
country_id: 1814991
description:
Feb  6 23:01:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.184.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.183.178
country_id: 2017370
description:
Feb  6 23:01:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.183.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.75.233
country_id: 1819730
description:
Feb  6 23:01:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.75.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.199.98.51
country_id: 690791
description:
2025-02-06 23:01:39 dovecot_plain authenticator failed for ([185.199.98.51]) [185.199.98.51]:37406: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
country_id: 1835841
description:
Feb  6 23:01:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 23:01:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.103.74
country_id: 1562822
description:
2025-02-06 23:01:00 dovecot_login authenticator failed for ([27.72.103.74]) [27.72.103.74]:64206: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.169.13
country_id: 2328926
description:
Feb  6 23:01:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.169.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.124.36.67
country_id: 1168579
description:
Feb  6 23:01:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.124.36.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.86.6
country_id: 2017370
description:
Feb  6 23:01:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.86.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.152
country_id: 294640
description:
2025-02-06 23:01:26 dovecot_plain authenticator failed for (2-55-88-152.orange.net.il) [2.55.88.152]:44547: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.141.194.159
country_id: 1835841
description:
2025-02-06 23:01:37 dovecot_plain authenticator failed for ([121.141.194.159]) [121.141.194.159]:36386: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.93.130
country_id: 1835841
description:
Feb  6 23:01:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.93.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  6 23:01:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.34.174.90
country_id: 1814991
description:
Feb  6 23:01:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.34.174.90 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 8.149.128.82
country_id: 1814991
description:
Feb  6 23:01:13 ait sshd[1461009]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=8.149.128.82


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.22.99.2
country_id: 1814991
description:
2025-02-06 23:01:23 dovecot_plain authenticator failed for ([121.22.99.2]) [121.22.99.2]:36003: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.72.14.152
country_id: 6252001
description:
Feb  6 23:01:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.72.14.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.6.225.90
country_id: 1820814
description:
Feb  6 23:01:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.6.225.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.84.175
country_id: 1835841
description:
2025-02-06 23:01:28 dovecot_plain authenticator failed for ([222.114.84.175]) [222.114.84.175]:50496: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.166.162.78
country_id: 1814991
description:
2025-02-06 23:01:41 dovecot_plain authenticator failed for ([180.166.162.78]) [180.166.162.78]:8054: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.32.145
country_id: 1814991
description:
Feb  6 23:01:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.32.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.20.131
country_id: 1835841
description:
Feb  6 23:01:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.20.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.146.186.122
country_id: 1835841
description:
2025-02-06 23:01:23 dovecot_plain authenticator failed for ([221.146.186.122]) [221.146.186.122]:51806: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.83
country_id: 1819730
description:
2025-02-06 23:01:23 dovecot_plain authenticator failed for 083.42.246.220.static.netvigator.com [220.246.42.83]:49416: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.224.220
country_id: 1814991
description:
2025-02-06 23:01:20 dovecot_plain authenticator failed for (220.224.221.60.adsl-pool.sx.cn) [60.221.224.220]:36968: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.32.145
country_id: 1814991
description:
2025-02-06 23:01:22 dovecot_plain authenticator failed for ([117.158.40.228]) [39.164.32.145]:51469: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.90.72.14
country_id: 1814991
description:
Feb  6 23:01:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.90.72.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.40.155
country_id: 1814991
description:
Feb  6 23:01:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.40.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.40.155
country_id: 1814991
description:
2025-02-06 23:01:40 dovecot_plain authenticator failed for ([60.174.40.155]) [60.174.40.155]:34079: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.132.42.170
country_id: 1814991
description:
2025-02-06 23:01:43 dovecot_plain authenticator failed for ([116.132.42.170]) [116.132.42.170]:46843: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.164.165
country_id: 298795
description:
2025-02-06 23:01:11 dovecot_login authenticator failed for ([5.11.164.165]) [5.11.164.165]:37022: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.22.99.2
country_id: 1814991
description:
Feb  6 23:01:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.22.99.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
country_id: 1819730
description:
2025-02-06 23:01:20 dovecot_plain authenticator failed for ([121.202.155.10]) [121.202.155.10]:20699: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.115.164
country_id: 1814991
description:
Feb  6 23:01:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.115.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.193.190.105
country_id: 1643084
description:
Feb  6 23:01:14 ait sshd[1461033]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.193.190.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.247
country_id: 1819730
description:
Feb  6 23:01:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.104.102
country_id: 1668284
description:
2025-02-06 23:01:54 dovecot_plain authenticator failed for 110-25-104-102.adsl.fetnet.net [110.25.104.102]:54982: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.69.156
country_id: 2017370
description:
Feb  6 23:01:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.69.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.237.101
country_id: 1814991
description:
Feb  6 23:02:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.237.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.241.253
country_id: 2017370
description:
2025-02-06 23:02:35 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:49264: 535 Incorrect authentication data (set_id=eng20b00167y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.190.111.104
country_id: 6251999
description:
2025-02-06 23:01:45 dovecot_plain authenticator failed for 107-190-111-104.cpe.teksavvy.com [107.190.111.104]:45108: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.40.155
country_id: 1814991
description:
2025-02-06 23:01:47 dovecot_plain authenticator failed for ([60.174.40.155]) [60.174.40.155]:34181: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.214.115
country_id: 1814991
description:
Feb  6 23:01:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.214.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.69.156
country_id: 2017370
description:
2025-02-06 23:01:57 dovecot_plain authenticator failed for ([109.195.69.156]) [109.195.69.156]:26653: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.14.157.24
country_id: 1814991
description:
2025-02-06 23:01:58 dovecot_plain authenticator failed for ([218.14.157.24]) [218.14.157.24]:40240: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
country_id: 2661886
description:
2025-02-06 23:01:44 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:37866: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.115.164
country_id: 1814991
description:
2025-02-06 23:01:44 dovecot_plain authenticator failed for ([218.94.115.164]) [218.94.115.164]:38768: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.8.174
country_id: 1814991
description:
2025-02-06 23:02:39 dovecot_login authenticator failed for ([60.166.8.174]) [60.166.8.174]:50577: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.0.170
country_id: 3585968
description:
2025-02-06 23:02:08 dovecot_plain authenticator failed for ([179.51.0.170]) [179.51.0.170]:53341: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-02-06 23:01:46 dovecot_plain authenticator failed for ([190.117.96.174]) [190.117.96.174]:35472: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.28.128.172
country_id: 1814991
description:
2025-02-06 23:02:08 dovecot_plain authenticator failed for ([112.28.128.172]) [112.28.128.172]:59409: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.21.191.178
country_id: 3175395
description:
Feb  6 23:01:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.21.191.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.86.6
country_id: 2017370
description:
2025-02-06 23:01:44 dovecot_plain authenticator failed for ([188.168.86.6]) [188.168.86.6]:60122: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.237.101
country_id: 1814991
description:
2025-02-06 23:02:14 dovecot_plain authenticator failed for ([120.237.237.101]) [120.237.237.101]:45877: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-02-06 23:01:44 dovecot_plain authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:39784: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.199.240.104
country_id: 1880251
description:
Feb  6 23:01:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.199.240.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.167.217.147
country_id: 1835841
description:
2025-02-06 23:01:54 dovecot_plain authenticator failed for ([121.167.217.147]) [121.167.217.147]:53648: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.14.157.24
country_id: 1814991
description:
Feb  6 23:01:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.14.157.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.28.128.172
country_id: 1814991
description:
Feb  6 23:02:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.28.128.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.8.174
country_id: 1814991
description:
Feb  6 23:02:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.8.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.214.115
country_id: 1814991
description:
2025-02-06 23:01:49 dovecot_plain authenticator failed for ([218.4.214.115]) [218.4.214.115]:52090: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.167.217.147
country_id: 1835841
description:
Feb  6 23:01:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.167.217.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.124.66
country_id: 1835841
description:
2025-02-06 23:02:24 dovecot_login authenticator failed for ([222.119.124.66]) [222.119.124.66]:44247: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.241.253
country_id: 2017370
description:
Feb  6 23:02:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.241.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 23:02:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
country_id: 1835841
description:
Feb  6 23:02:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
country_id: 3932488
description:
Feb  6 23:01:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.104.102
country_id: 1668284
description:
Feb  6 23:01:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.104.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.149.233.245
country_id: 1835841
description:
Feb  6 23:01:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.149.233.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.21.191.178
country_id: 3175395
description:
2025-02-06 23:01:46 dovecot_plain authenticator failed for host-79-21-191-178.retail.telecomitalia.it [79.21.191.178]:51770: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-02-06 23:01:48 dovecot_plain authenticator failed for ([190.121.193.126]) [190.121.193.126]:55314: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.233.245
country_id: 1835841
description:
2025-02-06 23:01:49 dovecot_plain authenticator failed for ([221.149.233.245]) [221.149.233.245]:39851: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.199.240.104
country_id: 1880251
description:
2025-02-06 23:01:53 dovecot_plain authenticator failed for (104.240.199.112.unknown.m1.com.sg) [112.199.240.104]:37528: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.51.0.170
country_id: 3585968
description:
Feb  6 23:02:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.51.0.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.39.106
country_id: 1814991
description:
2025-02-06 23:01:44 dovecot_plain authenticator failed for ([219.139.39.106]) [219.139.39.106]:40934: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.121.193.126
country_id: 3595528
description:
Feb  6 23:01:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.121.193.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.124.66
country_id: 1835841
description:
Feb  6 23:02:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.124.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2025-02-06 23:02:40 dovecot_login authenticator failed for ([121.178.185.141]) [121.178.185.141]:53698: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.232.206
country_id: 3469034
description:
Feb  6 23:03:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.232.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.152.119.134
country_id: 1643084
description:
Feb  6 23:03:23 ait sshd[1462028]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.152.119.134


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.232.206
country_id: 3469034
description:
2025-02-06 23:03:22 dovecot_plain authenticator failed for ([177.6.232.206]) [177.6.232.206]:47203: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.58
country_id: 1814991
description:
Feb  6 23:03:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.50.137.84
country_id: 1814991
description:
Feb  6 23:03:29 ait sshd[1462038]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.50.137.84 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 104.248.118.148
country_id: 6252001
domain: ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:23-03.104.248.118.148


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.96
country_id: 1814991
description:
Feb  6 23:02:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.96
country_id: 1814991
description:
2025-02-06 23:02:52 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:30708: 535 Incorrect authentication data (set_id=eng20b00167y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.231.84.13
country_id: 1814991
description:
Feb  6 23:03:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.231.84.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.231.84.13
country_id: 1814991
description:
2025-02-06 23:03:27 dovecot_login authenticator failed for ([116.231.84.13]) [116.231.84.13]:12168: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.129.195
country_id: 6251999
description:
2025-02-06 23:02:50 dovecot_login authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:45430: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.152.119.134
country_id: 1643084
description:
Feb  6 23:03:23 ait sshd[1462028]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.152.119.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.235.240
country_id: 6252001
description:
2025-02-06 23:03:25 dovecot_login authenticator failed for (ADMIN) [102.129.235.240]:13004: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.50.137.84
country_id: 1814991
description:
Feb  6 23:03:29 ait sshd[1462038]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.137.84


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.28.77.206
country_id: 1814991
description:
Feb  6 23:03:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.28.77.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.129.195
country_id: 6251999
description:
Feb  6 23:02:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.129.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
country_id: 1814991
description:
2025-02-06 23:03:31 dovecot_login authenticator failed for ([111.61.176.58]) [111.61.176.58]:43672: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.77.206
country_id: 1814991
description:
2025-02-06 23:03:35 dovecot_plain authenticator failed for (pc0.zz.ha.cn) [218.28.77.206]:60886: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.235.240
country_id: 6252001
description:
Feb  6 23:03:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.235.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.204.108.172
country_id: 1814991
description:
Feb  6 23:04:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.204.108.172 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.50.137.84
country_id: 1814991
description:
Feb  6 23:04:19 ait sshd[1462285]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.137.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.149.220.148
country_id: 1269750
description:
2025-02-06 23:04:20 dovecot_plain authenticator failed for (static-146.220.149.202-tataidc.co.in) [202.149.220.148]:44692: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.51.0.170
country_id: 3585968
description:
Feb  6 23:04:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.51.0.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2025-02-06 23:04:38 dovecot_plain authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:35787: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.248.75.101
country_id: 1861060
description:
Feb  6 23:03:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.248.75.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-02-06 23:03:47 dovecot_login authenticator failed for ([213.32.253.235]) [213.32.253.235]:41271: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.85.196
country_id: 294640
description:
2025-02-06 23:04:36 dovecot_plain authenticator failed for (2-55-85-196.orange.net.il) [2.55.85.196]:53449: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.151.168.237
country_id: 1835841
description:
Feb  6 23:04:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.151.168.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.171.195.70
country_id: 6252001
description:
Feb  6 23:04:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.171.195.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.248.75.101
country_id: 1861060
description:
2025-02-06 23:03:47 dovecot_login authenticator failed for st7013.mas4401.y-tokyo.nttpc.ne.jp [160.248.75.101]:43034: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 23:04:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
country_id: 1269750
description:
2025-02-06 23:04:11 dovecot_plain authenticator failed for ([122.187.230.154]) [122.187.230.154]:56891: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.161.217.228
country_id: 2510769
description:
Feb  6 23:04:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.161.217.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.85.196
country_id: 294640
description:
Feb  6 23:04:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.85.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-02-06 23:04:35 dovecot_plain authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:48678: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.204.108.172
country_id: 1814991
description:
2025-02-06 23:04:37 dovecot_plain authenticator failed for ([129.204.108.172]) [129.204.108.172]:48008: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.154
country_id: 1269750
description:
Feb  6 23:04:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.154 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:23-04.35.92.116.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.151.168.237
country_id: 1835841
description:
2025-02-06 23:04:25 dovecot_login authenticator failed for ([221.151.168.237]) [221.151.168.237]:56418: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.248.238.187
country_id: 1835841
description:
2025-02-06 23:04:36 dovecot_plain authenticator failed for ([106.248.238.187]) [106.248.238.187]:55807: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.10
country_id: 2077456
description:
2025-02-06 23:04:21 dovecot_plain authenticator failed for ([203.189.124.10]) [203.189.124.10]:39368: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.50.137.84
country_id: 1814991
description:
Feb  6 23:04:19 ait sshd[1462285]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.50.137.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.149.220.148
country_id: 1269750
description:
Feb  6 23:04:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.149.220.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.10
country_id: 2077456
description:
Feb  6 23:04:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.152
country_id: 1269750
description:
Feb  6 23:04:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.0.170
country_id: 3585968
description:
2025-02-06 23:04:39 dovecot_login authenticator failed for ([179.51.0.170]) [179.51.0.170]:34121: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.32.253.235
country_id: 99237
description:
Feb  6 23:03:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.32.253.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.171.195.70
country_id: 6252001
description:
2025-02-06 23:04:26 dovecot_plain authenticator failed for ([216.171.195.70]) [216.171.195.70]:55615: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.119.126.81
country_id: 1835841
description:
2025-02-06 23:04:48 dovecot_plain authenticator failed for ([220.119.126.81]) [220.119.126.81]:48139: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.100
country_id: 1819730
description:
Feb  6 23:04:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.35.237.38
country_id: 1835841
description:
2025-02-06 23:05:06 dovecot_plain authenticator failed for ([183.105.138.168]) [211.35.237.38]:55145: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.82
country_id: 1835841
description:
Feb  6 23:05:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.217.141.77
country_id: 6252001
description:
Feb  6 23:04:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.217.141.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.87.246
country_id: 1814991
description:
2025-02-06 23:04:50 dovecot_plain authenticator failed for ([1.28.87.246]) [1.28.87.246]:37320: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.184.212.168
country_id: 6252001
description:
Feb  6 23:05:29 ait sshd[1462804]: pam_imunify(sshd:auth): [IM360_RBL] The IP 137.184.212.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.217.141.77
country_id: 6252001
description:
2025-02-06 23:04:51 dovecot_plain authenticator failed for (206-217-141-77-host.colocrossing.com) [206.217.141.77]:59866: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.82
country_id: 1835841
description:
2025-02-06 23:05:24 dovecot_plain authenticator failed for ([58.230.236.82]) [58.230.236.82]:47686: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 137.184.212.168
country_id: 6252001
description:
Feb  6 23:05:29 ait sshd[1462804]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.184.212.168  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 23:05:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.119.126.81
country_id: 1835841
description:
Feb  6 23:04:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.119.126.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.87.246
country_id: 1814991
description:
Feb  6 23:04:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.87.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.156.43
country_id: 1861060
description:
Feb  6 23:04:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.156.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.156.43
country_id: 1861060
description:
2025-02-06 23:04:50 dovecot_plain authenticator failed for p85044-obmd01.osaka.ocn.ne.jp [180.7.156.43]:48274: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.203.122.112
country_id: 6252001
description:
Feb  6 23:05:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.203.122.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.203.122.112
country_id: 6252001
description:
2025-02-06 23:05:07 dovecot_plain authenticator failed for syn-069-203-122-112.res.spectrum.com [69.203.122.112]:44190: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.218.102.225
country_id: 1668284
description:
Feb  6 23:04:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.218.102.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.100
country_id: 1819730
description:
2025-02-06 23:04:52 dovecot_plain authenticator failed for (m121-202-152-100.smartone.com) [121.202.152.100]:59611: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.218.102.225
country_id: 1668284
description:
2025-02-06 23:04:53 dovecot_plain authenticator failed for (180-218-102-225.dynamic.twmbroadband.net) [180.218.102.225]:38122: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.35.237.38
country_id: 1835841
description:
Feb  6 23:05:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.35.237.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.53.82
country_id: 1814991
description:
2025-02-06 23:06:31 dovecot_plain authenticator failed for ([60.172.53.82]) [60.172.53.82]:51893: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.216.7.163
country_id: 1668284
description:
2025-02-06 23:06:31 dovecot_plain authenticator failed for 61-216-7-163.hinet-ip.hinet.net (61-216-7-164.hinet-ip.hinet.net) [61.216.7.163]:59188: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.34
country_id: 1819730
description:
2025-02-06 23:06:21 dovecot_plain authenticator failed for (m121-202-152-34.smartone.com) [121.202.152.34]:63093: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.251.121.70
country_id: 1861060
description:
Feb  6 23:06:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.251.121.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.53.82
country_id: 1814991
description:
Feb  6 23:06:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.53.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.220.16.46
country_id: 1835841
description:
Feb  6 23:06:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.220.16.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.202.71.21
country_id: 1835841
description:
Feb  6 23:06:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.202.71.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.134.239.97
country_id: 1814991
description:
2025-02-06 23:06:09 dovecot_plain authenticator failed for ([182.134.239.97]) [182.134.239.97]:35566: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 80.94.250.121
country_id: 617790
description:
[2025-02-06 23:06:12 +0100] info [webmaild] 80.94.250.121 - info@ait.edu.gh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.208.66
country_id: 1269750
description:
2025-02-06 23:06:13 dovecot_plain authenticator failed for ([115.244.25.186]) [103.156.208.66]:50596: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.202.71.21
country_id: 1835841
description:
2025-02-06 23:06:16 dovecot_plain authenticator failed for ([211.202.71.21]) [211.202.71.21]:38990: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.134.239.97
country_id: 1814991
description:
Feb  6 23:06:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.134.239.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.34
country_id: 1819730
description:
Feb  6 23:06:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2025-02-06 23:06:26 dovecot_plain authenticator failed for works.ssc-gr.info [160.251.121.70]:53298: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.216.7.163
country_id: 1668284
description:
Feb  6 23:06:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.216.7.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.220.16.46
country_id: 1835841
description:
2025-02-06 23:06:44 dovecot_plain authenticator failed for ([119.220.16.46]) [119.220.16.46]:48017: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.156.208.66
country_id: 1269750
description:
Feb  6 23:06:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.156.208.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.22.99.2
country_id: 1814991
description:
2025-02-06 23:07:04 dovecot_plain authenticator failed for ([121.22.99.2]) [121.22.99.2]:56663: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
country_id: 2510769
description:
Feb  6 23:07:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
country_id: 2510769
description:
2025-02-06 23:07:41 dovecot_plain authenticator failed for (romic) [207.188.157.230]:52480: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.224.55.22
country_id: 1835841
description:
Feb  6 23:06:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.224.55.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.224.55.22
country_id: 1835841
description:
2025-02-06 23:06:46 dovecot_plain authenticator failed for ([58.224.55.22]) [58.224.55.22]:45914: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.22.99.2
country_id: 1814991
description:
Feb  6 23:07:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.22.99.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 23:08:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.212.38.130
country_id: 1814991
description:
Feb  6 23:08:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.212.38.130 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-08.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.38.130
country_id: 1814991
description:
2025-02-06 23:08:41 dovecot_plain authenticator failed for (130.38.212.118.adsl-pool.jx.chinaunicom.com) [118.212.38.130]:58072: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.20.26.201
country_id: 1668284
description:
2025-02-06 23:08:55 dovecot_plain authenticator failed for 211-20-26-201.hinet-ip.hinet.net [211.20.26.201]:33182: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.21.191.178
country_id: 3175395
description:
2025-02-06 23:08:56 dovecot_plain authenticator failed for host-79-21-191-178.retail.telecomitalia.it [79.21.191.178]:57246: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.195.104
country_id: 1269750
description:
Feb  6 23:09:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.187.195.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.195.104
country_id: 1269750
description:
2025-02-06 23:09:20 dovecot_login authenticator failed for ([103.187.195.104]) [103.187.195.104]:58539: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 3.109.208.184
country_id: 1269750
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:23-09.3.109.208.184


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.172.225.52
country_id: 630336
description:
Feb  6 23:09:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.172.225.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.15.104
country_id: 2017370
description:
Feb  6 23:08:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.15.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.20.26.201
country_id: 1668284
description:
Feb  6 23:08:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.20.26.201 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.203
country_id: 1814991
description:
Feb  6 23:09:43 ait sshd[1464076]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.203  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.172.225.52
country_id: 630336
description:
2025-02-06 23:09:30 dovecot_login authenticator failed for ([178.172.225.52]) [178.172.225.52]:55673: 535 Incorrect authentication data (set_id=freeman@jaster.us)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.203
country_id: 1814991
description:
Feb  6 23:09:43 ait sshd[1464076]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.15.104
country_id: 2017370
description:
2025-02-06 23:08:48 dovecot_plain authenticator failed for 95-31-15-104.static.corbina.ru [95.31.15.104]:54015: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.21.191.178
country_id: 3175395
description:
Feb  6 23:08:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.21.191.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.88.241
country_id: 3469034
description:
2025-02-06 23:10:24 dovecot_login authenticator failed for (177-174-88-241.user.vivozap.com.br) [177.174.88.241]:37356: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
country_id: 614540
description:
Feb  6 23:09:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
country_id: 614540
description:
2025-02-06 23:09:49 dovecot_login authenticator failed for ([2.57.219.6]) [2.57.219.2]:50318: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.104.50.190
country_id: 1562822
description:
Feb  6 23:09:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.104.50.190 has been locked due to Imunify RBL


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.203
country_id: 1814991
description:
Feb  6 23:10:04 ait sshd[1464076]: error: maximum authentication attempts exceeded for root from 218.92.0.203 port 13386 ssh2 [preauth]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.88.241
country_id: 3469034
description:
Feb  6 23:10:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.88.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.203
country_id: 1814991
description:
Feb  6 23:09:47 ait sshd[1464076]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.104.50.190
country_id: 1562822
description:
2025-02-06 23:09:55 dovecot_login authenticator failed for ([116.104.50.190]) [116.104.50.190]:58310: 535 Incorrect authentication data (set_id=freeman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2025-02-06 23:10:04 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:55235: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.161.242.146
country_id: 1814991
description:
2025-02-06 23:11:53 dovecot_login authenticator failed for (146.242.161.222.adsl-pool.jlccptt.net.cn) [222.161.242.146]:8022: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.159.57.4
country_id: 1814991
description:
Feb  6 23:11:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.159.57.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.222.90.178
country_id: 3469034
description:
2025-02-06 23:11:57 dovecot_plain authenticator failed for ([200.222.90.178]) [200.222.90.178]:37750: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.54.115.46
country_id: 1512440
description:
Feb  6 23:12:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.54.115.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.214.52.214
country_id: 1835841
description:
Feb  6 23:12:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.214.52.214 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 202.29.30.124
country_id: 1605651
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-12.202.29.30.124


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-02-06 23:12:14 dovecot_plain authenticator failed for ([84.54.115.46]) [84.54.115.46]:56566: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:23-12.35.92.116.235


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.121.214.105
country_id: 2017370
description:
Feb  6 23:12:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.121.214.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.190.39.142
country_id: 878675
description:
2025-02-06 23:12:16 dovecot_login authenticator failed for (442534-test.customer.zol.co.zw) [41.190.39.142]:33478: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
country_id: 1168579
description:
2025-02-06 23:11:48 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:48111: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-02-06 23:12:08 dovecot_plain authenticator failed for (20118168049.host.telemar.net.br) [200.202.250.46]:58773: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.106.15
country_id: 6252001
description:
Feb  6 23:12:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.106.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
country_id: 1168579
description:
Feb  6 23:11:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.222.90.178
country_id: 3469034
description:
Feb  6 23:11:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.222.90.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.202.250.46
country_id: 3469034
description:
Feb  6 23:12:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.202.250.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.190.39.142
country_id: 878675
description:
Feb  6 23:12:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.190.39.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.57.4
country_id: 1814991
description:
2025-02-06 23:11:59 dovecot_plain authenticator failed for ([219.159.57.4]) [219.159.57.4]:33723: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.214.52.214
country_id: 1835841
description:
2025-02-06 23:12:28 dovecot_login authenticator failed for ([175.214.52.214]) [175.214.52.214]:42468: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.161.242.146
country_id: 1814991
description:
Feb  6 23:11:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.161.242.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.106.15
country_id: 6252001
description:
2025-02-06 23:12:36 dovecot_login authenticator failed for pool-108-18-106-15.washdc.fios.verizon.net [108.18.106.15]:59378: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.121.214.105
country_id: 2017370
description:
2025-02-06 23:12:40 dovecot_plain authenticator failed for ([176.121.214.105]) [176.121.214.105]:60601: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.52.202.92
country_id: 1814991
description:
2025-02-06 23:13:44 dovecot_plain authenticator failed for ([123.52.202.92]) [123.52.202.92]:37868: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.204.162.116
country_id: 2017370
description:
Feb  6 23:13:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.204.162.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.52.202.92
country_id: 1814991
description:
Feb  6 23:13:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.52.202.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.180
country_id: 1668284
description:
2025-02-06 23:12:52 dovecot_plain authenticator failed for 111-70-49-180.emome-ip.hinet.net [111.70.49.180]:37209: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.93.198.164
country_id: 1814991
description:
Feb  6 23:13:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.93.198.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.199.57.220
country_id: 6251999
description:
Feb  6 23:13:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.199.57.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.93.198.164
country_id: 1814991
description:
2025-02-06 23:13:07 dovecot_plain authenticator failed for ([183.93.198.164]) [183.93.198.164]:52637: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 23:13:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.217.141.77
country_id: 6252001
description:
Feb  6 23:12:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.217.141.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.180
country_id: 1668284
description:
Feb  6 23:12:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.199.57.220
country_id: 6251999
description:
2025-02-06 23:13:08 dovecot_plain authenticator failed for ([192.199.57.220]) [192.199.57.220]:42192: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.204.162.116
country_id: 2017370
description:
2025-02-06 23:13:43 dovecot_plain authenticator failed for ([82.204.162.116]) [82.204.162.116]:55144: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.217.141.77
country_id: 6252001
description:
2025-02-06 23:12:49 dovecot_plain authenticator failed for (206-217-141-77-host.colocrossing.com) [206.217.141.77]:45662: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.242.165.148
country_id: 1835841
description:
2025-02-06 23:12:50 dovecot_plain authenticator failed for ([1.242.165.148]) [1.242.165.148]:50572: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 23:13:05 ait sshd[1465386]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 23:13:05 ait sshd[1465386]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.242.165.148
country_id: 1835841
description:
Feb  6 23:12:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.242.165.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.39.63.46
country_id: 1814991
description:
2025-02-06 23:13:57 dovecot_plain authenticator failed for ([117.39.63.46]) [117.39.63.46]:56259: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.28.66.78
country_id: 2264397
description:
2025-02-06 23:14:31 dovecot_plain authenticator failed for ([62.28.66.78]) [62.28.66.78]:56286: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2025-02-06 23:14:40 dovecot_plain authenticator failed for ([220.95.14.102]) [220.95.14.102]:57624: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.66.190.67
country_id: 1269750
description:
Feb  6 23:13:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.66.190.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.71.53.210
country_id: 1814991
description:
Feb  6 23:14:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.71.53.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.62.184.138
country_id: 1814991
description:
Feb  6 23:14:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.62.184.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.76.194.159
country_id: 6252001
description:
Feb  6 23:14:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.76.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
country_id: 1668284
description:
2025-02-06 23:14:30 dovecot_plain authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:34370: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.97.253.246
country_id: 6252001
description:
Feb  6 23:14:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.97.253.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
country_id: 1668284
description:
Feb  6 23:14:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.26.70.70
country_id: 1814991
description:
Feb  6 23:14:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.26.70.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.82.12.128
country_id: 6252001
description:
2025-02-06 23:14:03 dovecot_plain authenticator failed for (50-82-12-128.client.mchsi.com) [50.82.12.128]:49198: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.216.5.134
country_id: 1814991
description:
Feb  6 23:14:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.216.5.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.119.20.149
country_id: 1835841
description:
2025-02-06 23:14:37 dovecot_plain authenticator failed for ([175.119.20.149]) [175.119.20.149]:53226: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.57.71
country_id: 1819730
description:
Feb  6 23:14:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.57.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.153.13.161
country_id: 1814991
description:
Feb  6 23:14:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.153.13.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.6.250.109
country_id: 2635167
description:
Feb  6 23:14:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.6.250.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.115.112.77
country_id: 1814991
description:
2025-02-06 23:14:40 dovecot_plain authenticator failed for ([123.115.112.77]) [123.115.112.77]:6788: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.132.43.94
country_id: 1814991
description:
2025-02-06 23:14:34 dovecot_plain authenticator failed for ([116.132.43.94]) [116.132.43.94]:13200: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.160.45.26
country_id: 1814991
description:
Feb  6 23:14:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.160.45.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.57.71
country_id: 1819730
description:
2025-02-06 23:14:43 dovecot_plain authenticator failed for n220246057071.netvigator.com [220.246.57.71]:58688: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.39.63.46
country_id: 1814991
description:
Feb  6 23:13:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.39.63.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.7
country_id: 1819730
description:
2025-02-06 23:14:22 dovecot_plain authenticator failed for 007.46.246.220.static.netvigator.com [220.246.46.7]:59609: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.62.184.138
country_id: 1814991
description:
2025-02-06 23:14:27 dovecot_plain authenticator failed for ([119.62.184.138]) [119.62.184.138]:47537: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.108.186.10
country_id: 3077311
description:
Feb  6 23:14:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.108.186.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.34.244.190
country_id: 1814991
description:
2025-02-06 23:14:34 dovecot_plain authenticator failed for ([36.34.244.190]) [36.34.244.190]:43564: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.179.124.13
country_id: 1814991
description:
2025-02-06 23:14:35 dovecot_plain authenticator failed for ([163.179.124.13]) [163.179.124.13]:51898: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.108.186.10
country_id: 3077311
description:
2025-02-06 23:14:36 dovecot_plain authenticator failed for (videoifolder.ru) [78.108.186.10]:52984: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.66.190.67
country_id: 1269750
description:
2025-02-06 23:14:00 dovecot_plain authenticator failed for ([116.66.190.67]) [116.66.190.67]:45646: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.153.13.161
country_id: 1814991
description:
2025-02-06 23:14:22 dovecot_plain authenticator failed for ([219.153.13.161]) [219.153.13.161]:57303: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.216.5.134
country_id: 1814991
description:
2025-02-06 23:14:22 dovecot_plain authenticator failed for ([114.216.5.134]) [114.216.5.134]:36326: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.71.53.210
country_id: 1814991
description:
2025-02-06 23:14:22 dovecot_plain authenticator failed for ([117.71.53.210]) [117.71.53.210]:52015: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.34.244.190
country_id: 1814991
description:
Feb  6 23:14:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.34.244.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.46.7
country_id: 1819730
description:
Feb  6 23:14:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.46.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.200.16
country_id: 1880251
description:
2025-02-06 23:14:21 dovecot_plain authenticator failed for (16.200.86.116.starhub.net.sg) [116.86.200.16]:34331: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.235.100.6
country_id: 2287781
description:
2025-02-06 23:14:22 dovecot_plain authenticator failed for host-105-235-100-6.afnet.net [105.235.100.6]:60293: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
country_id: 1814991
description:
Feb  6 23:13:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.119.20.149
country_id: 1835841
description:
Feb  6 23:14:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.119.20.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
country_id: 6252001
description:
Feb  6 23:14:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.216
country_id: 3865483
description:
2025-02-06 23:14:38 dovecot_plain authenticator failed for (201-234-106-216.static.impsat.net.ar) [201.234.106.216]:59592: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.28.66.78
country_id: 2264397
description:
Feb  6 23:14:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.28.66.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.95.14.102
country_id: 1835841
description:
Feb  6 23:14:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.95.14.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.103.2
country_id: 1835841
description:
2025-02-06 23:14:43 dovecot_plain authenticator failed for ([121.189.103.2]) [121.189.103.2]:38354: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.138.162
country_id: 1168579
description:
2025-02-06 23:14:26 dovecot_plain authenticator failed for ([182.176.138.162]) [182.176.138.162]:32768: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.198.173.145
country_id: 1819730
description:
Feb  6 23:14:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.198.173.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-02-06 23:14:38 dovecot_plain authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:42109: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.26.70.70
country_id: 1814991
description:
2025-02-06 23:14:40 dovecot_plain authenticator failed for ([1.26.70.70]) [1.26.70.70]:39670: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.103.2
country_id: 1835841
description:
Feb  6 23:14:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.103.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.200.16
country_id: 1880251
description:
Feb  6 23:14:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.200.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.235.100.6
country_id: 2287781
description:
Feb  6 23:14:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.235.100.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-02-06 23:14:19 dovecot_plain authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:51875: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-02-06 23:14:24 dovecot_plain authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:55678: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.132.43.94
country_id: 1814991
description:
Feb  6 23:14:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.132.43.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.248.223
country_id: 732800
description:
Feb  6 23:14:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.248.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.6.250.109
country_id: 2635167
description:
2025-02-06 23:14:33 dovecot_plain authenticator failed for 109.250.6.51.dyn.plus.net [51.6.250.109]:49480: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.115.112.77
country_id: 1814991
description:
Feb  6 23:14:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.115.112.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-02-06 23:14:40 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:12397: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.234.106.216
country_id: 3865483
description:
Feb  6 23:14:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.234.106.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.160.45.26
country_id: 1814991
description:
2025-02-06 23:14:40 dovecot_plain authenticator failed for ([124.160.45.26]) [124.160.45.26]:50884: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.82.12.128
country_id: 6252001
description:
Feb  6 23:14:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.82.12.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-02-06 23:14:18 dovecot_plain authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:46984: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.50.150
country_id: 1814991
description:
Feb  6 23:14:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.50.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.118.157
country_id: 1562822
description:
Feb  6 23:14:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.118.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.179.124.13
country_id: 1814991
description:
Feb  6 23:14:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.179.124.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
country_id: 1814991
description:
2025-02-06 23:13:51 dovecot_plain authenticator failed for ([218.98.160.117]) [218.98.160.117]:46285: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.118.157
country_id: 1562822
description:
2025-02-06 23:14:21 dovecot_plain authenticator failed for ([118.70.118.157]) [118.70.118.157]:60201: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
country_id: 1814991
description:
2025-02-06 23:14:21 dovecot_plain authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.50.150]:46358: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.176.138.162
country_id: 1168579
description:
Feb  6 23:14:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.176.138.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
country_id: 2510769
description:
2025-02-06 23:14:56 dovecot_plain authenticator failed for ([165.220.130.160]) [165.220.130.160]:52080: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.222
country_id: 1819730
description:
Feb  6 23:14:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.238.206
country_id: 2017370
description:
2025-02-06 23:15:13 dovecot_plain authenticator failed for ([95.221.238.206]) [95.221.238.206]:56071: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.138.162
country_id: 1168579
description:
2025-02-06 23:14:49 dovecot_plain authenticator failed for ([182.176.138.162]) [182.176.138.162]:34029: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.222
country_id: 1819730
description:
2025-02-06 23:14:59 dovecot_plain authenticator failed for ([121.202.205.222]) [121.202.205.222]:33093: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
country_id: 1269750
description:
2025-02-06 23:14:52 dovecot_plain authenticator failed for (nsg-corporate-194.153.186.122.airtel.in) [106.51.220.33]:28588: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.212.173.17
country_id: 1835841
description:
Feb  6 23:15:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.212.173.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.176.138.162
country_id: 1168579
description:
Feb  6 23:14:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.176.138.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.38.5
country_id: 1835841
description:
Feb  6 23:14:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.38.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.38.5
country_id: 1835841
description:
2025-02-06 23:14:53 dovecot_plain authenticator failed for ([211.169.38.5]) [211.169.38.5]:48376: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.130.160
country_id: 2510769
description:
Feb  6 23:14:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.130.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.238.206
country_id: 2017370
description:
Feb  6 23:15:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.238.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.212.173.17
country_id: 1835841
description:
2025-02-06 23:15:19 dovecot_plain authenticator failed for ([175.212.173.17]) [175.212.173.17]:42532: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.220.33
country_id: 1269750
description:
Feb  6 23:14:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.220.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.19.149
country_id: 1668284
description:
2025-02-06 23:16:29 dovecot_plain authenticator failed for 111-70-19-149.emome-ip.hinet.net [111.70.19.149]:57974: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.47.65
country_id: 1880251
description:
47.128.47.65 - - [06/Feb/2025:23:16:04 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=29758257 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=198%2C79%2C95%2C183&filtering=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.47.65


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.168.246
country_id: 1269750
description:
Feb  6 23:16:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.168.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.168.246
country_id: 1269750
description:
2025-02-06 23:16:13 dovecot_plain authenticator failed for (host103-171-169-246.renubroadband.com) [103.171.168.246]:52014: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.19.149
country_id: 1668284
description:
Feb  6 23:16:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.19.149 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 23:17:15 ait sshd[1466856]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.164.211.155
country_id: 2017370
description:
2025-02-06 23:17:28 dovecot_plain authenticator failed for (gludowe) [212.164.211.155]:51210: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.242.149.240
country_id: 6252001
description:
Feb  6 23:17:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.242.149.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.242.149.240
country_id: 6252001
description:
2025-02-06 23:17:06 dovecot_plain authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:45274: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-02-06 23:17:33 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:39786: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.205.112.156
country_id: 3625428
description:
2025-02-06 23:17:22 dovecot_login authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:1205: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.0.170
country_id: 3585968
description:
2025-02-06 23:17:38 dovecot_plain authenticator failed for ([179.51.0.170]) [179.51.0.170]:42978: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 23:17:15 ait sshd[1466856]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.205.112.156
country_id: 3625428
description:
Feb  6 23:17:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.205.112.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.164.211.155
country_id: 2017370
description:
Feb  6 23:17:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.164.211.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
country_id: 2464461
description:
Feb  6 23:17:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.51.0.170
country_id: 3585968
description:
Feb  6 23:17:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.51.0.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.93.37.178
country_id: 1269750
description:
Feb  6 23:17:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.93.37.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
country_id: 1269750
description:
2025-02-06 23:17:18 dovecot_plain authenticator failed for ([103.93.37.178]) [103.93.37.178]:37324: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.49.61.211
country_id: 6252001
description:
Feb  6 23:17:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.49.61.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.49.61.211
country_id: 6252001
description:
2025-02-06 23:17:47 dovecot_plain authenticator failed for ([136.49.61.211]) [136.49.61.211]:45402: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
country_id: 1835841
description:
Feb  6 23:18:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
country_id: 6252001
description:
Feb  6 23:19:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
country_id: 6252001
description:
2025-02-06 23:19:27 dovecot_login authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:56143: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2025-02-06 23:19:31 dovecot_plain authenticator failed for ([222.120.176.6]) [222.120.176.6]:57250: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
country_id: 1835841
description:
2025-02-06 23:19:01 dovecot_login authenticator failed for ([175.206.105.126]) [175.206.105.126]:37394: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.90.128.97
country_id: 6252001
description:
Feb  6 23:19:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.90.128.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.251
country_id: 1819730
description:
2025-02-06 23:19:29 dovecot_login authenticator failed for (m121-202-204-251.smartone.com) [121.202.204.251]:63215: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.72
country_id: 1814991
description:
2025-02-06 23:19:31 dovecot_login authenticator failed for ([183.249.1.72]) [183.249.1.72]:58415: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
country_id: 2510769
description:
Feb  6 23:18:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
country_id: 2510769
description:
2025-02-06 23:19:00 dovecot_plain authenticator failed for (myxonal) [207.188.157.230]:62664: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.251
country_id: 1819730
description:
Feb  6 23:19:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.99.162
country_id: 290557
description:
Feb  6 23:19:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.99.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.99.162
country_id: 290557
description:
2025-02-06 23:19:38 dovecot_login authenticator failed for ([80.227.99.162]) [80.227.99.162]:54271: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.75.65.36
country_id: 2260494
description:
[2025-02-06 23:19:41 +0100] info [webmaild] 41.75.65.36 - info@ait.university "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.194.128.158
country_id: 1269750
description:
Feb  6 23:19:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.194.128.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
country_id: 1269750
description:
2025-02-06 23:19:15 dovecot_login authenticator failed for ([14.194.128.158]) [14.194.128.158]:52980: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2025-02-06 23:19:20 dovecot_plain authenticator failed for syn-172-090-128-097.res.spectrum.com [172.90.128.97]:57699: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
country_id: 1835841
description:
Feb  6 23:19:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.72
country_id: 1814991
description:
Feb  6 23:19:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 23:20:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.31.93.182
country_id: 1814991
description:
Feb  6 23:20:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.31.93.182 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:23-20.35.92.116.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.93.182
country_id: 1814991
description:
2025-02-06 23:20:40 dovecot_plain authenticator failed for ([112.31.93.182]) [112.31.93.182]:47025: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.240
country_id: 1668284
description:
Feb  6 23:20:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.240
country_id: 1668284
description:
2025-02-06 23:20:52 dovecot_plain authenticator failed for 111-70-23-240.emome-ip.hinet.net [111.70.23.240]:51136: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 40.84.43.33
country_id: 6252001
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads20b00297y||WPU:ads20b00297y||RSV:6.65||T:APACHE||MV:23-21.40.84.43.33


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.253.152
country_id: 99237
description:
Feb  6 23:21:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.253.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.253.152
country_id: 99237
description:
2025-02-06 23:21:50 dovecot_plain authenticator failed for (possiserno) [65.20.253.152]:47833: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.201
country_id: 1814991
description:
Feb  6 23:23:33 ait sshd[1468952]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.201 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.201
country_id: 1814991
description:
Feb  6 23:23:33 ait sshd[1468952]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.201  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.70.38.99
country_id: 3865483
description:
Feb  6 23:23:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.70.38.99 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-23.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.99
country_id: 3865483
description:
2025-02-06 23:23:44 dovecot_login authenticator failed for (ADMIN) [146.70.38.99]:53440: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.38.74
country_id: 1814991
description:
Feb  6 23:24:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.38.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.201
country_id: 1814991
description:
Feb  6 23:23:47 ait sshd[1468952]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.201 has been locked due to Imunify RBL


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.201
country_id: 1814991
description:
Feb  6 23:23:55 ait sshd[1468952]: error: maximum authentication attempts exceeded for root from 218.92.0.201 port 36722 ssh2 [preauth]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.107.146.186
country_id: 1814991
description:
Feb  6 23:24:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.107.146.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.107.146.186
country_id: 1814991
description:
2025-02-06 23:24:22 dovecot_login authenticator failed for ([223.107.146.186]) [223.107.146.186]:47466: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.38.74
country_id: 1814991
description:
2025-02-06 23:24:45 dovecot_plain authenticator failed for ([118.122.38.74]) [118.122.38.74]:41716: 535 Incorrect authentication data (set_id=admin@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
country_id: 1835841
description:
Feb  6 23:24:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
country_id: 1835841
description:
2025-02-06 23:24:08 dovecot_login authenticator failed for ([14.88.228.202]) [14.88.228.202]:55762: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.202.128.28
country_id: 1835841
description:
Feb  6 23:24:54 ait sshd[1469595]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.202.128.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2025-02-06 23:24:56 dovecot_plain authenticator failed for works.ssc-gr.info [160.251.121.70]:52738: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.202.206.163
country_id: 3996063
description:
Feb  6 23:25:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.202.206.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.202.206.163
country_id: 3996063
description:
2025-02-06 23:25:40 dovecot_plain authenticator failed for 163.189-202-206.bestelclientes.com.mx [189.202.206.163]:33502: 535 Incorrect authentication data (set_id=office@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
country_id: 1835841
description:
Feb  6 23:25:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.6.241.38
country_id: 1562822
description:
2025-02-06 23:24:48 dovecot_plain authenticator failed for ([117.6.241.38]) [117.6.241.38]:55993: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.118
country_id: 1819730
description:
2025-02-06 23:24:53 dovecot_login authenticator failed for (m121-202-155-118.smartone.com) [121.202.155.118]:27628: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
country_id: 3277605
description:
Feb  6 23:25:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.6.241.38
country_id: 1562822
description:
Feb  6 23:24:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.6.241.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.202.128.28
country_id: 1835841
description:
Feb  6 23:24:54 ait sshd[1469595]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.202.128.28


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-02-06 23:25:05 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:52112: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.148.187.146
country_id: 3686110
description:
Feb  6 23:25:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.148.187.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 23:25:37 ait sshd[1469994]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.118
country_id: 1819730
description:
Feb  6 23:24:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.148.187.146
country_id: 3686110
description:
2025-02-06 23:25:13 dovecot_plain authenticator failed for (azteca-comunicaciones.com) [186.148.187.146]:45934: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 23:25:37 ait sshd[1469994]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.251.121.70
country_id: 1861060
description:
Feb  6 23:24:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.251.121.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2025-02-06 23:25:44 dovecot_login authenticator failed for ([203.252.10.3]) [203.252.10.3]:18017: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.51.0.170
country_id: 3585968
description:
Feb  6 23:25:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.51.0.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.87.246
country_id: 1814991
description:
2025-02-06 23:26:07 dovecot_login authenticator failed for ([1.28.87.246]) [1.28.87.246]:40044: 535 Incorrect authentication data (set_id=webmaster@aitonline.us)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.75.27.252
country_id: 1814991
description:
Feb  6 23:26:14 ait sshd[1470371]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.75.27.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.31.47.232
country_id: 6252001
description:
Feb  6 23:26:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.31.47.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
country_id: 1694008
description:
Feb  6 23:26:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.31.47.232
country_id: 6252001
description:
2025-02-06 23:26:03 dovecot_plain authenticator failed for syn-065-031-047-232.res.spectrum.com [65.31.47.232]:46973: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.0.170
country_id: 3585968
description:
2025-02-06 23:25:51 dovecot_plain authenticator failed for ([179.51.0.170]) [179.51.0.170]:56153: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.27.114
country_id: 1814991
description:
2025-02-06 23:25:53 dovecot_login authenticator failed for (114.27.33.36.adsl-pool.ah.cnuninet.net) [36.33.27.114]:60120: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
country_id: 1694008
description:
2025-02-06 23:26:03 dovecot_plain authenticator failed for ([116.50.246.69]) [58.69.17.18]:45546: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.75.27.252
country_id: 1814991
description:
Feb  6 23:26:14 ait sshd[1470371]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.27.252


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.27.114
country_id: 1814991
description:
Feb  6 23:25:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.27.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.87.246
country_id: 1814991
description:
Feb  6 23:26:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.87.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
country_id: 614540
description:
Feb  6 23:26:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
country_id: 614540
description:
2025-02-06 23:26:16 dovecot_login authenticator failed for ([2.57.219.6]) [2.57.219.2]:35106: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.140.17.85
country_id: 6252001
description:
Feb  6 23:27:32 ait sshd[1470763]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.140.17.85


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 23:27:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.74.9.190
country_id: 1814991
description:
Feb  6 23:28:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.74.9.190 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.202.128.28
country_id: 1835841
description:
Feb  6 23:28:21 ait sshd[1471063]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.202.128.28


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.181.81.77
country_id: 1835841
description:
Feb  6 23:28:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.181.81.77 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.114.194.24
country_id: 1814991
description:
Feb  6 23:28:04 ait sshd[1470902]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.114.194.24


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.202.128.28
country_id: 1835841
description:
Feb  6 23:28:21 ait sshd[1471063]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.202.128.28 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.78.81.208
country_id: 3469034
description:
[2025-02-06 23:28:37 +0100] info [webmaild] 170.78.81.208 - info@ait-edu.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 204.10.194.42
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:dennisbotchway02@gmail.com||WPU:dennisbotchway02@gmail.com||RSV:6.65||T:APACHE||MV:23-27.204.10.194.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.74.9.190
country_id: 1814991
description:
2025-02-06 23:28:23 dovecot_plain authenticator failed for ([101.230.0.49]) [124.74.9.190]:60663: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
country_id: 3277605
description:
2025-02-06 23:28:36 dovecot_plain authenticator failed for ([195.222.59.157]) [195.222.59.157]:48686: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.181.81.77
country_id: 1835841
description:
2025-02-06 23:28:37 dovecot_plain authenticator failed for ([125.181.81.77]) [125.181.81.77]:9004: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.59.157
country_id: 3277605
description:
Feb  6 23:28:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.59.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.224.220
country_id: 1814991
description:
2025-02-06 23:28:47 dovecot_plain authenticator failed for (220.224.221.60.adsl-pool.sx.cn) [60.221.224.220]:32823: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.65.68.104
country_id: 732800
description:
2025-02-06 23:28:49 dovecot_plain authenticator failed for ([45.65.68.104]) [45.65.68.104]:40264: 535 Incorrect authentication data (set_id=larm)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:23-28.35.92.116.235


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.161.197.130
country_id: 1562822
description:
Feb  6 23:28:54 ait sshd[1471335]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.161.197.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.140.17.85
country_id: 6252001
description:
Feb  6 23:28:56 ait sshd[1471352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.140.17.85


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.221.224.220
country_id: 1814991
description:
Feb  6 23:28:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.221.224.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.54.17
country_id: 3469034
description:
2025-02-06 23:29:34 dovecot_login authenticator failed for (17.54.gonzagatelecom.com.br) [177.128.54.17]:42972: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.128.54.17
country_id: 3469034
description:
Feb  6 23:29:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.128.54.17 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.161.197.130
country_id: 1562822
description:
Feb  6 23:28:54 ait sshd[1471335]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.197.130


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.65.68.104
country_id: 732800
description:
Feb  6 23:28:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.65.68.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.140.17.85
country_id: 6252001
description:
Feb  6 23:30:17 ait sshd[1472003]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.140.17.85


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.205.112.156
country_id: 3625428
description:
Feb  6 23:30:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.205.112.156 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.202.128.28
country_id: 1835841
description:
Feb  6 23:29:50 ait sshd[1471584]: Failed password for invalid user tac from 119.202.128.28 port 36838 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 23:30:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.205.112.156
country_id: 3625428
description:
2025-02-06 23:30:37 dovecot_login authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:14322: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
country_id: 1831722
description:
Feb  6 23:29:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-02-06 23:29:48 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:55242: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
country_id: 1210997
description:
2025-02-06 23:30:25 dovecot_login authenticator failed for ([103.124.54.14]) [103.124.54.14]:44995: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.202.128.28
country_id: 1835841
description:
Feb  6 23:29:47 ait sshd[1471584]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.202.128.28 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.202.128.28
country_id: 1835841
description:
Feb  6 23:29:47 ait sshd[1471584]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.202.128.28


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
country_id: 1210997
description:
Feb  6 23:30:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.8.25
country_id: 1835841
description:
Feb  6 23:30:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.8.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.8.25
country_id: 1835841
description:
2025-02-06 23:30:50 dovecot_plain authenticator failed for ([119.207.8.25]) [119.207.8.25]:42455: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.165.83
country_id: 99237
description:
Feb  6 23:30:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.165.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.196.62
country_id: 1814991
description:
Feb  6 23:31:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.196.62 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 202.29.30.124
country_id: 1605651
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:iric_admin||WPU:iric_admin||RSV:6.65||T:APACHE||MV:23-31.202.29.30.124


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.88.186.142
country_id: 3469034
description:
Feb  6 23:30:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.88.186.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.165.83
country_id: 99237
description:
2025-02-06 23:30:56 dovecot_plain authenticator failed for ([65.20.165.83]) [65.20.165.83]:36339: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.196.62
country_id: 1814991
description:
2025-02-06 23:31:06 dovecot_login authenticator failed for ([183.167.196.62]) [183.167.196.62]:53506: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.27
country_id: 1814991
description:
Feb  6 23:31:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.88.186.142
country_id: 3469034
description:
2025-02-06 23:30:47 dovecot_plain authenticator failed for ([201.88.186.142]) [201.88.186.142]:53850: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.83.138.102
country_id: 1814991
description:
2025-02-06 23:31:24 dovecot_login authenticator failed for ([223.83.138.102]) [223.83.138.102]:58477: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.27
country_id: 1814991
description:
2025-02-06 23:31:09 dovecot_plain authenticator failed for ([182.135.66.27]) [182.135.66.27]:53488: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.172.51
country_id: 2635167
description:
2025-02-06 23:31:12 dovecot_login authenticator failed for (ADMIN) [45.133.172.51]:46972: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.83.138.102
country_id: 1814991
description:
Feb  6 23:31:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.83.138.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.185.159.132
country_id: 3865483
description:
Feb  6 23:32:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.185.159.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.221.59
country_id: 1269750
description:
Feb  6 23:32:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.221.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.100.186.71
country_id: 6252001
description:
Feb  6 23:32:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.100.186.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.221.59
country_id: 1269750
description:
2025-02-06 23:32:27 dovecot_plain authenticator failed for (abts-north-static-059.221.160.122.airtelbroadband.in) [122.160.221.59]:41326: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.103.142
country_id: 1814991
description:
2025-02-06 23:32:31 dovecot_plain authenticator failed for ([58.18.103.142]) [58.18.103.142]:33562: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.87.122.207
country_id: 1880251
description:
Feb  6 23:32:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.87.122.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
country_id: 3469034
description:
Feb  6 23:32:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
country_id: 3469034
description:
2025-02-06 23:32:14 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:26461: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.103.142
country_id: 1814991
description:
Feb  6 23:32:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.103.142 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.252
country_id: 1814991
description:
Feb  6 23:32:40 ait sshd[1472818]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.252  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.84.175
country_id: 1835841
description:
Feb  6 23:32:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.84.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.2.44.54
country_id: 1269750
description:
Feb  6 23:32:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.2.44.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.84.175
country_id: 1835841
description:
2025-02-06 23:32:25 dovecot_login authenticator failed for ([222.114.84.175]) [222.114.84.175]:56846: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.100.186.71
country_id: 6252001
description:
2025-02-06 23:32:29 dovecot_plain authenticator failed for syn-172-100-186-071.res.spectrum.com [172.100.186.71]:56138: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.89.158.49
country_id: 783754
description:
[2025-02-06 23:31:51 +0100] info [webmaild] 185.89.158.49 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.185.159.132
country_id: 3865483
description:
2025-02-06 23:32:20 dovecot_plain authenticator failed for (132.159.185.190.cable.dyn.ridsa.com.ar) [190.185.159.132]:54791: 535 Incorrect authentication data (set_id=ads22a00092y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-02-06 23:32:42 dovecot_plain authenticator failed for (static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:55594: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.2.110
country_id: 3469034
description:
Feb  6 23:32:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.2.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.252
country_id: 1814991
description:
Feb  6 23:32:40 ait sshd[1472818]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.87.122.207
country_id: 1880251
description:
2025-02-06 23:32:41 dovecot_login authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:42306: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.2.110
country_id: 3469034
description:
2025-02-06 23:32:11 dovecot_plain authenticator failed for ([187.12.2.110]) [187.12.2.110]:58173: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 23:32:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.252
country_id: 1814991
description:
Feb  6 23:33:00 ait sshd[1472818]: error: maximum authentication attempts exceeded for root from 218.92.0.252 port 51144 ssh2 [preauth]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 23:32:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.86.48
country_id: 290557
description:
2025-02-06 23:32:50 dovecot_plain authenticator failed for ([94.205.86.48]) [94.205.86.48]:53828: 535 Incorrect authentication data (set_id=ads22a00092y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.116.62
country_id: 732800
description:
2025-02-06 23:32:56 dovecot_plain authenticator failed for (plishlogy) [62.182.116.62]:38759: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.86.48
country_id: 290557
description:
Feb  6 23:32:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.86.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.252
country_id: 1814991
description:
Feb  6 23:32:48 ait sshd[1472818]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.182.116.62
country_id: 732800
description:
Feb  6 23:32:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.182.116.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.121.199.203
country_id: 6252001
description:
Feb  6 23:34:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.121.199.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.176.249.35
country_id: 1835841
description:
Feb  6 23:34:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.176.249.35 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.12.153.108
country_id: 1814991
description:
Feb  6 23:34:02 ait sshd[1473447]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.153.108


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 23:34:12 ait sshd[1473464]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
country_id: 6252001
description:
2025-02-06 23:34:28 dovecot_login authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:52004: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.170.154
country_id: 1835841
description:
Feb  6 23:34:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.170.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.176.249.35
country_id: 1835841
description:
2025-02-06 23:34:42 dovecot_plain authenticator failed for ([112.176.249.35]) [112.176.249.35]:46964: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.153.108
country_id: 1814991
description:
Feb  6 23:34:02 ait sshd[1473447]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.12.153.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
country_id: 1835841
description:
Feb  6 23:34:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2025-02-06 23:34:30 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:41470: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.22.255.28
country_id: 1814991
description:
Feb  6 23:34:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.22.255.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.22.255.28
country_id: 1814991
description:
2025-02-06 23:34:37 dovecot_plain authenticator failed for ([58.22.255.28]) [58.22.255.28]:48164: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.207.50
country_id: 3017382
description:
Feb  6 23:34:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.207.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.207.50
country_id: 3017382
description:
2025-02-06 23:34:24 dovecot_plain authenticator failed for vps-f5bece10.vps.ovh.net [135.125.207.50]:41982: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.6.78.182
country_id: 3469034
description:
Feb  6 23:34:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.6.78.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.170.154
country_id: 1835841
description:
2025-02-06 23:34:40 dovecot_login authenticator failed for ([211.44.170.154]) [211.44.170.154]:54854: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.6.78.182
country_id: 3469034
description:
2025-02-06 23:34:41 dovecot_login authenticator failed for (bd064eb6.virtua.com.br) [189.6.78.182]:13205: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 23:34:12 ait sshd[1473464]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.110.120.96
country_id: 3469034
description:
Feb  6 23:34:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.110.120.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.110.120.96
country_id: 3469034
description:
2025-02-06 23:34:57 dovecot_plain authenticator failed for ([189.110.120.96]) [189.110.120.96]:43696: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.46.79
country_id: 1814991
description:
Feb  6 23:35:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.46.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.46.79
country_id: 1814991
description:
2025-02-06 23:35:12 dovecot_plain authenticator failed for ([117.158.46.79]) [117.158.46.79]:52805: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.64.54
country_id: 1814991
description:
Feb  6 23:34:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.64.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.64.54
country_id: 1814991
description:
2025-02-06 23:34:54 dovecot_plain authenticator failed for ([58.18.64.54]) [58.18.64.54]:33246: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2025-02-06 23:35:47 dovecot_plain authenticator failed for ([220.80.223.144]) [220.80.223.144]:46138: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
country_id: 6252001
description:
Feb  6 23:36:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.86.209.86
country_id: 1814991
description:
Feb  6 23:36:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.86.209.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-02-06 23:36:32 dovecot_plain authenticator failed for ([196.191.212.236]) [213.55.85.202]:23356: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-02-06 23:36:00 dovecot_plain authenticator failed for ([41.220.3.113]) [41.220.3.101]:9415: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.220.168.116
country_id: 2017370
description:
2025-02-06 23:36:31 dovecot_plain authenticator failed for ([31.220.168.116]) [31.220.168.116]:51033: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.220.168.116
country_id: 2017370
description:
Feb  6 23:36:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.220.168.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
country_id: 1835841
description:
Feb  6 23:35:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
country_id: 226074
description:
Feb  6 23:35:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
country_id: 6252001
description:
2025-02-06 23:36:12 dovecot_plain authenticator failed for ([96.79.174.131]) [96.79.174.131]:41907: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
country_id: 337996
description:
Feb  6 23:36:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.86.209.86
country_id: 1814991
description:
2025-02-06 23:36:33 dovecot_plain authenticator failed for ([106.86.209.86]) [106.86.209.86]:43734: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.75.27.252
country_id: 1814991
description:
Feb  6 23:36:43 ait sshd[1474430]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.75.27.252 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.75.27.252
country_id: 1814991
description:
Feb  6 23:36:43 ait sshd[1474430]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.27.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.244.39
country_id: 1269750
description:
2025-02-06 23:37:25 dovecot_login authenticator failed for ([103.69.244.39]) [103.69.244.39]:36926: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.210
country_id: 1814991
description:
Feb  6 23:37:28 ait sshd[1474656]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.210  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
country_id: 1814991
description:
Feb  6 23:37:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 106.75.27.252
country_id: 1814991
description:
Feb  6 23:36:45 ait sshd[1474430]: Failed password for invalid user mse from 106.75.27.252 port 59028 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.15.222.74
country_id: 1814991
description:
2025-02-06 23:36:59 dovecot_plain authenticator failed for ([218.15.222.74]) [218.15.222.74]:14787: 535 Incorrect authentication data (set_id=obiri)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:23-37.35.92.116.235


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.15.222.74
country_id: 1814991
description:
Feb  6 23:36:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.15.222.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.244.39
country_id: 1269750
description:
Feb  6 23:37:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.210
country_id: 1814991
description:
Feb  6 23:37:28 ait sshd[1474656]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
country_id: 1814991
description:
2025-02-06 23:37:36 dovecot_login authenticator failed for ([60.166.31.198]) [60.166.31.198]:39477: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 23:38:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Feb  6 23:38:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.76.127
country_id: 1835841
description:
2025-02-06 23:38:37 dovecot_plain authenticator failed for ([183.107.76.127]) [183.107.76.127]:52761: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.210
country_id: 1814991
description:
Feb  6 23:37:47 ait sshd[1474656]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.210 has been locked due to Imunify RBL


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.210
country_id: 1814991
description:
Feb  6 23:37:49 ait sshd[1474656]: error: maximum authentication attempts exceeded for root from 218.92.0.210 port 5738 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.82
country_id: 1819730
description:
2025-02-06 23:38:26 dovecot_plain authenticator failed for (m121-202-152-82.smartone.com) [121.202.152.82]:35124: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.82
country_id: 1819730
description:
Feb  6 23:38:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.209.18
country_id: 1814991
description:
2025-02-06 23:38:46 dovecot_plain authenticator failed for ([220.189.209.18]) [220.189.209.18]:47624: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.34.165.114
country_id: 6252001
description:
Feb  6 23:38:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.34.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.165.114
country_id: 6252001
description:
2025-02-06 23:38:55 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:42726: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.222.90.178
country_id: 3469034
description:
2025-02-06 23:39:24 dovecot_plain authenticator failed for ([200.222.90.178]) [200.222.90.178]:43886: 535 Incorrect authentication data


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.75.27.252
country_id: 1814991
description:
Feb  6 23:38:51 ait sshd[1475137]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.27.252


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 23:39:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.209.18
country_id: 1814991
description:
Feb  6 23:38:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.209.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 23:38:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.75.27.252
country_id: 1814991
description:
Feb  6 23:38:51 ait sshd[1475137]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.75.27.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 23:39:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.196.92
country_id: 1819730
description:
Feb  6 23:40:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.196.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.196.92
country_id: 1819730
description:
2025-02-06 23:40:05 dovecot_plain authenticator failed for (223-197-196-92.static.imsbiz.com) [223.197.196.92]:65387: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
country_id: 3469034
description:
2025-02-06 23:40:34 dovecot_plain authenticator failed for (200-232-71-201.mdanet.com.br) [189.108.147.210]:59027: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.218.163.130
country_id: 1814991
description:
2025-02-06 23:40:37 dovecot_plain authenticator failed for ([58.218.163.130]) [58.218.163.130]:53746: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-39.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
country_id: 3469034
description:
Feb  6 23:40:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.218.163.130
country_id: 1814991
description:
Feb  6 23:40:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.218.163.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.44
country_id: 6251999
description:
Feb  6 23:40:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.44
country_id: 6251999
description:
2025-02-06 23:40:48 dovecot_plain authenticator failed for ([207.219.222.44]) [207.219.222.44]:32829: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 23:40:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.159.150.111
country_id: 3469034
description:
Feb  6 23:41:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.159.150.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
country_id: 3469034
description:
2025-02-06 23:42:37 dovecot_plain authenticator failed for ([177.43.106.73]) [177.43.106.73]:47607: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.254.47
country_id: 1814991
description:
Feb  6 23:42:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.12.254.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.12.254.47
country_id: 1814991
description:
2025-02-06 23:42:41 dovecot_plain authenticator failed for ([106.12.254.47]) [106.12.254.47]:32549: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 23:42:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
country_id: 3469034
description:
Feb  6 23:42:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.238.192.121
country_id: 2750405
description:
Feb  6 23:43:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.238.192.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.238.192.121
country_id: 2750405
description:
2025-02-06 23:43:02 dovecot_plain authenticator failed for host-5l.vsg1-a.v4.dfn.nl (host-5l.vsg1-a.dfn.nl) [62.238.192.121]:39320: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 158.69.23.79
country_id: 6251999
domain: iric.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:23-43.158.69.23.79||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.124.221.2
country_id: 2750405
description:
Feb  6 23:43:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.124.221.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2025-02-06 23:43:10 dovecot_plain authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:59204: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.212
country_id: 1814991
description:
Feb  6 23:43:18 ait sshd[1476794]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.212  user=root


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.212
country_id: 1814991
description:
Feb  6 23:43:39 ait sshd[1476794]: error: maximum authentication attempts exceeded for root from 218.92.0.212 port 64082 ssh2 [preauth]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.102.39.138
country_id: 3077311
description:
Feb  6 23:42:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.102.39.138 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.69.23.79
country_id: 6251999
domain: iric.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/cache.php||SC:/home/titlemas/public_html/iric.us/images


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.212
country_id: 1814991
description:
Feb  6 23:43:18 ait sshd[1476794]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 23:43:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.91.178.253
country_id: 1835841
description:
Feb  6 23:42:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.91.178.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.91.178.253
country_id: 1835841
description:
2025-02-06 23:42:58 dovecot_plain authenticator failed for ([111.91.178.253]) [111.91.178.253]:55426: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
country_id: 1835841
description:
Feb  6 23:43:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2025-02-06 23:43:38 dovecot_plain authenticator failed for ([222.120.176.6]) [222.120.176.6]:51742: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.138
country_id: 3077311
description:
2025-02-06 23:42:55 dovecot_login authenticator failed for (ADMIN) [212.102.39.138]:39556: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.11.207
country_id: 2017370
description:
Feb  6 23:43:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.11.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.11.207
country_id: 2017370
description:
2025-02-06 23:43:52 dovecot_plain authenticator failed for broadband-5-228-11-207.ip.moscow.rt.ru [5.228.11.207]:53026: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 23:43:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.210.250
country_id: 3469034
description:
Feb  6 23:44:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.210.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.210.250
country_id: 3469034
description:
2025-02-06 23:44:26 dovecot_plain authenticator failed for ([187.12.210.250]) [187.12.210.250]:43425: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 23:44:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.12.68.242
country_id: 1814991
description:
2025-02-06 23:45:44 dovecot_login authenticator failed for ([210.12.68.242]) [210.12.68.242]:40676: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
country_id: 2661886
description:
2025-02-06 23:45:10 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se [83.254.126.238]:60904: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
country_id: 1269750
description:
2025-02-06 23:45:19 dovecot_plain authenticator failed for ([103.93.37.178]) [103.93.37.178]:33896: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.83.189
country_id: 895949
description:
Feb  6 23:44:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.83.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.234.83.189
country_id: 895949
description:
2025-02-06 23:45:01 dovecot_plain authenticator failed for ([197.234.83.189]) [197.234.83.189]:42430: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 23:45:07 ait sshd[1477878]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 23:45:07 ait sshd[1477878]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
country_id: 1269750
description:
2025-02-06 23:45:33 dovecot_plain authenticator failed for ([59.96.62.29]) [59.96.62.29]:41616: 535 Incorrect authentication data (set_id=stquarshie)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:23-45.35.92.116.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.46.88.68
country_id: 1814991
description:
2025-02-06 23:46:00 dovecot_plain authenticator failed for ([115.46.88.68]) [115.46.88.68]:47306: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
country_id: 3351879
description:
2025-02-06 23:45:46 dovecot_plain authenticator failed for ([41.63.165.61]) [41.63.165.61]:64056: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.245.102
country_id: 1835841
description:
2025-02-06 23:45:57 dovecot_login authenticator failed for ([175.203.245.102]) [175.203.245.102]:38256: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.235.94
country_id: 1835841
description:
Feb  6 23:46:14 ait sshd[1478118]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.235.94 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
country_id: 1835841
description:
Feb  6 23:46:14 ait sshd[1478118]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.13.120
country_id: 290557
description:
2025-02-06 23:46:48 dovecot_plain authenticator failed for ([5.31.13.120]) [5.31.13.120]:55461: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.6.160.15
country_id: 1814991
description:
2025-02-06 23:47:09 dovecot_plain authenticator failed for ([218.6.160.15]) [218.6.160.15]:54818: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.67.99
country_id: 6252001
description:
2025-02-06 23:47:11 dovecot_login authenticator failed for (ADMIN) [191.96.67.99]:49342: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.184.97.125
country_id: 953987
description:
[2025-02-06 23:47:14 +0100] info [webmaild] 197.184.97.125 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.70
country_id: 617790
description:
2025-02-06 23:48:11 dovecot_plain authenticator failed for ([185.167.56.70]) [185.167.56.70]:53498: 535 Incorrect authentication data (set_id=eng18a00033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.162.249
country_id: 1668284
description:
2025-02-06 23:47:50 dovecot_plain authenticator failed for 1-34-162-249.hinet-ip.hinet.net [1.34.162.249]:44844: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.2.161.66
country_id: 3469034
description:
2025-02-06 23:47:51 dovecot_plain authenticator failed for ([177.2.161.89]) [177.2.161.66]:41045: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2025-02-06 23:48:04 dovecot_plain authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:41744: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.252.63.242
country_id: 1835841
description:
2025-02-06 23:48:16 dovecot_plain authenticator failed for ([1.252.63.242]) [1.252.63.242]:46466: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.113.122.243
country_id: 1835841
description:
2025-02-06 23:48:23 dovecot_plain authenticator failed for ([210.113.122.243]) [210.113.122.243]:34970: 535 Incorrect authentication data (set_id=eng18a00033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.118.248.19
country_id: 1861060
description:
2025-02-06 23:47:46 dovecot_plain authenticator failed for p173020-obmd01.osaka.ocn.ne.jp [61.118.248.19]:50306: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.34.158.19
country_id: 3144096
description:
2025-02-06 23:48:02 dovecot_plain authenticator failed for ti0004q160-7861.bb.online.no [95.34.158.19]:60478: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.241.15
country_id: 2017370
description:
2025-02-06 23:48:13 dovecot_plain authenticator failed for broadband-5-228-241-15.ip.moscow.rt.ru [5.228.241.15]:54824: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.93.87.71
country_id: 1694008
description:
2025-02-06 23:48:01 dovecot_plain authenticator failed for ([119.93.87.71]) [119.93.87.71]:36464: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 23:47:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.126.21.209
country_id: 1814991
description:
Feb  6 23:47:49 ait sshd[1478660]: pam_imunify(sshd:auth): [IM360_RBL] The IP 101.126.21.209 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.21.209
country_id: 1814991
description:
Feb  6 23:47:49 ait sshd[1478660]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.21.209


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2025-02-06 23:48:20 dovecot_plain authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:38361: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 23:48:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.243.79.22
country_id: 3469034
description:
2025-02-06 23:49:17 dovecot_login authenticator failed for 191-243-79-22.telecomconectividade.net.br [191.243.79.22]:53457: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.40.66
country_id: 1880251
description:
47.128.40.66 - - [06/Feb/2025:23:49:26 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19328114 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/course-tag/analytics/?filtering=1&instructor=2" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.40.66


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.39.230.40
country_id: 1835841
description:
2025-02-06 23:49:05 dovecot_login authenticator failed for ([118.39.230.40]) [118.39.230.40]:4876: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 45.61.162.13
country_id: 6252001
domain: www.lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads21b00261y||WPU:ads21b00261y||RSV:6.65||T:APACHE||MV:23-49.45.61.162.13


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
country_id: 6252001
description:
2025-02-06 23:50:10 dovecot_plain authenticator failed for syn-208-105-196-214.biz.spectrum.com (rrcs-208-105-196-214.nys.biz.rr.com) [208.105.196.214]:43443: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
country_id: 1835841
description:
2025-02-06 23:50:22 dovecot_plain authenticator failed for ([218.147.6.84]) [218.147.6.84]:51040: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.190.69
country_id: 2017370
description:
2025-02-06 23:50:02 dovecot_plain authenticator failed for ([92.255.190.69]) [92.255.190.69]:42532: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-02-06 23:49:57 dovecot_plain authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:43344: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2025-02-06 23:49:50 dovecot_login authenticator failed for ([118.36.234.156]) [118.36.234.156]:48182: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.82.131.20
country_id: 1605651
description:
2025-02-06 23:50:21 dovecot_login authenticator failed for ([184.82.131.20]) [184.82.131.20]:53094: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.6.69.226
country_id: 1814991
description:
2025-02-06 23:51:25 dovecot_plain authenticator failed for ([221.6.69.226]) [221.6.69.226]:43430: 535 Incorrect authentication data (set_id=postmaster@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.128.5
country_id: 6252001
description:
2025-02-06 23:51:42 dovecot_plain authenticator failed for ([170.250.128.5]) [170.250.128.5]:48158: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.208
country_id: 1814991
description:
Feb  6 23:51:16 ait sshd[1480025]: error: maximum authentication attempts exceeded for root from 218.92.0.208 port 22282 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.59.90.121
country_id: 2661886
description:
2025-02-06 23:51:34 dovecot_plain authenticator failed for h-46-59-90-121.a463.priv.bahnhof.se [46.59.90.121]:60125: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.171
country_id: 6252001
description:
2025-02-06 23:51:37 dovecot_plain authenticator failed for syn-184-152-099-171.res.spectrum.com [184.152.99.171]:38546: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2025-02-06 23:51:45 dovecot_login authenticator failed for ([61.73.190.98]) [61.73.190.98]:59897: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.208
country_id: 1814991
description:
Feb  6 23:50:58 ait sshd[1480025]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.208 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 114.130.188.116
country_id: 1210997
description:
[2025-02-06 23:51:02 +0100] info [webmaild] 114.130.188.116 - info@lemsas.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.98.113
country_id: 290557
description:
2025-02-06 23:51:32 dovecot_login authenticator failed for ([91.74.98.113]) [91.74.98.113]:52247: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.122.103.215
country_id: 1835841
description:
2025-02-06 23:51:40 dovecot_plain authenticator failed for ([222.122.103.215]) [222.122.103.215]:38429: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.208
country_id: 1814991
description:
Feb  6 23:50:58 ait sshd[1480025]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.208  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.250
country_id: 1819730
description:
2025-02-06 23:52:37 dovecot_plain authenticator failed for ([121.202.155.250]) [121.202.155.250]:31941: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
country_id: 2017370
description:
2025-02-06 23:52:43 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:55862: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.91.172.21
country_id: 1269750
description:
2025-02-06 23:52:44 dovecot_plain authenticator failed for ([219.91.172.21]) [219.91.172.21]:48566: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.106.198.35
country_id: 1835841
description:
2025-02-06 23:51:51 dovecot_plain authenticator failed for ([222.106.198.35]) [222.106.198.35]:42936: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.145.108.234
country_id: 6251999
description:
2025-02-06 23:52:09 dovecot_plain authenticator failed for ([216.145.108.234]) [216.145.108.234]:55932: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.114.215
country_id: 1168579
description:
2025-02-06 23:52:26 dovecot_plain authenticator failed for ([103.123.114.215]) [103.123.114.215]:33518: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.180.193.176
country_id: 6252001
description:
2025-02-06 23:52:36 dovecot_plain authenticator failed for wsip-184-180-193-176.tu.ok.cox.net [184.180.193.176]:57543: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
country_id: 2017370
description:
2025-02-06 23:52:36 dovecot_plain authenticator failed for ([92.126.223.175]) [92.126.223.175]:36958: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-02-06 23:52:40 dovecot_plain authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:33028: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.180.50
country_id: 1814991
description:
2025-02-06 23:52:42 dovecot_plain authenticator failed for ([124.114.180.50]) [124.114.180.50]:49870: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.216.117
country_id: 1210997
description:
2025-02-06 23:52:00 dovecot_plain authenticator failed for ([103.148.216.98]) [103.148.216.117]:54202: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.59.53
country_id: 617790
description:
2025-02-06 23:52:26 dovecot_plain authenticator failed for ([185.167.59.53]) [185.167.59.53]:59832: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.233
country_id: 1269750
description:
2025-02-06 23:52:29 dovecot_plain authenticator failed for (nsg-corporate-233.228.187.122.airtel.in) [122.187.228.233]:47158: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.66.228.194
country_id: 1880251
description:
2025-02-06 23:52:32 dovecot_plain authenticator failed for bb115-66-228-194.singnet.com.sg [115.66.228.194]:41219: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.180.240.96
country_id: 1282988
description:
2025-02-06 23:52:29 dovecot_plain authenticator failed for ([103.180.240.96]) [103.180.240.96]:35294: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-02-06 23:52:33 dovecot_plain authenticator failed for ([50.188.204.213]) [50.188.204.213]:49567: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.64.10
country_id: 2413451
description:
2025-02-06 23:52:35 dovecot_plain authenticator failed for ([102.221.64.10]) [102.221.64.10]:58181: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.166.162.78
country_id: 1814991
description:
2025-02-06 23:52:40 dovecot_plain authenticator failed for ([180.166.162.78]) [180.166.162.78]:39767: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.40.155
country_id: 1814991
description:
2025-02-06 23:51:54 dovecot_plain authenticator failed for ([60.174.40.155]) [60.174.40.155]:56183: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.148.216.117
country_id: 1210997
description:
Feb  6 23:51:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.148.216.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.161.68
country_id: 99237
description:
2025-02-06 23:51:59 dovecot_plain authenticator failed for ([65.20.161.68]) [65.20.161.68]:52048: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.164.135.251
country_id: 1835841
description:
2025-02-06 23:52:28 dovecot_plain authenticator failed for ([121.164.135.251]) [121.164.135.251]:56919: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.188.40.123
country_id: 2017370
description:
2025-02-06 23:52:40 dovecot_plain authenticator failed for (90.188.40.123.stbur.ru) [90.188.40.123]:46336: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.144.140
country_id: 1814991
description:
2025-02-06 23:52:42 dovecot_plain authenticator failed for ([112.15.144.140]) [112.15.144.140]:52024: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.185.204.10
country_id: 6252001
description:
2025-02-06 23:52:38 dovecot_plain authenticator failed for syn-107-185-204-010.res.spectrum.com [107.185.204.10]:59768: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.230
country_id: 1269750
description:
2025-02-06 23:52:27 dovecot_plain authenticator failed for (nsg-corporate-230.228.187.122.airtel.in) [122.187.228.230]:35713: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.84.62.98
country_id: 1269750
description:
2025-02-06 23:52:28 dovecot_plain authenticator failed for ([103.177.205.100]) [58.84.62.98]:18175: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.44.165
country_id: 1880251
description:
2025-02-06 23:52:43 dovecot_plain authenticator failed for ([49.245.44.165]) [49.245.44.165]:47550: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.248.246.134
country_id: 1861060
description:
2025-02-06 23:52:37 dovecot_plain authenticator failed for st6534.mas4401.y-tokyo.nttpc.ne.jp [160.248.246.134]:53900: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.47.66
country_id: 2328926
description:
2025-02-06 23:52:04 dovecot_plain authenticator failed for ([197.211.47.66]) [197.211.47.66]:35148: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.136
country_id: 2017370
description:
2025-02-06 23:52:26 dovecot_plain authenticator failed for ([178.178.194.136]) [178.178.194.136]:50254: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
country_id: 6252001
description:
2025-02-06 23:52:36 dovecot_plain authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:55486: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.127.114
country_id: 2017370
description:
2025-02-06 23:52:36 dovecot_plain authenticator failed for ([178.178.127.114]) [178.178.127.114]:32323: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.131.79
country_id: 1814991
description:
2025-02-06 23:52:31 dovecot_plain authenticator failed for ([111.53.131.79]) [111.53.131.79]:53056: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.248.246.134
country_id: 1861060
description:
Feb  6 23:52:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.248.246.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.84.18
country_id: 895949
description:
2025-02-06 23:52:29 dovecot_plain authenticator failed for ([41.216.84.18]) [41.216.84.18]:38187: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.103
country_id: 1819730
description:
2025-02-06 23:52:35 dovecot_plain authenticator failed for (m121-202-195-103.smartone.com) [121.202.195.103]:8579: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
country_id: 3895114
description:
2025-02-06 23:52:39 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:48082: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
country_id: 2661886
description:
2025-02-06 23:51:52 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:47964: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.232.39.165
country_id: 2510769
description:
2025-02-06 23:52:24 dovecot_plain authenticator failed for ([185.232.39.165]) [185.232.39.165]:40096: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.20.146
country_id: 2017370
description:
2025-02-06 23:52:25 dovecot_plain authenticator failed for ([31.173.20.146]) [31.173.20.146]:56958: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.84.62.98
country_id: 1269750
description:
Feb  6 23:52:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.84.62.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.179.104
country_id: 6252001
description:
2025-02-06 23:52:46 dovecot_plain authenticator failed for ([23.94.179.104]) [23.94.179.104]:50748: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.255.221
country_id: 1835841
description:
2025-02-06 23:52:52 dovecot_plain authenticator failed for ([218.146.255.221]) [218.146.255.221]:60301: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
country_id: 1269750
description:
2025-02-06 23:53:02 dovecot_plain authenticator failed for (nsg-static-171.125.76.182-airtel.com) [182.76.87.90]:55592: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.184
country_id: 1269750
description:
2025-02-06 23:53:07 dovecot_plain authenticator failed for (nsg-corporate-184.230.187.122.airtel.in) [122.187.230.184]:35551: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.27
country_id: 1814991
description:
2025-02-06 23:52:51 dovecot_plain authenticator failed for ([182.135.66.27]) [182.135.66.27]:49426: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.214.92.142
country_id: 1814991
description:
2025-02-06 23:52:51 dovecot_plain authenticator failed for (142.92.214.139.adsl-pool.jlccptt.net.cn) [139.214.92.142]:45469: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.186.57
country_id: 290557
description:
2025-02-06 23:52:52 dovecot_plain authenticator failed for ([91.74.186.57]) [91.74.186.57]:59101: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.243.43.30
country_id: 1835841
description:
2025-02-06 23:53:13 dovecot_plain authenticator failed for ([211.243.43.30]) [211.243.43.30]:45610: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
country_id: 1835841
description:
2025-02-06 23:52:54 dovecot_plain authenticator failed for ([203.128.181.121]) [203.128.181.121]:48529: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.196.144.45
country_id: 1814991
description:
2025-02-06 23:52:54 dovecot_plain authenticator failed for ([183.196.144.45]) [183.196.144.45]:52553: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.178
country_id: 1835841
description:
2025-02-06 23:53:09 dovecot_plain authenticator failed for ([218.149.228.178]) [218.149.228.178]:48464: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.178
country_id: 1835841
description:
Feb  6 23:53:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.0.170
country_id: 3585968
description:
2025-02-06 23:52:46 dovecot_plain authenticator failed for ([179.51.0.170]) [179.51.0.170]:45050: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.37.35.155
country_id: 6252001
description:
2025-02-06 23:52:47 dovecot_plain authenticator failed for c-68-37-35-155.hsd1.mi.comcast.net [68.37.35.155]:53614: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.76.127
country_id: 1835841
description:
2025-02-06 23:52:50 dovecot_plain authenticator failed for ([183.107.76.127]) [183.107.76.127]:49376: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.106.154.137
country_id: 1269750
description:
2025-02-06 23:54:05 dovecot_login authenticator failed for ([103.106.154.137]) [103.106.154.137]:43012: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-02-06 23:54:18 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:45368: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:23-54.35.92.116.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.88.96.37
country_id: 1814991
description:
2025-02-06 23:54:29 dovecot_plain authenticator failed for ([58.131.97.5]) [180.88.96.37]:2826: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 23:54:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.181.1.49
country_id: 6252001
description:
2025-02-06 23:54:18 dovecot_plain authenticator failed for static-47-181-1-49.lsan.ca.frontiernet.net [47.181.1.49]:57004: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
country_id: 1835841
description:
Feb  6 23:54:33 ait sshd[1481485]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.235.94
country_id: 1835841
description:
Feb  6 23:54:33 ait sshd[1481485]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.235.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.88.96.37
country_id: 1814991
description:
Feb  6 23:54:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.88.96.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2025-02-06 23:54:31 dovecot_plain authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:52404: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.17.6.119
country_id: 1814991
description:
2025-02-06 23:54:36 dovecot_plain authenticator failed for (119.6.17.58.adsl-pool.jx.chinaunicom.com) [58.17.6.119]:57353: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.45.68
country_id: 1835841
description:
2025-02-06 23:54:20 dovecot_login authenticator failed for ([218.146.45.68]) [218.146.45.68]:42008: 535 Incorrect authentication data (set_id=dm)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-54.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.184
country_id: 1269750
description:
2025-02-06 23:54:46 dovecot_plain authenticator failed for (nsg-corporate-184.230.187.122.airtel.in) [122.187.230.184]:39726: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.246.141
country_id: 290557
description:
2025-02-06 23:55:19 dovecot_plain authenticator failed for ([94.204.246.141]) [94.204.246.141]:57582: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2025-02-06 23:55:21 dovecot_plain authenticator failed for ([116.114.94.242]) [116.114.94.242]:46302: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.24.194.207
country_id: 1835841
description:
2025-02-06 23:55:35 dovecot_plain authenticator failed for ([59.24.194.207]) [59.24.194.207]:46372: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
country_id: 2017370
description:
2025-02-06 23:55:10 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:56866: 535 Incorrect authentication data (set_id=ads20a00071y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.215.126.22
country_id: 1814991
description:
2025-02-06 23:55:02 dovecot_plain authenticator failed for ([60.215.126.22]) [60.215.126.22]:51200: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.222.137.41
country_id: 6251999
description:
2025-02-06 23:55:07 dovecot_plain authenticator failed for vps-09fc8581.vps.ovh.ca [51.222.137.41]:59130: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
country_id: 1835841
description:
2025-02-06 23:56:17 dovecot_plain authenticator failed for ([175.205.191.27]) [175.205.191.27]:42124: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.190.181
country_id: 6252001
description:
2025-02-06 23:56:05 dovecot_plain authenticator failed for ([47.149.190.181]) [47.149.190.181]:61407: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.122.203
country_id: 3175395
description:
2025-02-06 23:57:16 dovecot_plain authenticator failed for ([82.84.122.203]) [82.84.122.203]:64922: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.228.225.91
country_id: 1668284
description:
2025-02-06 23:57:32 dovecot_plain authenticator failed for 125-228-225-91.hinet-ip.hinet.net [125.228.225.91]:45637: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.164.240
country_id: 6252001
description:
2025-02-06 23:58:06 dovecot_login authenticator failed for (ADMIN) [181.214.164.240]:42104: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.113.43.143
country_id: 1269750
description:
2025-02-06 23:59:53 dovecot_plain authenticator failed for vps-b909f986.vps.ovh.ca [148.113.43.143]:57286: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.113
country_id: 1814991
description:
2025-02-07 00:02:13 dovecot_plain authenticator failed for (113.20.167.124.adsl-pool.sx.cn) [124.167.20.113]:33395: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.56.11.148
country_id: 3175395
description:
2025-02-07 00:02:21 dovecot_plain authenticator failed for 93-56-11-148.ip287.fastwebnet.it [93.56.11.148]:58189: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.183.178
country_id: 2017370
description:
2025-02-06 23:59:59 dovecot_plain authenticator failed for broadband-5-228-183-178.ip.moscow.rt.ru [5.228.183.178]:7476: 535 Incorrect authentication data (set_id=eng21a00034y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.40.147
country_id: 1880251
description:
47.128.40.147 - - [07/Feb/2025:00:00:36 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6833935 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/8/?filter_course-language=198&filtering=1&instructor=2" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.40.147


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.70.166.51
country_id: 298795
description:
Feb  7 00:00:07 ait sshd[1483790]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.70.166.51


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.132.232
country_id: 6252001
description:
2025-02-07 00:00:15 dovecot_login authenticator failed for ([75.110.132.232]) [75.110.132.232]:60006: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.46.79
country_id: 1814991
description:
2025-02-07 00:00:21 dovecot_plain authenticator failed for ([117.158.46.79]) [117.158.46.79]:47723: 535 Incorrect authentication data (set_id=eng21a00034y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.72
country_id: 298795
description:
2025-02-07 00:01:47 dovecot_plain authenticator failed for ([95.0.252.72]) [95.0.252.72]:53946: 535 Incorrect authentication data (set_id=assdas2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 00:02:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.191.163.102
country_id: 1814991
description:
2025-02-07 00:02:06 dovecot_plain authenticator failed for ([61.191.163.102]) [61.191.163.102]:36892: 535 Incorrect authentication data (set_id=assdas2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.218.58
country_id: 1835841
description:
2025-02-07 00:00:05 dovecot_login authenticator failed for ([14.35.218.58]) [14.35.218.58]:40409: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.248.26.21
country_id: 6252001
description:
2025-02-07 00:02:30 dovecot_login authenticator failed for syn-067-248-026-021.res.spectrum.com [67.248.26.21]:43296: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-02-07 00:03:15 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:56644: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:00-03.35.92.116.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.66.222
country_id: 290557
description:
2025-02-07 00:03:26 dovecot_login authenticator failed for ([94.204.66.222]) [94.204.66.222]:60292: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2025-02-07 00:03:27 dovecot_plain authenticator failed for ([62.201.228.210]) [62.201.228.210]:42756: 535 Incorrect authentication data (set_id=dzidonu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 00:02:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.7.52.183
country_id: 1814991
description:
2025-02-07 00:03:01 dovecot_login authenticator failed for ([110.7.52.183]) [110.7.52.183]:37264: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.79
country_id: 1819730
description:
2025-02-07 00:03:11 dovecot_login authenticator failed for (m121-202-155-79.smartone.com) [121.202.155.79]:1941: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.233.1.108
country_id: 6251999
description:
Feb  7 00:03:49 ait sshd[1484835]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.233.1.108 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.233.1.108
country_id: 6251999
description:
Feb  7 00:03:49 ait sshd[1484835]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.233.1.108


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.177.247.242
country_id: 1269750
description:
2025-02-07 00:03:05 dovecot_plain authenticator failed for (host-247342.fivenetwork.com) [202.177.247.242]:43942: 535 Incorrect authentication data (set_id=dzidonu@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.109.20.192
country_id: 1643084
description:
2025-02-07 00:03:25 dovecot_login authenticator failed for (ip-20-192.datautama.net.id) [112.109.20.192]:38529: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 00:04:30 ait sshd[1485183]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.233.1.108
country_id: 6251999
description:
Feb  7 00:03:52 ait sshd[1484835]: Failed password for invalid user deploy from 52.233.1.108 port 46364 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 00:04:30 ait sshd[1485183]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.72
country_id: 298795
description:
Feb  7 00:05:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.72
country_id: 298795
description:
2025-02-07 00:05:20 dovecot_login authenticator failed for ([95.0.252.72]) [95.0.252.72]:39812: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
country_id: 1210997
description:
Feb  7 00:05:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
country_id: 1210997
description:
2025-02-07 00:05:29 dovecot_login authenticator failed for ([103.124.54.14]) [103.124.54.14]:36626: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.43.231.186
country_id: 3175395
description:
Feb  7 00:05:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.43.231.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
country_id: 1562822
description:
2025-02-07 00:05:36 dovecot_login authenticator failed for ([171.244.40.236]) [171.244.40.236]:23048: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.43.231.186
country_id: 3175395
description:
2025-02-07 00:05:38 dovecot_login authenticator failed for host-88-43-231-186.business.telecomitalia.it (host-88-43-231-188.business.telecomitalia.it) [88.43.231.186]:33110: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
country_id: 1562822
description:
Feb  7 00:05:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.180.176.75
country_id: 1269750
description:
Feb  7 00:06:23 ait sshd[1485834]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.180.176.75 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.180.176.75
country_id: 1269750
description:
Feb  7 00:06:23 ait sshd[1485834]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.180.176.75


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.98
country_id: 1269750
description:
Feb  7 00:07:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.166.112.154
country_id: 6252001
description:
2025-02-07 00:07:30 dovecot_login authenticator failed for (173-166-112-154-newengland.hfc.comcastbusiness.net) [173.166.112.154]:64901: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.19
country_id: 6290252
description:
2025-02-07 00:07:32 dovecot_login authenticator failed for (ADMIN) [37.46.115.19]:56446: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.33.171.65
country_id: 3996063
description:
Feb  7 00:07:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.33.171.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.210.250
country_id: 3469034
description:
2025-02-07 00:07:42 dovecot_plain authenticator failed for ([187.12.210.250]) [187.12.210.250]:49089: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
country_id: 3996063
description:
2025-02-07 00:07:42 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:1886: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.132.238.43
country_id: 6252001
description:
Feb  7 00:07:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.132.238.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.166.112.154
country_id: 6252001
description:
Feb  7 00:07:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.166.112.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.98
country_id: 1269750
description:
2025-02-07 00:07:30 dovecot_plain authenticator failed for ([103.190.91.98]) [103.190.91.98]:51531: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
country_id: 2077456
description:
Feb  7 00:07:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
country_id: 2077456
description:
2025-02-07 00:07:38 dovecot_plain authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:49766: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.210.250
country_id: 3469034
description:
Feb  7 00:07:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.210.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-02-07 00:07:49 dovecot_plain authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:48484: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.225.236
country_id: 732800
description:
2025-02-07 00:08:07 dovecot_login authenticator failed for 95-87-225-236.ip.btc-net.bg [95.87.225.236]:52122: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 00:08:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.38.239.52
country_id: 1835841
description:
Feb  7 00:08:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.38.239.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.38.239.52
country_id: 1835841
description:
2025-02-07 00:08:22 dovecot_login authenticator failed for ([118.38.239.52]) [118.38.239.52]:42412: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.225.236
country_id: 732800
description:
Feb  7 00:08:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.225.236 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.172.53.80
country_id: 298795
description:
[2025-02-07 00:09:10 +0100] info [webmaild] 78.172.53.80 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-09.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.233.1.108
country_id: 6251999
description:
Feb  7 00:08:55 ait sshd[1486524]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.233.1.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.180.176.75
country_id: 1269750
description:
Feb  7 00:09:49 ait sshd[1486932]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.180.176.75 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.233.1.108
country_id: 6251999
description:
Feb  7 00:08:55 ait sshd[1486524]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.233.1.108


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.180.176.75
country_id: 1269750
description:
Feb  7 00:09:49 ait sshd[1486932]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.180.176.75


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.197.250.3
country_id: 1210997
description:
[2025-02-07 00:09:54 +0100] info [webmaild] 103.197.250.3 - info@gvu.university "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-02-07 00:10:19 dovecot_plain authenticator failed for ([128.106.196.150]) [128.106.196.150]:47149: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 00:10:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.233.1.108
country_id: 6251999
description:
Feb  7 00:10:07 ait sshd[1487320]: Failed password for invalid user dev from 52.233.1.108 port 50854 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.125.94
country_id: 1880251
description:
2025-02-07 00:10:20 dovecot_plain authenticator failed for (94.125.156.175.unknown.m1.com.sg) [175.156.125.94]:35159: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.177.209.66
country_id: 1814991
description:
Feb  7 00:10:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.177.209.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.177.209.66
country_id: 1814991
description:
2025-02-07 00:10:40 dovecot_plain authenticator failed for ([42.177.209.66]) [42.177.209.66]:45664: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.233.1.108
country_id: 6251999
description:
Feb  7 00:10:05 ait sshd[1487320]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.233.1.108


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
country_id: 1880251
description:
Feb  7 00:10:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.125.94
country_id: 1880251
description:
Feb  7 00:10:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.180.176.75
country_id: 1269750
description:
Feb  7 00:09:51 ait sshd[1486932]: Failed password for invalid user deploy from 103.180.176.75 port 55090 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.233.1.108
country_id: 6251999
description:
Feb  7 00:10:05 ait sshd[1487320]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.233.1.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.6.78.182
country_id: 3469034
description:
Feb  7 00:11:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.6.78.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.6.78.182
country_id: 3469034
description:
2025-02-07 00:11:42 dovecot_plain authenticator failed for ([189.6.78.182]) [189.6.78.182]:58191: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.210.84.220
country_id: 1835841
description:
2025-02-07 00:11:44 dovecot_plain authenticator failed for ([175.210.84.220]) [175.210.84.220]:43752: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.161.14.83
country_id: 3996063
description:
Feb  7 00:10:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.161.14.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.117.0.253
country_id: 1835841
description:
Feb  7 00:11:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.117.0.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.159.14.187
country_id: 3469034
description:
2025-02-07 00:11:40 dovecot_plain authenticator failed for (200-168-190-81.jandaia.com) [200.159.14.187]:51705: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.180.176.75
country_id: 1269750
description:
Feb  7 00:11:15 ait sshd[1487714]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.180.176.75


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
country_id: 1835841
description:
Feb  7 00:11:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2025-02-07 00:11:26 dovecot_plain authenticator failed for ([218.149.235.152]) [218.149.235.152]:39432: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.159.14.187
country_id: 3469034
description:
Feb  7 00:11:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.159.14.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.210.84.220
country_id: 1835841
description:
Feb  7 00:11:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.210.84.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.14.83
country_id: 3996063
description:
2025-02-07 00:10:55 dovecot_plain authenticator failed for (187.161.14.83-clientes-izzi.mx) [187.161.14.83]:53099: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.180.176.75
country_id: 1269750
description:
Feb  7 00:11:15 ait sshd[1487714]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.180.176.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.4.81.206
country_id: 2658434
description:
Feb  7 00:11:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.4.81.206 has been locked due to Imunify RBL


