# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.176.57
description:
Feb  5 06:35:24 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.176.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.182.116.64
description:
Feb  5 06:35:51 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.182.116.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.105.67.102
description:
Feb  5 06:35:51 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.105.67.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-02-05 06:35:09 dovecot_plain authenticator failed for ([77.51.214.170]) [77.51.214.170]:49372: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.184.14.127
description:
Feb  5 06:35:11 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.184.14.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.248.1.199
description:
2025-02-05 06:35:14 dovecot_plain authenticator failed for (ip-199-1-248-87.eidsiva.net) [87.248.1.199]:44829: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.202.59.203
description:
2025-02-05 06:35:15 dovecot_plain authenticator failed for (dyn-cable-cust.203.59.202.213.quicknet.ch) [213.202.59.203]:32776: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.241.168
description:
2025-02-05 06:35:21 dovecot_plain authenticator failed for ([196.207.241.168]) [196.207.241.168]:49285: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.90.114
description:
Feb  5 06:35:36 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.90.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
description:
2025-02-05 06:35:36 dovecot_plain authenticator failed for (189-108-147-210.customer.tdatabrasil.net.br) [189.108.147.210]:42016: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Feb  5 06:36:05 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.7.10
description:
2025-02-05 06:35:27 dovecot_plain authenticator failed for ([120.194.7.10]) [120.194.7.10]:59970: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
description:
2025-02-05 06:35:28 dovecot_plain authenticator failed for ([106.51.120.94]) [106.51.220.33]:29330: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.252.148
description:
Feb  5 06:35:43 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.252.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
description:
2025-02-05 06:35:14 dovecot_plain authenticator failed for ([59.99.153.21]) [59.99.153.21]:30914: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
description:
2025-02-05 06:35:15 dovecot_plain authenticator failed for (148166.telemar.net.br) [200.165.148.166]:33879: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.130.70.80
description:
Feb  5 06:35:16 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.130.70.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.124.42.26
description:
Feb  5 06:35:18 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.124.42.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.235
description:
2025-02-05 06:35:28 dovecot_plain authenticator failed for 111-70-23-235.emome-ip.hinet.net [111.70.23.235]:39371: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Feb  5 06:35:07 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.47.63.37
description:
Feb  5 06:35:11 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.47.63.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.124.119.7
description:
2025-02-05 06:35:13 dovecot_plain authenticator failed for ([118.122.255.5]) [118.124.119.7]:30394: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.3.16.128
description:
2025-02-05 06:35:24 dovecot_plain authenticator failed for 128.16.3.213.static.wline.lns.sme.cust.swisscom.ch [213.3.16.128]:58673: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.72.156
description:
Feb  5 06:35:44 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.72.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.232.39.165
description:
2025-02-05 06:35:58 dovecot_login authenticator failed for ([185.232.39.165]) [185.232.39.165]:43944: 535 Incorrect authentication data (set_id=ads23b00195y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.172.79.206
description:
Feb  5 06:35:07 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.172.79.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.222.171.6
description:
2025-02-05 06:35:12 dovecot_login authenticator failed for 6.ip-92-222-171.eu [92.222.171.6]:57664: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.21.148
description:
2025-02-05 06:35:14 dovecot_plain authenticator failed for ([221.167.21.148]) [221.167.21.148]:35956: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.65.203.82
description:
Feb  5 06:35:29 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.65.203.82 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.96.145.202
description:
Feb  5 06:35:58 ait sshd[382149]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.96.145.202


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.201.85.163
description:
Feb  5 06:35:10 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.201.85.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.192.29.74
description:
2025-02-05 06:35:16 dovecot_plain authenticator failed for ([120.192.29.74]) [120.192.29.74]:43206: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
description:
2025-02-05 06:35:20 dovecot_plain authenticator failed for ([203.123.219.137]) [203.123.219.137]:57554: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.186.57
description:
Feb  5 06:35:08 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.186.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.230.179
description:
2025-02-05 06:35:21 dovecot_plain authenticator failed for 189.115.230.179.dynamic.adsl.gvt.net.br [189.115.230.179]:59527: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.176.57
description:
2025-02-05 06:35:26 dovecot_plain authenticator failed for ([39.152.176.57]) [39.152.176.57]:46654: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.86.87
description:
2025-02-05 06:35:45 dovecot_plain authenticator failed for c-73-199-86-87.hsd1.nj.comcast.net (derettly) [73.199.86.87]:40382: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.133.182
description:
2025-02-05 06:36:01 dovecot_login authenticator failed for ([61.81.133.182]) [61.81.133.182]:49759: 535 Incorrect authentication data (set_id=ads23b00195y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.172.79.206
description:
2025-02-05 06:35:09 dovecot_plain authenticator failed for ([211.172.79.206]) [211.172.79.206]:52136: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.167.21.148
description:
Feb  5 06:35:12 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.167.21.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.32
description:
2025-02-05 06:35:13 dovecot_plain authenticator failed for ([122.187.229.32]) [122.187.229.32]:46389: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.12.201.7
description:
Feb  5 06:35:15 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.12.201.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.40.10
description:
2025-02-05 06:35:15 dovecot_plain authenticator failed for ([112.6.73.140]) [221.2.40.10]:56923: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.124.14
description:
Feb  5 06:35:21 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.124.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.6.250.109
description:
2025-02-05 06:35:07 dovecot_plain authenticator failed for 109.250.6.51.dyn.plus.net [51.6.250.109]:51212: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.21.28.237
description:
Feb  5 06:35:10 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.21.28.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.53.66
description:
2025-02-05 06:35:24 dovecot_plain authenticator failed for (58-115-53-66.twt1.com.tw) [58.115.53.66]:40734: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.72.156
description:
2025-02-05 06:35:46 dovecot_login authenticator failed for ([95.165.72.156]) [95.165.72.156]:54060: 535 Incorrect authentication data (set_id=ads23b00195y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.96.145.202
description:
Feb  5 06:35:58 ait sshd[382149]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.96.145.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.204.158.2
description:
2025-02-05 06:35:18 dovecot_plain authenticator failed for 2.189-204-158.bestelclientes.com.mx [189.204.158.2]:53975: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.220.33
description:
Feb  5 06:35:26 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.220.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.14.127
description:
2025-02-05 06:35:13 dovecot_plain authenticator failed for ([112.184.14.127]) [112.184.14.127]:35182: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
description:
2025-02-05 06:35:16 dovecot_plain authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:53367: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.206.42
description:
Feb  5 06:35:25 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.206.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.77.25.108
description:
2025-02-05 06:35:12 dovecot_plain authenticator failed for (static-76-77-25-108.networklubbock.net) [76.77.25.108]:55315: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.116
description:
2025-02-05 06:35:16 dovecot_plain authenticator failed for (116.20.167.124.adsl-pool.sx.cn) [124.167.20.116]:54779: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.90.114
description:
2025-02-05 06:35:38 dovecot_plain authenticator failed for ([58.18.90.114]) [58.18.90.114]:48393: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.116.64
description:
2025-02-05 06:35:53 dovecot_plain authenticator failed for (upenous) [62.182.116.64]:43034: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.11.145.81
description:
2025-02-05 06:35:08 dovecot_plain authenticator failed for ([121.11.145.81]) [121.11.145.81]:34753: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.248.1.199
description:
Feb  5 06:35:12 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.248.1.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.225.239.115
description:
Feb  5 06:35:19 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.225.239.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.115.53.66
description:
Feb  5 06:35:22 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.115.53.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.222.171.6
description:
Feb  5 06:35:10 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.222.171.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.201.7
description:
2025-02-05 06:35:17 dovecot_plain authenticator failed for ([59.12.201.7]) [59.12.201.7]:41928: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
description:
2025-02-05 06:35:25 dovecot_plain authenticator failed for ([116.114.84.246]) [116.114.84.246]:50056: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.105.67.102
description:
2025-02-05 06:35:53 dovecot_login authenticator failed for 67-105-177-102.netprimus.net.br [177.105.67.102]:37900: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.232.39.165
description:
Feb  5 06:35:56 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.232.39.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.197.38
description:
2025-02-05 06:35:17 dovecot_plain authenticator failed for ([117.211.197.38]) [117.211.197.38]:56926: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.94.228.61
description:
[2025-02-05 06:35:51 +0100] info [webmaild] 181.94.228.61 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.3.16.128
description:
Feb  5 06:35:22 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.3.16.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.11.145.81
description:
Feb  5 06:35:06 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.11.145.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.170.28
description:
Feb  5 06:35:06 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.170.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.245
description:
Feb  5 06:35:08 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.34.128.40
description:
Feb  5 06:35:11 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.34.128.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.100.184.80
description:
2025-02-05 06:35:12 dovecot_plain authenticator failed for (80-184-100-101.myrepublic.com.sg) [101.100.184.80]:58492: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.202.59.203
description:
Feb  5 06:35:13 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.202.59.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.192.29.74
description:
Feb  5 06:35:14 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.192.29.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
description:
Feb  5 06:35:34 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.21.28.237
description:
2025-02-05 06:35:12 dovecot_plain authenticator failed for host-79-21-28-237.retail.telecomitalia.it [79.21.28.237]:38308: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.97.138
description:
2025-02-05 06:35:14 dovecot_plain authenticator failed for ([1.180.97.138]) [1.180.97.138]:44808: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.253.226
description:
Feb  5 06:35:14 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.253.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.199.86.87
description:
Feb  5 06:35:43 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.199.86.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.97.138
description:
Feb  5 06:35:12 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.97.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.165.148.166
description:
Feb  5 06:35:13 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.165.148.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.206.42
description:
2025-02-05 06:35:27 dovecot_plain authenticator failed for ([122.227.206.42]) [122.227.206.42]:34214: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.227.200.201
description:
2025-02-05 06:35:10 dovecot_plain authenticator failed for ([171.227.200.201]) [171.227.200.201]:7417: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.245
description:
2025-02-05 06:35:10 dovecot_plain authenticator failed for (m121-202-152-245.smartone.com) [121.202.152.245]:28707: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.77.25.108
description:
Feb  5 06:35:10 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.77.25.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.211.197.38
description:
Feb  5 06:35:15 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.211.197.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.204.158.2
description:
Feb  5 06:35:16 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.204.158.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.230.179
description:
Feb  5 06:35:19 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.230.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
description:
2025-02-05 06:35:23 dovecot_plain authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:38178: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.207.241.168
description:
Feb  5 06:35:19 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.207.241.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.225.239.115
description:
2025-02-05 06:35:21 dovecot_plain authenticator failed for ([58.225.239.115]) [58.225.239.115]:44868: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.65.203.82
description:
2025-02-05 06:35:31 dovecot_login authenticator failed for ([63.65.203.82]) [63.65.203.82]:37639: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.92.192.154
description:
2025-02-05 06:36:47 dovecot_login authenticator failed for (187-92-192-154.customer.tdatabrasil.net.br) [187.92.192.154]:32869: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.82
description:
2025-02-05 06:36:48 dovecot_login authenticator failed for (m121-202-152-82.smartone.com) [121.202.152.82]:4847: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.152
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/engine1/images/images/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.122.132.241
description:
Feb  5 06:36:29 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.122.132.241 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.36.126.147
description:
[2025-02-05 06:36:21 +0100] info [webmaild] 138.36.126.147 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.243.50
description:
2025-02-05 06:36:33 dovecot_login authenticator failed for ([117.158.243.50]) [117.158.243.50]:43114: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.132.241
description:
2025-02-05 06:36:31 dovecot_login authenticator failed for ([157.122.132.241]) [157.122.132.241]:41501: 535 Incorrect authentication data (set_id=ads23b00195y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 06:36:41 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.94.38.131
description:
[2025-02-05 06:36:41 +0100] info [webmaild] 138.94.38.131 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
description:
2025-02-05 06:36:23 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:32788: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.38.45.2
description:
[2025-02-05 06:36:22 +0100] info [webmaild] 177.38.45.2 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.243.50
description:
Feb  5 06:36:31 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.243.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.92.192.154
description:
Feb  5 06:36:45 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.92.192.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.82
description:
Feb  5 06:36:46 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-02-05 06:36:07 dovecot_login authenticator failed for ([59.98.150.190]) [122.160.68.46]:56436: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.191.27
description:
Feb  5 06:36:21 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.191.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.248.55
description:
Feb  5 06:37:47 ait sshd[382792]: pam_imunify(sshd:auth): [IM360_RBL] The IP 209.38.248.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 06:37:56 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.179.158
description:
2025-02-05 06:37:26 dovecot_login authenticator failed for broadband-77-37-179-158.ip.moscow.rt.ru [77.37.179.158]:50248: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.165.243.10
description:
Feb  5 06:37:31 ait sshd[382723]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.165.243.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.189.234.37
description:
Feb  5 06:37:33 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.189.234.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.189.234.37
description:
2025-02-05 06:37:35 dovecot_login authenticator failed for (ip103-189-234-37.cloudhost.web.id) [103.189.234.37]:34200: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.179.158
description:
Feb  5 06:37:24 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.179.158 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.165.243.10
description:
Feb  5 06:37:31 ait sshd[382723]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.165.243.10


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.88.67.1
description:
Feb  5 06:37:40 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.88.67.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.88.67.1
description:
2025-02-05 06:37:42 dovecot_plain authenticator failed for (wtl.worldcall.net.pk) [111.88.67.1]:57736: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 209.38.248.55
description:
Feb  5 06:37:47 ait sshd[382792]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.248.55


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.19.149
description:
2025-02-05 06:38:06 dovecot_login authenticator failed for 111-70-19-149.emome-ip.hinet.net [111.70.19.149]:36748: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.54.16.115
description:
2025-02-05 06:38:24 dovecot_login authenticator failed for playmail20191.fvds.ru [103.54.16.115]:11480: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.233.134
description:
Feb  5 06:38:25 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.233.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.182.89.19
description:
Feb  5 06:38:36 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.182.89.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.149.93
description:
Feb  5 06:38:21 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.149.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.217.255.171
description:
Feb  5 06:38:21 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.217.255.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.220.209.59
description:
Feb  5 06:38:25 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.220.209.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.233.134
description:
2025-02-05 06:38:27 dovecot_plain authenticator failed for ([27.45.233.134]) [27.45.233.134]:48100: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
description:
Feb  5 06:38:44 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
description:
2025-02-05 06:38:06 dovecot_plain authenticator failed for ([36.37.181.181]) [36.37.181.181]:43750: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.98
description:
2025-02-05 06:38:14 dovecot_plain authenticator failed for ([103.190.91.98]) [103.190.91.98]:53468: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
description:
2025-02-05 06:38:23 dovecot_plain authenticator failed for (halea) [65.20.149.93]:54605: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.212.37.145
description:
Feb  5 06:38:32 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.212.37.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
description:
Feb  5 06:39:03 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 93.171.246.251
description:
[2025-02-05 06:38:55 +0100] info [webmaild] 93.171.246.251 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.181.181
description:
Feb  5 06:38:04 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.37.181.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.54.16.115
description:
Feb  5 06:38:22 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.54.16.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.37.145
description:
2025-02-05 06:38:34 dovecot_plain authenticator failed for (145.37.212.118.adsl-pool.jx.chinaunicom.com) [118.212.37.145]:35838: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.199.240.104
description:
2025-02-05 06:38:40 dovecot_plain authenticator failed for (104.240.199.112.unknown.m1.com.sg) [112.199.240.104]:42258: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.231.159
description:
Feb  5 06:38:52 ait sshd[383053]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.205.231.159 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.231.159
description:
Feb  5 06:38:52 ait sshd[383053]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.231.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.7.225.113
description:
2025-02-05 06:38:23 dovecot_plain authenticator failed for (113.225.7.186.f.dyn.claro.net.do) [186.7.225.113]:47016: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
description:
2025-02-05 06:38:23 dovecot_plain authenticator failed for ([50.217.255.171]) [50.217.255.171]:54580: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.98
description:
Feb  5 06:38:12 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.7.225.113
description:
Feb  5 06:38:21 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.7.225.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.182.89.19
description:
2025-02-05 06:38:38 dovecot_plain authenticator failed for ([123.182.89.19]) [123.182.89.19]:38193: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.199.240.104
description:
Feb  5 06:38:38 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.199.240.104 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.72.46.123
description:
[2025-02-05 06:38:42 +0100] info [webmaild] 188.72.46.123 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
description:
2025-02-05 06:38:46 dovecot_plain authenticator failed for (187-8-163-70.customer.tdatabrasil.net.br) [187.8.163.70]:60039: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.19.149
description:
Feb  5 06:38:04 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.19.149 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.245.100.21
description:
[2025-02-05 06:38:25 +0100] info [webmaild] 105.245.100.21 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.220.209.59
description:
2025-02-05 06:38:27 dovecot_plain authenticator failed for ([114.220.209.59]) [114.220.209.59]:54768: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
description:
2025-02-05 06:39:05 dovecot_plain authenticator failed for ([195.222.57.182]) [195.222.57.190]:39300: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 06:39:38 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.193
description:
Feb  5 06:39:52 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.33.44.12
description:
Feb  5 06:40:00 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.33.44.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.135.188.125
description:
2025-02-05 06:39:18 dovecot_login authenticator failed for ([121.135.188.125]) [121.135.188.125]:37496: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.106.198.35
description:
Feb  5 06:39:30 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.106.198.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.193
description:
2025-02-05 06:39:54 dovecot_login authenticator failed for (nsg-corporate-193.227.187.122.airtel.in) [122.187.227.193]:46949: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.33.44.12
description:
2025-02-05 06:40:02 dovecot_plain authenticator failed for ([209.33.44.12]) [209.33.44.12]:34238: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.135.188.125
description:
Feb  5 06:39:16 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.135.188.125 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.116.128.173
description:
[2025-02-05 06:39:21 +0100] info [webmaild] 181.116.128.173 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 06:39:37 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.82
description:
Feb  5 06:39:28 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.82
description:
2025-02-05 06:39:30 dovecot_login authenticator failed for (nsg-corporate-82.227.187.122.airtel.in) [122.187.227.82]:39548: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.106.198.35
description:
2025-02-05 06:39:32 dovecot_login authenticator failed for ([222.106.198.35]) [222.106.198.35]:55028: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.216.176.90
description:
Feb  5 06:40:12 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.216.176.90 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-40.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.229
description:
Feb  5 06:40:59 ait sshd[383931]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.69.30.93
description:
Feb  5 06:40:38 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.69.30.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.52.202.92
description:
Feb  5 06:40:39 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.52.202.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Feb  5 06:40:45 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.94.190
description:
2025-02-05 06:40:09 dovecot_plain authenticator failed for ([39.164.94.190]) [39.164.94.190]:32792: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
description:
Feb  5 06:40:55 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.231.137.153
description:
Feb  5 06:41:03 ait sshd[383947]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.231.137.153


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.97.132.7
description:
Feb  5 06:40:05 ait sshd[383476]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.97.132.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.94.190
description:
Feb  5 06:40:07 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.94.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.139.189
description:
2025-02-05 06:40:32 dovecot_login authenticator failed for ([180.188.139.189]) [180.188.139.189]:42938: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
description:
2025-02-05 06:40:57 dovecot_plain authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:45666: 535 Incorrect authentication data (set_id=jessica1234)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.229
description:
Feb  5 06:41:00 ait sshd[383931]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.229  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.187.62.248
description:
Feb  5 06:40:04 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.187.62.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.71.98.202
description:
Feb  5 06:40:16 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.71.98.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.35.63.27
description:
Feb  5 06:40:46 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.35.63.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.216.176.90
description:
2025-02-05 06:40:14 dovecot_plain authenticator failed for 32-216-176-90.bng02.brpt.ct.frontiernet.net [32.216.176.90]:60082: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.188.139.189
description:
Feb  5 06:40:30 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.188.139.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.52.202.92
description:
2025-02-05 06:40:41 dovecot_plain authenticator failed for ([123.52.202.92]) [123.52.202.92]:56730: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.35.63.27
description:
2025-02-05 06:40:48 dovecot_login authenticator failed for ([110.35.63.27]) [110.35.63.27]:37294: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.231.137.153
description:
Feb  5 06:41:03 ait sshd[383947]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.231.137.153 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.152
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/engine1/images/images/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.97.132.7
description:
Feb  5 06:40:05 ait sshd[383476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.97.132.7


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.71.98.202
description:
2025-02-05 06:40:18 dovecot_plain authenticator failed for ([223.71.98.202]) [223.71.98.202]:56082: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.69.30.93
description:
2025-02-05 06:40:40 dovecot_plain authenticator failed for ([180.69.30.93]) [180.69.30.93]:60880: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.188.14.233
description:
[2025-02-05 06:41:04 +0100] info [webmaild] 187.188.14.233 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.187.62.248
description:
2025-02-05 06:40:06 dovecot_plain authenticator failed for ([188.187.62.248]) [188.187.62.248]:52318: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-02-05 06:40:47 dovecot_plain authenticator failed for ([223.75.231.193]) [58.49.113.138]:13689: 535 Incorrect authentication data (set_id=jessica1234@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.231.137.153
description:
Feb  5 06:41:05 ait sshd[383947]: Failed password for invalid user job from 52.231.137.153 port 60042 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.229
description:
Feb  5 06:41:05 ait sshd[383931]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 06:41:30 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 128.201.79.114
description:
[2025-02-05 06:41:35 +0100] info [webmaild] 128.201.79.114 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.237.83.130
description:
2025-02-05 06:41:06 dovecot_plain authenticator failed for ([23.237.83.130]) [23.237.83.130]:60948: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.152
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/engine1/images/images/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.237.83.130
description:
Feb  5 06:41:04 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.237.83.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.229
description:
Feb  5 06:41:09 ait sshd[383972]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.229  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.176.170.160
description:
Feb  5 06:41:51 ait sshd[384410]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.176.170.160 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.238.52.111
description:
[2025-02-05 06:42:00 +0100] info [webmaild] 170.238.52.111 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.181.72.208
description:
[2025-02-05 06:41:25 +0100] info [webmaild] 45.181.72.208 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.176.170.160
description:
Feb  5 06:41:51 ait sshd[384410]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.176.170.160


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.251.202.80
description:
Feb  5 06:42:51 ait sshd[384660]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.251.202.80


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.13.243.101
description:
2025-02-05 06:42:55 dovecot_login authenticator failed for bl3-243-101.dsl.telepac.pt [213.13.243.101]:3906: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 06:42:17 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.241.121.9
description:
Feb  5 06:42:29 ait sshd[384593]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.241.121.9 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.241.121.9
description:
Feb  5 06:42:29 ait sshd[384593]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.241.121.9


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.112.159
description:
Feb  5 06:42:45 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.112.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.112.159
description:
2025-02-05 06:42:47 dovecot_login authenticator failed for 46-162-112-159.cust.bredband2.com [46.162.112.159]:51590: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.251.202.80
description:
Feb  5 06:42:51 ait sshd[384660]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.251.202.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.13.243.101
description:
Feb  5 06:42:53 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.13.243.101 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.207.7
description:
[2025-02-05 06:43:47 +0100] info [webmaild] 170.239.207.7 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.52.75.196
description:
[2025-02-05 06:44:10 +0100] info [webmaild] 190.52.75.196 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.0.43.212
description:
[2025-02-05 06:44:12 +0100] info [webmaild] 179.0.43.212 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.188
description:
Feb  5 06:44:34 ait sshd[385083]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.188 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.188
description:
Feb  5 06:44:34 ait sshd[385083]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.188


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.216.49.146
description:
[2025-02-05 06:44:47 +0100] info [webmaild] 186.216.49.146 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 27.71.27.234
description:
Feb  5 06:45:16 ait sshd[385281]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.71.27.234


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.135.96.213
description:
Feb  5 06:46:00 ait sshd[385530]: pam_imunify(sshd:auth): [IM360_RBL] The IP 137.135.96.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.183.103.117
description:
Feb  5 06:45:05 ait sshd[385258]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.183.103.117 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.183.103.117
description:
Feb  5 06:45:05 ait sshd[385258]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.103.117


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.234
description:
Feb  5 06:45:16 ait sshd[385281]: pam_imunify(sshd:auth): [IM360_RBL] The IP 27.71.27.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 137.135.96.213
description:
Feb  5 06:46:00 ait sshd[385530]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.135.96.213


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.39.192.57
description:
[2025-02-05 06:46:22 +0100] info [webmaild] 102.39.192.57 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.124.21.165
description:
[2025-02-05 06:46:52 +0100] info [webmaild] 190.124.21.165 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.100.167.151
description:
[2025-02-05 06:46:59 +0100] info [webmaild] 131.100.167.151 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 06:46:18 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Feb  5 06:46:28 ait sshd[385720]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.36.108.223
description:
Feb  5 06:46:28 ait sshd[385720]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.36.108.223


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.60.243.137
description:
Feb  5 06:47:20 ait sshd[385991]: pam_imunify(sshd:auth): [IM360_RBL] The IP 37.60.243.137 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.150.241.78
description:
[2025-02-05 06:47:20 +0100] info [webmaild] 170.150.241.78 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.153.166
description:
2025-02-05 06:47:55 dovecot_plain authenticator failed for (200-205-223-1.customer.tdatabrasil.net.br) [187.93.153.166]:44629: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.107.135.197
description:
Feb  5 06:47:24 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.107.135.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.177.106
description:
2025-02-05 06:47:41 dovecot_plain authenticator failed for ([196.250.177.106]) [196.250.177.106]:32777: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.29.196.162
description:
Feb  5 06:47:59 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.29.196.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.113
description:
2025-02-05 06:47:36 dovecot_plain authenticator failed for ([103.190.91.113]) [103.190.91.113]:33103: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.153.166
description:
Feb  5 06:47:53 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.153.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.29.196.162
description:
2025-02-05 06:48:01 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [218.29.196.162]:17120: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.177.106
description:
Feb  5 06:47:39 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.177.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.136.176.12
description:
Feb  5 06:47:08 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.136.176.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
description:
2025-02-05 06:47:10 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:39941: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 37.60.243.137
description:
Feb  5 06:47:20 ait sshd[385991]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.60.243.137


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.107.135.197
description:
2025-02-05 06:47:26 dovecot_login authenticator failed for ([117.107.135.194]) [117.107.135.197]:33328: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.113
description:
Feb  5 06:47:34 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.22.116.38
description:
Feb  5 06:48:50 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.22.116.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.229
description:
2025-02-05 06:49:01 dovecot_plain authenticator failed for (m121-202-153-229.smartone.com) [121.202.153.229]:62383: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.30.127.9
description:
Feb  5 06:48:35 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.30.127.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.166.85.53
description:
Feb  5 06:48:37 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.166.85.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.30.127.9
description:
2025-02-05 06:48:37 dovecot_plain authenticator failed for ([112.29.109.174]) [112.30.127.9]:44884: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.175.253.49
description:
Feb  5 06:48:39 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.175.253.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.166.85.53
description:
2025-02-05 06:48:39 dovecot_plain authenticator failed for ([121.166.85.53]) [121.166.85.53]:43566: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.32.11.3
description:
2025-02-05 06:48:40 dovecot_plain authenticator failed for ([119.32.11.3]) [119.32.11.3]:16411: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.119.194.70
description:
2025-02-05 06:48:22 dovecot_plain authenticator failed for ([212.119.194.70]) [212.119.194.70]:35218: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.206.19
description:
2025-02-05 06:48:24 dovecot_plain authenticator failed for syn-076-176-206-019.res.spectrum.com [76.176.206.19]:58971: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.186.220.42
description:
2025-02-05 06:48:49 dovecot_plain authenticator failed for ([211.186.220.42]) [211.186.220.42]:37834: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.97
description:
Feb  5 06:48:54 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.1.60
description:
2025-02-05 06:48:23 dovecot_plain authenticator failed for ([175.206.1.60]) [175.206.1.60]:34393: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.206.19
description:
Feb  5 06:48:22 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.206.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.97
description:
2025-02-05 06:48:34 dovecot_plain authenticator failed for ([179.185.1.97]) [179.185.1.97]:42559: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.231.102.189
description:
2025-02-05 06:48:34 dovecot_plain authenticator failed for ([73.231.102.189]) [73.231.102.189]:45240: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.10
description:
2025-02-05 06:48:19 dovecot_plain authenticator failed for ([196.189.126.10]) [196.189.126.10]:48602: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.93.87.71
description:
2025-02-05 06:48:23 dovecot_plain authenticator failed for ([119.93.87.71]) [119.93.87.71]:37440: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.231.102.189
description:
Feb  5 06:48:32 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.231.102.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.215.31.124
description:
2025-02-05 06:48:36 dovecot_plain authenticator failed for ([47.215.31.124]) [47.215.31.124]:57917: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.46.166
description:
Feb  5 06:48:44 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.46.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.84.11.180
description:
Feb  5 06:48:47 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.84.11.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.153.73
description:
2025-02-05 06:48:54 dovecot_plain authenticator failed for (80-184-100-101.myrepublic.com.sg) [218.212.153.73]:60836: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Feb  5 06:48:54 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.126.10
description:
Feb  5 06:48:17 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.126.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.172.61.145
description:
Feb  5 06:48:30 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.172.61.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.109.253.156
description:
2025-02-05 06:48:19 dovecot_plain authenticator failed for ([172.109.253.156]) [172.109.253.156]:48326: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.1.97
description:
Feb  5 06:48:32 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.1.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.172.61.145
description:
2025-02-05 06:48:32 dovecot_plain authenticator failed for ([39.172.61.145]) [39.172.61.145]:34116: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.253.49
description:
2025-02-05 06:48:41 dovecot_plain authenticator failed for ([89.175.253.49]) [89.175.253.49]:35350: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.254.23.40
description:
Feb  5 06:48:13 ait sshd[386242]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.254.23.40 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.254.23.40
description:
Feb  5 06:48:13 ait sshd[386242]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.254.23.40


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.65.21
description:
2025-02-05 06:48:40 dovecot_plain authenticator failed for ([183.220.65.21]) [183.220.65.21]:35266: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.93.69
description:
2025-02-05 06:48:40 dovecot_plain authenticator failed for ([210.99.93.69]) [210.99.93.69]:59273: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.84.11.180
description:
2025-02-05 06:48:49 dovecot_plain authenticator failed for ([59.84.11.180]) [59.84.11.180]:40232: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.58.190
description:
2025-02-05 06:48:50 dovecot_plain authenticator failed for p165190-obmd01.tokyo.ocn.ne.jp [153.141.58.190]:54651: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.228.105.192
description:
Feb  5 06:48:19 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.228.105.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.248.55
description:
Feb  5 06:48:24 ait sshd[386262]: pam_imunify(sshd:auth): [IM360_RBL] The IP 209.38.248.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.187.62.248
description:
2025-02-05 06:48:18 dovecot_plain authenticator failed for ([188.187.62.248]) [188.187.62.248]:52320: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.117.32.22
description:
Feb  5 06:48:15 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.117.32.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.215.31.124
description:
Feb  5 06:48:34 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.215.31.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.22.116.38
description:
2025-02-05 06:48:52 dovecot_plain authenticator failed for ([134.22.116.38]) [134.22.116.38]:48810: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.15.163.18
description:
2025-02-05 06:49:04 dovecot_plain authenticator failed for wsip-68-15-163-18.no.no.cox.net [68.15.163.18]:32713: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Feb  5 06:48:10 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.32
description:
2025-02-05 06:48:31 dovecot_plain authenticator failed for ([122.187.229.32]) [122.187.229.32]:37959: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.119.194.70
description:
Feb  5 06:48:20 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.119.194.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.212.183.97
description:
Feb  5 06:48:26 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.212.183.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.142.184.114
description:
Feb  5 06:48:30 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.142.184.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.142.184.114
description:
2025-02-05 06:48:32 dovecot_plain authenticator failed for ([163.142.184.114]) [163.142.184.114]:36027: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.65.21
description:
Feb  5 06:48:38 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.65.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.25.140.211
description:
Feb  5 06:48:39 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.25.140.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.109.253.156
description:
Feb  5 06:48:17 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.109.253.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.212.153.73
description:
Feb  5 06:48:52 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.212.153.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.44
description:
Feb  5 06:48:19 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.96
description:
Feb  5 06:48:23 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.212.183.97
description:
2025-02-05 06:48:28 dovecot_plain authenticator failed for ([182.212.183.97]) [182.212.183.97]:46741: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.217.183
description:
Feb  5 06:48:34 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.217.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.89.143.234
description:
Feb  5 06:48:38 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.89.143.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.187.62.248
description:
Feb  5 06:48:16 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.187.62.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
description:
Feb  5 06:48:16 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.25.140.211
description:
2025-02-05 06:48:41 dovecot_plain authenticator failed for ([112.25.140.211]) [112.25.140.211]:46779: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.32.11.3
description:
Feb  5 06:48:38 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.32.11.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.89.143.234
description:
2025-02-05 06:48:40 dovecot_plain authenticator failed for ([222.89.143.234]) [222.89.143.234]:55892: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.15.163.18
description:
Feb  5 06:49:02 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.15.163.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-02-05 06:48:12 dovecot_plain authenticator failed for (abilitus) [207.188.157.230]:47517: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.217.183
description:
2025-02-05 06:48:36 dovecot_plain authenticator failed for ([186.200.71.115]) [189.56.217.183]:39561: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.93.69
description:
Feb  5 06:48:38 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.93.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.186.220.42
description:
Feb  5 06:48:47 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.186.220.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.229
description:
Feb  5 06:48:59 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.44
description:
2025-02-05 06:48:21 dovecot_plain authenticator failed for ([207.219.222.44]) [207.219.222.44]:55605: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.96
description:
2025-02-05 06:48:25 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:39068: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.148.252.147
description:
Feb  5 06:48:26 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.148.252.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.58.190
description:
Feb  5 06:48:48 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.58.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-02-05 06:48:56 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (willatoile) [87.103.126.54]:51154: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.117.32.22
description:
2025-02-05 06:48:17 dovecot_plain authenticator failed for ([87.117.32.22]) [87.117.32.22]:54318: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 209.38.248.55
description:
Feb  5 06:48:24 ait sshd[386262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.248.55


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.1.60
description:
Feb  5 06:48:21 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.1.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.252.147
description:
2025-02-05 06:48:28 dovecot_plain authenticator failed for 122-148-252-147.sta.wbroadband.net.au [122.148.252.147]:40719: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.32
description:
Feb  5 06:48:29 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
description:
2025-02-05 06:48:56 dovecot_plain authenticator failed for ([65.20.191.97]) [65.20.191.97]:56170: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
description:
2025-02-05 06:48:18 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:60046: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.93.87.71
description:
Feb  5 06:48:21 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.93.87.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.166
description:
2025-02-05 06:48:46 dovecot_plain authenticator failed for 166.46.246.220.static.netvigator.com [220.246.46.166]:57341: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.228.105.192
description:
2025-02-05 06:48:21 dovecot_plain authenticator failed for ([58.228.105.192]) [58.228.105.192]:58536: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Feb  5 06:49:11 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.97.59.58
description:
[2025-02-05 06:49:17 +0100] info [webmaild] 102.97.59.58 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.185.199.245
description:
Feb  5 06:49:22 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.185.199.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.199.245
description:
2025-02-05 06:49:24 dovecot_login authenticator failed for 5.185.199.245.ipv4.public.orange.pl [5.185.199.245]:52284: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.196.84.188
description:
Feb  5 06:49:39 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.196.84.188 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.108.230.219
description:
[2025-02-05 06:50:01 +0100] info [webmaild] 187.108.230.219 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-02-05 06:49:13 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (covercomy) [87.103.126.54]:9673: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.108.106.15
description:
[2025-02-05 06:49:27 +0100] info [webmaild] 176.108.106.15 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.196.84.188
description:
2025-02-05 06:49:41 dovecot_login authenticator failed for static-168-196-84-188.hilink.net.br [168.196.84.188]:34441: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.131.189.195
description:
[2025-02-05 06:49:50 +0100] info [webmaild] 177.131.189.195 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 74.234.146.205
description:
Feb  5 06:49:59 ait sshd[386742]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.234.146.205


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.74.47
description:
2025-02-05 06:50:50 dovecot_login authenticator failed for 46-162-74-47.cust.bredband2.com [46.162.74.47]:57252: 535 Incorrect authentication data (set_id=iric)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.60.243.137
description:
Feb  5 06:50:58 ait sshd[387367]: pam_imunify(sshd:auth): [IM360_RBL] The IP 37.60.243.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-02-05 06:51:00 dovecot_login authenticator failed for (nsg-static-170.125.76.182-airtel.com) [182.76.87.90]:49018: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.196.84.188
description:
2025-02-05 06:50:34 dovecot_login authenticator failed for static-168-196-84-188.hilink.net.br [168.196.84.188]:38061: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.234.48.147
description:
Feb  5 06:50:46 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.234.48.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Feb  5 06:50:58 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.93
description:
2025-02-05 06:51:03 dovecot_login authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:59750: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.74.47
description:
Feb  5 06:50:48 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.74.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.123.208.246
description:
Feb  5 06:50:52 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.123.208.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.93
description:
Feb  5 06:51:01 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.196.84.188
description:
Feb  5 06:50:32 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.196.84.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.123.208.246
description:
2025-02-05 06:50:54 dovecot_login authenticator failed for 246.208.123.34.bc.googleusercontent.com [34.123.208.246]:49860: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.234.48.147
description:
2025-02-05 06:50:48 dovecot_login authenticator failed for ([221.234.48.147]) [221.234.48.147]:56540: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.231.137.153
description:
Feb  5 06:50:57 ait sshd[387363]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.231.137.153 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.231.137.153
description:
Feb  5 06:50:57 ait sshd[387363]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.231.137.153


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 37.60.243.137
description:
Feb  5 06:50:58 ait sshd[387367]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.60.243.137


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.190.69
description:
Feb  5 06:50:40 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.255.190.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.190.69
description:
2025-02-05 06:50:42 dovecot_login authenticator failed for ([92.255.190.69]) [92.255.190.69]:52392: 535 Incorrect authentication data (set_id=iric@aitedu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.198.60
description:
Feb  5 06:51:16 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.198.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.159.217.71
description:
Feb  5 06:51:17 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.159.217.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
description:
2025-02-05 06:51:30 dovecot_login authenticator failed for syn-050-074-136-134.biz.spectrum.com [50.74.136.134]:45378: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.45.68
description:
2025-02-05 06:51:34 dovecot_login authenticator failed for ([218.146.45.68]) [218.146.45.68]:41680: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
description:
2025-02-05 06:51:48 dovecot_login authenticator failed for ([211.223.41.90]) [211.223.41.90]:38608: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.191.131
description:
Feb  5 06:51:15 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.191.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.198.60
description:
2025-02-05 06:51:18 dovecot_login authenticator failed for ([121.189.198.60]) [121.189.198.60]:57962: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.74.136.134
description:
Feb  5 06:51:28 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.74.136.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.136.243
description:
Feb  5 06:51:38 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.136.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.136.243
description:
2025-02-05 06:51:40 dovecot_login authenticator failed for ([45.118.136.243]) [45.118.136.243]:64633: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.130.116.100
description:
Feb  5 06:51:59 ait sshd[387694]: pam_imunify(sshd:auth): [IM360_RBL] The IP 102.130.116.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.233.251
description:
2025-02-05 06:51:09 dovecot_login authenticator failed for 5.185.233.251.ipv4.public.orange.pl [5.185.233.251]:39900: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.223.41.90
description:
Feb  5 06:51:46 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.223.41.90 has been locked due to Imunify RBL


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.205
description:
Feb  5 06:51:52 ait sshd[387452]: error: maximum authentication attempts exceeded for root from 218.92.0.205 port 13320 ssh2 [preauth]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.124.14
description:
Feb  5 06:51:28 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.124.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.45.68
description:
Feb  5 06:51:32 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.45.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.205
description:
Feb  5 06:51:31 ait sshd[387452]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.0.112
description:
2025-02-05 06:51:33 dovecot_login authenticator failed for 111-70-0-112.emome-ip.hinet.net [111.70.0.112]:54094: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.222.7.136
description:
2025-02-05 06:51:33 dovecot_login authenticator failed for (63-222-7-136.static.as3491.net) [63.222.7.136]:62495: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.191.131
description:
2025-02-05 06:51:17 dovecot_login authenticator failed for broadband-178-140-191-131.ip.moscow.rt.ru [178.140.191.131]:34578: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.205
description:
Feb  5 06:51:31 ait sshd[387452]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.205  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.29.135.230
description:
2025-02-05 06:51:43 dovecot_login authenticator failed for 50.29.135.230.res-cmts.mtp2.ptd.net [50.29.135.230]:59054: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 102.130.116.100
description:
Feb  5 06:51:59 ait sshd[387694]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.130.116.100


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.185.233.251
description:
Feb  5 06:51:07 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.185.233.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
description:
2025-02-05 06:51:19 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:47344: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
description:
2025-02-05 06:51:30 dovecot_login authenticator failed for ([179.125.124.14]) [179.125.124.14]:50904: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.29.135.230
description:
Feb  5 06:51:41 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.29.135.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.222.7.136
description:
Feb  5 06:51:31 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.222.7.136 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 74.234.146.205
description:
Feb  5 06:52:04 ait sshd[387839]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.234.146.205


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 37.60.243.137
description:
Feb  5 06:52:24 ait sshd[387888]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.60.243.137


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Feb  5 06:52:45 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.36.108.223
description:
Feb  5 06:52:14 ait sshd[387878]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.36.108.223


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.234.121.237
description:
[2025-02-05 06:52:47 +0100] info [webmaild] 152.234.121.237 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 13.127.221.174
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:06-52.13.127.221.174


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.49.244.104
description:
[2025-02-05 06:52:13 +0100] info [webmaild] 187.49.244.104 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.166.230.38
description:
Feb  5 06:52:24 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.166.230.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.60.243.137
description:
Feb  5 06:52:24 ait sshd[387888]: pam_imunify(sshd:auth): [IM360_RBL] The IP 37.60.243.137 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.60.243.137
description:
Feb  5 06:52:26 ait sshd[387888]: Failed password for invalid user tecnopos from 37.60.243.137 port 53968 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.68.0.210
description:
Feb  5 06:52:45 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.68.0.210 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.130.215.226
description:
Feb  5 06:52:10 ait sshd[387872]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.130.215.226


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.210.188.130
description:
2025-02-05 06:52:09 dovecot_plain authenticator failed for ([58.210.188.130]) [58.210.188.130]:64235: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.173.6.5
description:
[2025-02-05 06:52:44 +0100] info [webmaild] 103.173.6.5 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Feb  5 06:52:14 ait sshd[387878]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.20.229
description:
2025-02-05 06:52:30 dovecot_plain authenticator failed for ([92.202.82.102]) [154.47.20.229]:38158: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.68.0.210
description:
2025-02-05 06:52:47 dovecot_plain authenticator failed for ([218.68.0.210]) [218.68.0.210]:56194: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.237
description:
Feb  5 06:53:05 ait sshd[388254]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.237  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.237
description:
Feb  5 06:53:04 ait sshd[388254]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.130.215.226
description:
Feb  5 06:52:10 ait sshd[387872]: pam_imunify(sshd:auth): [IM360_RBL] The IP 34.130.215.226 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.72.103.1
description:
[2025-02-05 06:52:14 +0100] info [webmaild] 131.72.103.1 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.176.125.34
description:
Feb  5 06:52:17 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.176.125.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.144.14.204
description:
Feb  5 06:52:33 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.144.14.204 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.234.146.205
description:
Feb  5 06:52:06 ait sshd[387839]: Failed password for invalid user precio01 from 74.234.146.205 port 41078 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.210.188.130
description:
Feb  5 06:52:07 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.210.188.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
description:
2025-02-05 06:52:19 dovecot_plain authenticator failed for ([200.106.49.149]) [200.106.49.149]:42590: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.144.14.204
description:
2025-02-05 06:52:35 dovecot_plain authenticator failed for (14.204.bol-online.com) [122.144.14.204]:64949: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.231.159
description:
Feb  5 06:52:53 ait sshd[388225]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.231.159


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.231.159
description:
Feb  5 06:52:53 ait sshd[388225]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.205.231.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.106.49.149
description:
Feb  5 06:52:17 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.106.49.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.125.34
description:
2025-02-05 06:52:19 dovecot_plain authenticator failed for ([182.176.125.34]) [182.176.125.34]:33896: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.230.38
description:
2025-02-05 06:52:26 dovecot_login authenticator failed for (NswcWpO) [188.166.230.38]:56037: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.47.20.229
description:
Feb  5 06:52:28 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.47.20.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.118.145.212
description:
Feb  5 06:53:53 ait sshd[388572]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.118.145.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.104.41
description:
Feb  5 06:54:02 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.104.41 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Feb  5 06:53:19 ait sshd[388339]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.104.41
description:
2025-02-05 06:54:04 dovecot_plain authenticator failed for visaustralia.com [216.70.104.41]:45782: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.13.21.246
description:
Feb  5 06:53:20 ait sshd[388341]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.13.21.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.13.21.246
description:
Feb  5 06:53:20 ait sshd[388341]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.13.21.246


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.180.102
description:
2025-02-05 06:53:51 dovecot_plain authenticator failed for 80-15-180-102.ftth.fr.orangecustomers.net [80.15.180.102]:33308: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.237
description:
Feb  5 06:53:08 ait sshd[388254]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.15.180.102
description:
Feb  5 06:53:49 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.15.180.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Feb  5 06:53:19 ait sshd[388339]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 175.100.113.232
domain: quiz.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:06-54.175.100.113.232


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 74.234.146.205
description:
Feb  5 06:53:14 ait sshd[388297]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.234.146.205


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.237
description:
Feb  5 06:53:18 ait sshd[388301]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.237  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.118.145.212
description:
Feb  5 06:53:53 ait sshd[388572]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.118.145.212


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.188
description:
Feb  5 06:54:42 ait sshd[388783]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Feb  5 06:54:42 ait sshd[388784]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.56.11.148
description:
2025-02-05 06:54:43 dovecot_plain authenticator failed for 93-56-11-148.ip287.fastwebnet.it [93.56.11.148]:47662: 535 Incorrect authentication data (set_id=assdas2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.7.100
description:
2025-02-05 06:54:47 dovecot_login authenticator failed for 100.7.61.94.rev.vodafone.pt [94.61.7.100]:43670: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 157.66.55.50
domain: jaster.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/links.php||SC:/home/titlemas/public_html/www.jaster.us/wp-admin


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.29.232.113
description:
Feb  5 06:54:57 ait sshd[388837]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.29.232.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-02-05 06:54:59 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-177.static.tpgi.com.au) [110.175.220.250]:59133: 535 Incorrect authentication data (set_id=assdas2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.61.7.100
description:
Feb  5 06:54:45 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.61.7.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.240.131
description:
[2025-02-05 06:54:43 +0100] info [webmaild] 179.125.240.131 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.240.72.193
description:
[2025-02-05 06:54:46 +0100] info [webmaild] 191.240.72.193 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.29.232.113
description:
Feb  5 06:54:57 ait sshd[388837]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.29.232.113


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-02-05 06:54:56 dovecot_login authenticator failed for (nsg-static-174.125.76.182-airtel.com) [182.76.87.90]:60456: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 06:54:41 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Feb  5 06:54:42 ait sshd[388784]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 157.66.55.50
domain: jaster.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:06-54.157.66.55.50||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Feb  5 06:54:54 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Feb  5 06:54:57 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.130
description:
2025-02-05 06:54:59 dovecot_login authenticator failed for ([119.198.191.130]) [119.198.191.130]:41992: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.56.11.148
description:
Feb  5 06:54:41 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.56.11.148 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.188
description:
Feb  5 06:54:42 ait sshd[388783]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.188


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.198.191.130
description:
Feb  5 06:54:57 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.198.191.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.35
description:
Feb  5 06:55:40 ait sshd[389288]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.35


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.232.228.4
description:
[2025-02-05 06:55:15 +0100] info [webmaild] 186.232.228.4 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.93.90
description:
Feb  5 06:55:22 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.93.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.35
description:
Feb  5 06:55:40 ait sshd[389288]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.243.37
description:
Feb  5 06:55:05 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.243.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.134.243.37
description:
2025-02-05 06:55:07 dovecot_login authenticator failed for ([31.134.243.37]) [31.134.243.37]:56701: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.61.116.244
description:
[2025-02-05 06:55:21 +0100] info [webmaild] 37.61.116.244 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.45.68
description:
Feb  5 06:55:37 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.45.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 06:55:38 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.45.68
description:
2025-02-05 06:55:39 dovecot_login authenticator failed for ([218.146.45.68]) [218.146.45.68]:60820: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
description:
2025-02-05 06:55:24 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:51438: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-56.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.131.163.41
description:
Feb  5 06:56:35 ait sshd[389558]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.131.163.41 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.131.163.41
description:
Feb  5 06:56:35 ait sshd[389558]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.163.41


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.232
description:
Feb  5 06:56:29 ait sshd[389417]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.232 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.232
description:
Feb  5 06:56:29 ait sshd[389417]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.232  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.39.128
description:
2025-02-05 06:57:27 dovecot_login authenticator failed for ([158.140.39.128]) [158.140.39.128]:50218: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.237.178.130
description:
Feb  5 06:57:53 ait sshd[390049]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.237.178.130


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.48.98.125
description:
Feb  5 06:57:55 ait sshd[390051]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.48.98.125 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.163
description:
Feb  5 06:58:05 ait sshd[390066]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.163


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.214.163.40
description:
[2025-02-05 06:58:05 +0100] info [webmaild] 177.214.163.40 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.195.217.94
description:
Feb  5 06:57:19 ait sshd[389816]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.195.217.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.110.114.113
description:
[2025-02-05 06:57:33 +0100] info [webmaild] 179.110.114.113 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.237.178.130
description:
Feb  5 06:57:53 ait sshd[390049]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.237.178.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.53
description:
2025-02-05 06:57:09 dovecot_login authenticator failed for ([65.20.251.53]) [65.20.251.53]:44490: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.126.90.28
description:
Feb  5 06:57:28 ait sshd[389871]: pam_imunify(sshd:auth): [IM360_RBL] The IP 101.126.90.28 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.90.28
description:
Feb  5 06:57:28 ait sshd[389871]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.90.28


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.163
description:
Feb  5 06:58:04 ait sshd[390066]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.53
description:
Feb  5 06:57:07 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.195.217.94
description:
Feb  5 06:57:19 ait sshd[389816]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.195.217.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.39.128
description:
Feb  5 06:57:25 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.39.128 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.95.221.136
description:
[2025-02-05 06:57:42 +0100] info [webmaild] 200.95.221.136 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.98.125
description:
Feb  5 06:57:55 ait sshd[390051]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.98.125


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.5.36.158
description:
[2025-02-05 06:58:07 +0100] info [webmaild] 191.5.36.158 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.108.172.220
description:
Feb  5 06:58:28 ait sshd[390101]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.108.172.220


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 199.188.207.151
description:
Feb  5 06:58:30 ait sshd[390107]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=199.188.207.151


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.250.128.5
description:
Feb  5 06:58:10 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.250.128.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.99.168
description:
2025-02-05 06:58:26 dovecot_plain authenticator failed for ([49.245.99.168]) [49.245.99.168]:45378: 535 Incorrect authentication data (set_id=eng19b00159y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 06:58:32 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.10.244.163
description:
Feb  5 06:58:06 ait sshd[390066]: Failed password for invalid user daniel from 216.10.244.163 port 51032 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.128.5
description:
2025-02-05 06:58:12 dovecot_plain authenticator failed for ([170.250.128.5]) [170.250.128.5]:42846: 535 Incorrect authentication data (set_id=eng19b00159y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.99.168
description:
Feb  5 06:58:24 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.99.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.188.207.151
description:
Feb  5 06:58:30 ait sshd[390107]: pam_imunify(sshd:auth): [IM360_RBL] The IP 199.188.207.151 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 175.100.113.232
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:06-59.175.100.113.232


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.45.217.249
description:
Feb  5 06:59:16 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.45.217.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.45.217.249
description:
2025-02-05 06:59:18 dovecot_plain authenticator failed for ([14.45.217.249]) [14.45.217.249]:44164: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.92.25.206
description:
Feb  5 06:59:42 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.92.25.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.92.25.206
description:
2025-02-05 06:59:44 dovecot_plain authenticator failed for ([220.92.25.206]) [220.92.25.206]:38486: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.202.91.52
description:
2025-02-05 07:00:27 dovecot_login authenticator failed for (host-196.202.91.52-static.tedata.net) [196.202.91.52]:49413: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.206.82.226
description:
[2025-02-05 07:00:36 +0100] info [webmaild] 185.206.82.226 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.227.248.225
description:
Feb  5 07:00:49 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.227.248.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.227.248.225
description:
2025-02-05 07:00:51 dovecot_login authenticator failed for ([139.227.248.225]) [139.227.248.225]:49680: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.252.95.34
description:
[2025-02-05 07:00:06 +0100] info [webmaild] 182.252.95.34 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.29.58.239
description:
[2025-02-05 07:00:40 +0100] info [webmaild] 176.29.58.239 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
description:
Feb  5 07:00:47 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.4.12.44
description:
Feb  5 07:01:03 ait sshd[391343]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.4.12.44


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.205.112.156
description:
2025-02-05 07:00:13 dovecot_plain authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:57997: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.177.96.5
description:
Feb  5 07:00:27 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.177.96.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
description:
2025-02-05 07:00:33 dovecot_login authenticator failed for ([5.32.99.14]) [5.32.99.14]:57461: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
description:
2025-02-05 07:00:49 dovecot_login authenticator failed for ([218.147.6.84]) [218.147.6.84]:43200: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.4.12.44
description:
Feb  5 07:01:03 ait sshd[391343]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.4.12.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.205.112.156
description:
Feb  5 07:00:11 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.205.112.156 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.79
description:
47.128.96.79 - - [05/Feb/2025:07:00:23 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11859064 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=125%2C61&filter_course-language=121%2C118%2C79&filtering=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.79


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.202.91.52
description:
Feb  5 07:00:25 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.202.91.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.177.96.5
description:
2025-02-05 07:00:29 dovecot_plain authenticator failed for ([117.177.96.5]) [117.177.96.5]:51526: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.99.14
description:
Feb  5 07:00:31 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.99.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.189.232
description:
2025-02-05 07:01:55 dovecot_plain authenticator failed for (host-232.185.15.189.0.0xffffff00.STERLING.stercom.ru) [185.15.189.232]:41640: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.59.34.245
description:
Feb  5 07:01:21 ait sshd[391478]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.59.34.245


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
description:
2025-02-05 07:01:34 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:36604: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.233.37
description:
Feb  5 07:01:36 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.233.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Feb  5 07:01:42 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
description:
2025-02-05 07:01:51 dovecot_login authenticator failed for (m121-202-152-13.smartone.com) [121.202.152.13]:32777: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.95.123.220
description:
2025-02-05 07:01:25 dovecot_login authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:54447: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.233.37
description:
2025-02-05 07:01:38 dovecot_login authenticator failed for ([104.241.233.37]) [104.241.233.37]:35256: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.232
description:
Feb  5 07:01:51 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.69.210.199
description:
Feb  5 07:02:04 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.69.210.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.95.123.220
description:
Feb  5 07:01:23 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.95.123.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.122.138
description:
2025-02-05 07:01:45 dovecot_login authenticator failed for (abts-north-static-x.138.122.163.122.airtelbroadband.in) [122.163.122.138]:57724: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.189
description:
Feb  5 07:01:53 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.232
description:
2025-02-05 07:01:53 dovecot_login authenticator failed for ([196.191.212.232]) [196.191.212.232]:41534: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.189.232
description:
Feb  5 07:01:53 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.189.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-02-05 07:01:44 dovecot_login authenticator failed for ([116.50.246.69]) [58.69.17.18]:35906: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.13
description:
Feb  5 07:01:49 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.189
description:
2025-02-05 07:01:55 dovecot_login authenticator failed for ([111.61.177.189]) [111.61.177.189]:37198: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.59.34.245
description:
Feb  5 07:01:21 ait sshd[391478]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.59.34.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.216.81.126
description:
Feb  5 07:01:22 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.216.81.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
description:
2025-02-05 07:01:24 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:47514: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.132.150.162
description:
Feb  5 07:01:32 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.132.150.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.163.122.138
description:
Feb  5 07:01:43 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.163.122.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.227
description:
Feb  5 07:02:06 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
description:
2025-02-05 07:02:08 dovecot_plain authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:57573: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.10.69
description:
Feb  5 07:02:21 ait sshd[391872]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.10.69


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.148.197.119
description:
Feb  5 07:02:26 ait sshd[392068]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.148.197.119 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.148.197.119
description:
Feb  5 07:02:26 ait sshd[392068]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.148.197.119


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 198.163.193.30
description:
[2025-02-05 07:02:54 +0100] info [webmaild] 198.163.193.30 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.69.210.199
description:
2025-02-05 07:02:06 dovecot_login authenticator failed for ([117.69.210.199]) [117.69.210.199]:60650: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.109.10.69
description:
Feb  5 07:02:21 ait sshd[391872]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.109.10.69 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.36.77.159
description:
[2025-02-05 07:02:35 +0100] info [webmaild] 177.36.77.159 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.253
description:
2025-02-05 07:03:12 dovecot_plain authenticator failed for (m121-202-152-253.smartone.com) [121.202.152.253]:17648: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.108.95.66
description:
2025-02-05 07:03:24 dovecot_plain authenticator failed for (bress) [109.108.95.66]:38445: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.190.210.117
description:
[2025-02-05 07:03:26 +0100] info [webmaild] 188.190.210.117 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
description:
Feb  5 07:03:33 ait sshd[392442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.108.172.220
description:
Feb  5 07:04:04 ait sshd[392724]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.108.172.220


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.153.126.237
description:
[2025-02-05 07:03:09 +0100] info [webmaild] 190.153.126.237 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.108.95.66
description:
Feb  5 07:03:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.108.95.66 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.194.148.132
description:
Feb  5 07:03:47 ait sshd[392637]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.194.148.132


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.118.145.212
description:
Feb  5 07:03:51 ait sshd[392669]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.118.145.212


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.194.148.132
description:
Feb  5 07:03:47 ait sshd[392637]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.194.148.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.253
description:
Feb  5 07:03:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.253 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.0.198.209
description:
[2025-02-05 07:03:24 +0100] info [webmaild] 131.0.198.209 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.189
description:
Feb  5 07:03:33 ait sshd[392442]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.118.145.212
description:
Feb  5 07:03:51 ait sshd[392669]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.118.145.212 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.108.172.220
description:
Feb  5 07:04:06 ait sshd[392724]: Failed password for invalid user server from 36.108.172.220 port 33838 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.245.237.193
description:
Feb  5 07:04:20 ait sshd[392781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.245.237.193


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.255.221
description:
2025-02-05 07:04:38 dovecot_plain authenticator failed for ([218.146.255.221]) [218.146.255.221]:56622: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.238.206
description:
2025-02-05 07:05:04 dovecot_plain authenticator failed for ([95.221.238.206]) [95.221.238.206]:43908: 535 Incorrect authentication data (set_id=eng20a00118y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 199.188.207.151
description:
Feb  5 07:05:05 ait sshd[393178]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=199.188.207.151


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.237.193
description:
Feb  5 07:04:20 ait sshd[392781]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.245.237.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.255.221
description:
Feb  5 07:04:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.255.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.164.147.150
description:
Feb  5 07:04:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.164.147.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.164.147.150
description:
2025-02-05 07:05:00 dovecot_plain authenticator failed for ([181.164.147.150]) [181.164.147.150]:23640: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.238.206
description:
Feb  5 07:05:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.238.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.188.207.151
description:
Feb  5 07:05:05 ait sshd[393178]: pam_imunify(sshd:auth): [IM360_RBL] The IP 199.188.207.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.241.253
description:
2025-02-05 07:05:45 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:52226: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Feb  5 07:05:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-02-05 07:05:49 dovecot_plain authenticator failed for (abts-north-static-046.68.160.122.airtelbroadband.in) [122.160.68.46]:44810: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.152.225.58
description:
Feb  5 07:05:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.152.225.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.91.144
description:
2025-02-05 07:05:26 dovecot_plain authenticator failed for ([58.16.91.144]) [58.16.91.144]:35233: 535 Incorrect authentication data (set_id=bscs18bit0012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.163.122.138
description:
Feb  5 07:05:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.163.122.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.72.121.10
description:
Feb  5 07:05:32 ait sshd[393473]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.72.121.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.72.121.10
description:
Feb  5 07:05:32 ait sshd[393473]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.72.121.10


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.72.14.152
description:
Feb  5 07:05:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.72.14.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.72.14.152
description:
2025-02-05 07:05:54 dovecot_plain authenticator failed for ([76.72.14.152]) [76.72.14.152]:53337: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.152.225.58
description:
2025-02-05 07:05:11 dovecot_plain authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:43469: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.169.145.10
description:
[2025-02-05 07:05:15 +0100] info [webmaild] 45.169.145.10 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.108.172.220
description:
Feb  5 07:05:13 ait sshd[393288]: Failed password for invalid user ftpuser from 36.108.172.220 port 19590 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.108.221.46
description:
[2025-02-05 07:05:34 +0100] info [webmaild] 131.108.221.46 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.122.138
description:
2025-02-05 07:05:35 dovecot_plain authenticator failed for (abts-north-static-x.138.122.163.122.airtelbroadband.in) [122.163.122.138]:60880: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.241.253
description:
Feb  5 07:05:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.241.253 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.185.77.104
description:
[2025-02-05 07:05:47 +0100] info [webmaild] 85.185.77.104 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.108.172.220
description:
Feb  5 07:05:11 ait sshd[393288]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.108.172.220


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 66.181.184.71
description:
[2025-02-05 07:06:03 +0100] info [webmaild] 66.181.184.71 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.91.144
description:
Feb  5 07:05:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.91.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-02-05 07:05:25 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:47783: 535 Incorrect authentication data (set_id=eng20a00118y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.188.207.151
description:
Feb  5 07:05:06 ait sshd[393178]: Failed password for invalid user plan from 199.188.207.151 port 40872 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Feb  5 07:05:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.53
description:
2025-02-05 07:06:58 dovecot_plain authenticator failed for ([178.178.222.53]) [178.178.222.53]:44572: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.9
description:
Feb  5 07:06:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.9
description:
2025-02-05 07:06:13 dovecot_plain authenticator failed for ([185.167.58.9]) [185.167.58.9]:52568: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
description:
Feb  5 07:06:26 ait sshd[393768]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.151.218.110
description:
Feb  5 07:06:40 ait sshd[393838]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.151.218.110


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
description:
Feb  5 07:06:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.13.21.246
description:
Feb  5 07:06:41 ait sshd[393836]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.13.21.246


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.53
description:
Feb  5 07:06:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.151.218.110
description:
Feb  5 07:06:40 ait sshd[393838]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.151.218.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.45.218.48
description:
Feb  5 07:06:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.45.218.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.45.218.48
description:
2025-02-05 07:06:25 dovecot_plain authenticator failed for ([46.45.218.48]) [46.45.218.48]:52000: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.97.132.7
description:
Feb  5 07:06:37 ait sshd[393827]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.97.132.7


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.208.197
description:
Feb  5 07:06:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.208.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
description:
2025-02-05 07:06:15 dovecot_plain authenticator failed for ([190.117.96.174]) [190.117.96.174]:42236: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
description:
Feb  5 07:06:26 ait sshd[393768]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.151.148
description:
2025-02-05 07:06:34 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.151.148]:60037: 535 Incorrect authentication data (set_id=ads20a00141y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.176
description:
2025-02-05 07:06:49 dovecot_plain authenticator failed for (nsg-corporate-176.229.187.122.airtel.in) [122.187.229.176]:39008: 535 Incorrect authentication data (set_id=ads20a00141y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.248.243.181
description:
Feb  5 07:07:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.248.243.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.237.110.29
description:
Feb  5 07:06:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.237.110.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.110.29
description:
2025-02-05 07:06:23 dovecot_plain authenticator failed for 81-237-110-29-no2300.tbcn.telia.com [81.237.110.29]:42500: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.176
description:
Feb  5 07:06:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.97.132.7
description:
Feb  5 07:06:37 ait sshd[393827]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.97.132.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.13.21.246
description:
Feb  5 07:06:41 ait sshd[393836]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.13.21.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.151.148
description:
Feb  5 07:06:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.151.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.208.197
description:
2025-02-05 07:06:41 dovecot_plain authenticator failed for ([111.48.208.197]) [111.48.208.197]:31276: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
description:
2025-02-05 07:07:06 dovecot_plain authenticator failed for (trablunth) [41.248.243.181]:60386: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.40.155
description:
2025-02-05 07:07:24 dovecot_plain authenticator failed for ([60.174.40.155]) [60.174.40.155]:57986: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.114.242
description:
2025-02-05 07:07:28 dovecot_plain authenticator failed for (242.114.95.187.static.liggatelecom.com.br) [187.95.114.242]:14580: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.123.32
description:
Feb  5 07:07:33 ait sshd[394205]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.123.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.182.203.89
description:
2025-02-05 07:07:39 dovecot_plain authenticator failed for ([110.182.203.89]) [110.182.203.89]:49590: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.125.68.208
description:
2025-02-05 07:07:48 dovecot_plain authenticator failed for ([175.125.68.208]) [175.125.68.208]:55692: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 07:07:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 57.129.17.80
description:
Feb  5 07:07:15 ait sshd[394175]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=57.129.17.80


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.199.123.32
description:
Feb  5 07:07:33 ait sshd[394205]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.123.32


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
description:
2025-02-05 07:07:37 dovecot_plain authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:56692: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.17.80
description:
Feb  5 07:07:15 ait sshd[394175]: pam_imunify(sshd:auth): [IM360_RBL] The IP 57.129.17.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.95.114.242
description:
Feb  5 07:07:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.95.114.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.212.219
description:
Feb  5 07:07:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.212.219 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.170.145.212
description:
[2025-02-05 07:07:48 +0100] info [webmaild] 31.170.145.212 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.182.203.89
description:
Feb  5 07:07:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.182.203.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.68.208
description:
Feb  5 07:07:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.125.68.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
description:
2025-02-05 07:09:01 dovecot_plain authenticator failed for ([90.173.78.90]) [90.173.78.90]:45408: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.178.158.132
description:
Feb  5 07:08:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.178.158.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.144.33.209
description:
2025-02-05 07:08:56 dovecot_login authenticator failed for ([121.144.33.209]) [121.144.33.209]:40074: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.204
description:
Feb  5 07:09:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.207.254.114
description:
2025-02-05 07:08:25 dovecot_plain authenticator failed for static-138-207-254-114.paw.cpe.atlanticbb.net [138.207.254.114]:35778: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 122.152.54.38
description:
[2025-02-05 07:08:34 +0100] info [webmaild] 122.152.54.38 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.178.158.132
description:
2025-02-05 07:08:49 dovecot_login authenticator failed for ([103.178.158.132]) [103.178.158.132]:47498: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Feb  5 07:08:48 ait sshd[394443]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-02-05 07:08:50 dovecot_login authenticator failed for ([14.38.28.126]) [14.88.228.202]:34712: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.85.137
description:
Feb  5 07:09:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.85.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.204
description:
2025-02-05 07:09:03 dovecot_login authenticator failed for ([111.61.176.204]) [111.61.176.204]:30876: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.88.186.142
description:
2025-02-05 07:08:15 dovecot_plain authenticator failed for ([201.88.186.142]) [201.88.186.142]:39558: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.82.26.182
description:
Feb  5 07:08:29 ait sshd[394396]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.82.26.182


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Feb  5 07:08:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.207.254.114
description:
Feb  5 07:08:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.207.254.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.82.26.182
description:
Feb  5 07:08:29 ait sshd[394396]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.82.26.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.144.33.209
description:
Feb  5 07:08:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.144.33.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.116.95.48
description:
2025-02-05 07:08:49 dovecot_login authenticator failed for ([203.116.95.48]) [203.116.95.48]:55508: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.173.78.90
description:
Feb  5 07:08:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.173.78.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.133.206
description:
2025-02-05 07:08:54 dovecot_login authenticator failed for syn-035-130-133-206.biz.spectrum.com [35.130.133.206]:38376: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.127.40.19
description:
Feb  5 07:09:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.127.40.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.127.40.19
description:
2025-02-05 07:09:03 dovecot_login authenticator failed for (115.127.40.33.bracnet.net) [115.127.40.19]:21746: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.88.186.142
description:
Feb  5 07:08:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.88.186.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.107.106.234
description:
[2025-02-05 07:08:26 +0100] info [webmaild] 217.107.106.234 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.133.206
description:
Feb  5 07:08:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.133.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.116.95.48
description:
Feb  5 07:08:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.116.95.48 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Feb  5 07:08:48 ait sshd[394443]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.218.58
description:
Feb  5 07:09:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.196.214
description:
Feb  5 07:09:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.196.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
description:
2025-02-05 07:09:06 dovecot_login authenticator failed for syn-208-105-196-214.biz.spectrum.com [208.105.196.214]:52387: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.223.49
description:
Feb  5 07:09:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.223.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.149.173.90
description:
2025-02-05 07:09:17 dovecot_plain authenticator failed for ([117.149.173.90]) [117.149.173.90]:43590: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
description:
2025-02-05 07:09:24 dovecot_plain authenticator failed for ([190.117.96.174]) [190.117.96.174]:55474: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.117.92.118
description:
2025-02-05 07:09:08 dovecot_login authenticator failed for ([202.117.92.118]) [202.117.92.118]:38412: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.223.49
description:
2025-02-05 07:09:10 dovecot_login authenticator failed for ([211.105.223.49]) [211.105.223.49]:49836: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
description:
2025-02-05 07:09:11 dovecot_login authenticator failed for ([220.178.246.43]) [220.178.246.43]:33712: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
description:
Feb  5 07:09:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.149.173.90
description:
Feb  5 07:09:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.149.173.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.218.58
description:
2025-02-05 07:09:41 dovecot_login authenticator failed for ([14.35.218.58]) [14.35.218.58]:35287: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.158
description:
2025-02-05 07:09:05 dovecot_login authenticator failed for p7001159-ipoefx.ipoe.ocn.ne.jp [118.3.227.158]:39836: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.85.137
description:
2025-02-05 07:09:05 dovecot_plain authenticator failed for (177-174-85-137.user.vivozap.com.br) [177.174.85.137]:45197: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.117.92.118
description:
Feb  5 07:09:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.117.92.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.246.43
description:
Feb  5 07:09:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.246.43 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 192.145.205.2
description:
[2025-02-05 07:09:08 +0100] info [webmaild] 192.145.205.2 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.4.133
description:
2025-02-05 07:10:36 dovecot_plain authenticator failed for 89-109-4-133.dynamic.mts-nn.ru [89.109.4.133]:46749: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.33.87.111
description:
Feb  5 07:10:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.33.87.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 110.39.235.228
description:
[2025-02-05 07:10:40 +0100] info [webmaild] 110.39.235.228 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.78.119.104
description:
Feb  5 07:10:59 ait sshd[395467]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.78.119.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.184.218.49
description:
Feb  5 07:10:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.184.218.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
description:
2025-02-05 07:10:25 dovecot_plain authenticator failed for (imparhoteis.static.gvt.net.br) [179.184.218.49]:45587: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.239.151
description:
2025-02-05 07:10:36 dovecot_plain authenticator failed for ([60.223.239.151]) [60.223.239.151]:44041: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.130.173.74
description:
2025-02-05 07:10:49 dovecot_plain authenticator failed for (l5-130-173-74.novotelecom.ru) [5.130.173.74]:60000: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Feb  5 07:10:16 ait sshd[395048]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.250
description:
Feb  5 07:10:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
description:
2025-02-05 07:10:49 dovecot_plain authenticator failed for ([222.92.61.242]) [222.92.61.242]:43586: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.145.54.48
description:
Feb  5 07:10:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.145.54.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.145.54.48
description:
2025-02-05 07:10:44 dovecot_plain authenticator failed for ([103.145.54.48]) [103.145.54.48]:51299: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.245.207.104
description:
2025-02-05 07:10:53 dovecot_plain authenticator failed for ([1.245.207.104]) [1.245.207.104]:38735: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.239.151
description:
Feb  5 07:10:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.239.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.109.4.133
description:
Feb  5 07:10:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.109.4.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.24.215.70
description:
Feb  5 07:10:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.24.215.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.130.173.74
description:
Feb  5 07:10:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.130.173.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.24.215.70
description:
2025-02-05 07:10:38 dovecot_plain authenticator failed for ([195.24.215.70]) [195.24.215.70]:36862: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.33.87.111
description:
2025-02-05 07:10:45 dovecot_plain authenticator failed for (111-86-33-194.intelcom-ug.ru) [194.33.87.111]:55192: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
description:
Feb  5 07:10:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.188.149.243
description:
Feb  5 07:10:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.188.149.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.149.243
description:
2025-02-05 07:10:58 dovecot_plain authenticator failed for (scz-181-188-149-00243.tigo.bo) [181.188.149.243]:34025: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.78.119.104
description:
Feb  5 07:10:59 ait sshd[395467]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.78.119.104


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.250
description:
2025-02-05 07:10:37 dovecot_plain authenticator failed for ([121.202.155.250]) [121.202.155.250]:51274: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.245.207.104
description:
Feb  5 07:10:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.245.207.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.23.95.14
description:
Feb  5 07:11:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.23.95.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.235.59.248
description:
[2025-02-05 07:11:12 +0100] info [webmaild] 45.235.59.248 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-11.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.23.95.14
description:
2025-02-05 07:11:07 dovecot_plain authenticator failed for ([218.23.95.14]) [218.23.95.14]:35065: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.246.125.123
description:
[2025-02-05 07:11:12 +0100] info [webmaild] 170.246.125.123 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 93.141.159.221
description:
[2025-02-05 07:11:46 +0100] info [webmaild] 93.141.159.221 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.132.125.226
description:
Feb  5 07:12:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.132.125.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.132.125.226
description:
2025-02-05 07:12:26 dovecot_plain authenticator failed for ip79-132-125-226.ulk.host.ttk.ru [79.132.125.226]:49484: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
description:
2025-02-05 07:12:53 dovecot_plain authenticator failed for ([175.202.82.251]) [175.202.82.251]:35878: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.207.225.55
description:
Feb  5 07:13:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.207.225.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
description:
2025-02-05 07:12:44 dovecot_plain authenticator failed for ([121.128.76.109]) [61.72.59.106]:56348: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
description:
Feb  5 07:12:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Feb  5 07:12:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
description:
2025-02-05 07:13:03 dovecot_plain authenticator failed for wsip-64-207-225-55.tu.ok.cox.net ([64.207.241.177]) [64.207.225.55]:40730: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.62.9
description:
47.128.62.9 - - [05/Feb/2025:07:13:03 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10357116 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/2/?duration=short&filter_course-language=120&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.62.9


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.180.37.53
description:
[2025-02-05 07:13:18 +0100] info [webmaild] 38.180.37.53 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Feb  5 07:13:41 ait sshd[396218]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.36.108.223
description:
Feb  5 07:13:41 ait sshd[396218]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.36.108.223


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Feb  5 07:13:56 ait sshd[396417]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=aitopen


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.104.13.30
description:
[2025-02-05 07:13:55 +0100] info [webmaild] 191.104.13.30 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Feb  5 07:13:56 ait sshd[396417]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.86.167.42
description:
Feb  5 07:14:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.86.167.42 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.156.17.114
description:
[2025-02-05 07:14:05 +0100] info [webmaild] 102.156.17.114 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Feb  5 07:14:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.86.167.42
description:
2025-02-05 07:14:51 dovecot_plain authenticator failed for ppp-210-86-167-42.revip.asianet.co.th [210.86.167.42]:64645: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.202.91.52
description:
2025-02-05 07:14:39 dovecot_plain authenticator failed for (host-196.202.91.52-static.tedata.net) [196.202.91.52]:34431: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-02-05 07:14:39 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (desaliest) [109.67.154.24]:59226: 535 Incorrect authentication data (set_id=abs65b11556y@ait.edu.gh)


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 104.28.251.138
domain: ait.edu.gh
description:
IM360 WAF: Request body parsing error||err_msg:XML parser error: XML: Failed parsing document.||RSV:6.65||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  5 07:14:27 ait sshd[396512]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.241.183.251
description:
[2025-02-05 07:14:39 +0100] info [webmaild] 191.241.183.251 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 83.50.55.184
description:
Feb  5 07:15:03 ait sshd[396844]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=83.50.55.184


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  5 07:14:27 ait sshd[396512]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.202.91.52
description:
Feb  5 07:14:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.202.91.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.233.166.200
description:
Feb  5 07:15:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.233.166.200 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.229.118.208
description:
Feb  5 07:15:22 ait sshd[396884]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.229.118.208


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.247.88
description:
2025-02-05 07:15:34 dovecot_plain authenticator failed for ([183.220.247.88]) [183.220.247.88]:52782: 535 Incorrect authentication data (set_id=eng18a00033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.115.211
description:
Feb  5 07:15:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.115.211 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.90.193.207
description:
[2025-02-05 07:15:54 +0100] info [webmaild] 189.90.193.207 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.115.211
description:
2025-02-05 07:15:47 dovecot_plain authenticator failed for (211.115.156.175.unknown.m1.com.sg) [175.156.115.211]:41134: 535 Incorrect authentication data (set_id=eng18a00033y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.50.55.184
description:
Feb  5 07:15:05 ait sshd[396844]: Failed password for invalid user pi from 83.50.55.184 port 55330 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.233.166.200
description:
2025-02-05 07:15:16 dovecot_plain authenticator failed for ([183.233.166.200]) [183.233.166.200]:49609: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.229.118.208
description:
Feb  5 07:15:22 ait sshd[396884]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.229.118.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.247.88
description:
Feb  5 07:15:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.247.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.72.156
description:
Feb  5 07:15:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.72.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.72.156
description:
2025-02-05 07:15:39 dovecot_plain authenticator failed for ([95.165.72.156]) [95.165.72.156]:47124: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.158.41.163
description:
[2025-02-05 07:16:32 +0100] info [webmaild] 201.158.41.163 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.234.233.159
description:
[2025-02-05 07:16:44 +0100] info [webmaild] 109.234.233.159 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 07:16:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.59.228.24
description:
Feb  5 07:16:06 ait sshd[397172]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.59.228.24 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.59.228.24
description:
Feb  5 07:16:06 ait sshd[397172]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.228.24


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.211.97.51
description:
Feb  5 07:17:10 ait sshd[397441]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.211.97.51


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.115.205.253
description:
Feb  5 07:17:18 ait sshd[397452]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.115.205.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
description:
2025-02-05 07:18:02 dovecot_plain authenticator failed for ([211.105.213.144]) [211.105.213.144]:40986: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.37.35.155
description:
Feb  5 07:17:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.37.35.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.205.253
description:
Feb  5 07:17:18 ait sshd[397452]: pam_imunify(sshd:auth): [IM360_RBL] The IP 124.115.205.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.97.51
description:
Feb  5 07:17:10 ait sshd[397441]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.211.97.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.37.35.155
description:
2025-02-05 07:17:19 dovecot_plain authenticator failed for c-68-37-35-155.hsd1.mi.comcast.net [68.37.35.155]:44658: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.116.231.33
description:
[2025-02-05 07:17:17 +0100] info [webmaild] 177.116.231.33 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.59.34.245
description:
Feb  5 07:18:35 ait sshd[397915]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.59.34.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 07:18:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.130.215.226
description:
Feb  5 07:18:54 ait sshd[397977]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.130.215.226


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.177.61
description:
2025-02-05 07:18:54 dovecot_plain authenticator failed for (61-177-53-194.mairnet.net) [194.53.177.61]:55938: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.20.137
description:
2025-02-05 07:19:03 dovecot_plain authenticator failed for ([2.192.20.137]) [2.192.20.137]:38882: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.59.34.245
description:
Feb  5 07:18:35 ait sshd[397915]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.59.34.245


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.71.226.225
description:
[2025-02-05 07:18:31 +0100] info [webmaild] 186.71.226.225 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.130.215.226
description:
Feb  5 07:18:54 ait sshd[397977]: pam_imunify(sshd:auth): [IM360_RBL] The IP 34.130.215.226 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.214.142.24
description:
[2025-02-05 07:19:31 +0100] info [webmaild] 91.214.142.24 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.106.154.133
description:
2025-02-05 07:19:55 dovecot_login authenticator failed for ([103.106.154.133]) [103.106.154.133]:54480: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-02-05 07:20:06 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:41541: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
description:
2025-02-05 07:20:19 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.50.150]:44800: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.78.191
description:
2025-02-05 07:19:56 dovecot_login authenticator failed for ([119.207.78.191]) [119.207.78.191]:49256: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
description:
2025-02-05 07:19:57 dovecot_login authenticator failed for ([171.244.63.170]) [171.244.63.170]:22701: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-02-05 07:20:10 dovecot_login authenticator failed for (nsg-static-174.125.76.182-airtel.com) [182.76.87.90]:55194: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
description:
2025-02-05 07:20:11 dovecot_login authenticator failed for ([118.36.234.156]) [118.36.234.156]:48410: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.72.121.10
description:
Feb  5 07:20:04 ait sshd[398984]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.72.121.10


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.150.71
description:
Feb  5 07:19:29 ait sshd[398636]: pam_imunify(sshd:auth): [IM360_RBL] The IP 85.130.150.71 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 85.130.150.71
description:
Feb  5 07:19:29 ait sshd[398636]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.130.150.71


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.96.145.202
description:
Feb  5 07:19:41 ait sshd[398679]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.96.145.202


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 111.88.96.85
description:
[2025-02-05 07:20:02 +0100] info [webmaild] 111.88.96.85 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.128.19.228
description:
2025-02-05 07:20:09 dovecot_login authenticator failed for ([57.128.19.228]) [57.128.19.228]:54662: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.27
description:
2025-02-05 07:20:19 dovecot_plain authenticator failed for ([182.135.66.27]) [182.135.66.27]:33380: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.96.145.202
description:
Feb  5 07:19:41 ait sshd[398679]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.96.145.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.90.207.82
description:
2025-02-05 07:20:03 dovecot_plain authenticator failed for ([182.90.207.82]) [182.90.207.82]:45981: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.218.158.114
description:
Feb  5 07:20:50 ait sshd[399319]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.218.158.114 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.218.158.114
description:
Feb  5 07:20:50 ait sshd[399319]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.218.158.114


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 93.171.155.30
description:
[2025-02-05 07:21:03 +0100] info [webmaild] 93.171.155.30 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.192
description:
2025-02-05 07:21:29 dovecot_plain authenticator failed for ([178.178.194.192]) [178.178.194.192]:35862: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.197.74.238
description:
[2025-02-05 07:21:42 +0100] info [webmaild] 168.197.74.238 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.124.66
description:
2025-02-05 07:21:43 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:52955: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.94.15.239
description:
[2025-02-05 07:22:12 +0100] info [webmaild] 187.94.15.239 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  5 07:22:40 ait sshd[399982]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.124.66.33
description:
[2025-02-05 07:22:47 +0100] info [webmaild] 200.124.66.33 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
description:
2025-02-05 07:23:09 dovecot_plain authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:55148: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.92.193
description:
2025-02-05 07:23:18 dovecot_plain authenticator failed for broadband-5-228-92-193.ip.moscow.rt.ru [5.228.92.193]:58115: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  5 07:22:40 ait sshd[399982]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 07:22:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.52.106
description:
2025-02-05 07:22:52 dovecot_plain authenticator failed for ([218.22.52.106]) [218.22.52.106]:38441: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.244.83.178
description:
2025-02-05 07:23:02 dovecot_plain authenticator failed for h80-244-83-178.cust.bredband2.com [80.244.83.178]:36996: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.62.77.221
description:
[2025-02-05 07:24:14 +0100] info [webmaild] 41.62.77.221 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.148.197.119
description:
Feb  5 07:24:20 ait sshd[400313]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.148.197.119 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.148.197.119
description:
Feb  5 07:24:20 ait sshd[400313]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.148.197.119


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.199.245.2
description:
[2025-02-05 07:23:39 +0100] info [webmaild] 91.199.245.2 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.60.35
description:
2025-02-05 07:24:18 dovecot_plain authenticator failed for ([211.48.60.35]) [211.48.60.35]:39750: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.242.71.107
description:
2025-02-05 07:24:28 dovecot_plain authenticator failed for ([36.32.223.199]) [58.242.71.107]:47792: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.245.102
description:
2025-02-05 07:25:16 dovecot_plain authenticator failed for ([175.203.245.102]) [175.203.245.102]:52552: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.247.184.12
description:
Feb  5 07:25:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.247.184.12 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.13.28.219
description:
[2025-02-05 07:25:19 +0100] info [webmaild] 201.13.28.219 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.148.197.119
description:
Feb  5 07:24:22 ait sshd[400313]: Failed password for invalid user intern from 52.148.197.119 port 44548 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.233.57.250
description:
[2025-02-05 07:24:47 +0100] info [webmaild] 45.233.57.250 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.123.153.214
description:
2025-02-05 07:25:07 dovecot_plain authenticator failed for ([144.123.153.214]) [144.123.153.214]:59584: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.148.187.146
description:
2025-02-05 07:25:45 dovecot_plain authenticator failed for (azteca-comunicaciones.com) [186.148.187.146]:53709: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.103.200
description:
2025-02-05 07:25:58 dovecot_plain authenticator failed for 110-25-103-200.adsl.fetnet.net [110.25.103.200]:57476: 535 Incorrect authentication data (set_id=yeboah)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-26.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.247.184.12
description:
2025-02-05 07:25:20 dovecot_plain authenticator failed for ([194.247.184.12]) [194.247.184.12]:49164: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.221.78.38
description:
[2025-02-05 07:27:03 +0100] info [webmaild] 177.221.78.38 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.161.72.68
description:
[2025-02-05 07:26:24 +0100] info [webmaild] 109.161.72.68 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.205.117.183
description:
[2025-02-05 07:27:01 +0100] info [webmaild] 109.205.117.183 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.123.242
description:
47.128.123.242 - - [05/Feb/2025:07:27:31 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=14017270 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/3728d8?panel=http_client" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.123.242


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.107.253.238
description:
[2025-02-05 07:27:34 +0100] info [webmaild] 109.107.253.238 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.142.105.18
description:
2025-02-05 07:28:13 dovecot_plain authenticator failed for ([180.142.105.18]) [180.142.105.18]:42852: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.231.133.50
description:
Feb  5 07:27:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.231.133.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.192.29.74
description:
2025-02-05 07:27:55 dovecot_plain authenticator failed for ([120.192.29.74]) [120.192.29.74]:56346: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.63.214.213
description:
2025-02-05 07:27:59 dovecot_plain authenticator failed for ([58.63.214.213]) [58.63.214.213]:47792: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.161.242.146
description:
2025-02-05 07:28:13 dovecot_plain authenticator failed for (146.242.161.222.adsl-pool.jlccptt.net.cn) [222.161.242.146]:7934: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.153.92.233
description:
[2025-02-05 07:27:51 +0100] info [webmaild] 190.153.92.233 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.170.49
description:
2025-02-05 07:27:52 dovecot_plain authenticator failed for (201.172.170.49-clientes-izzi.mx) [201.172.170.49]:44200: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.133.50
description:
2025-02-05 07:27:53 dovecot_plain authenticator failed for ([197.231.133.50]) [197.231.133.50]:60415: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.37.145
description:
2025-02-05 07:28:10 dovecot_plain authenticator failed for (145.37.212.118.adsl-pool.jx.chinaunicom.com) [118.212.37.145]:51840: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.118.249.89
description:
2025-02-05 07:28:18 dovecot_plain authenticator failed for p174090-obmd01.osaka.ocn.ne.jp [61.118.249.89]:38038: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 07:27:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.107.189
description:
2025-02-05 07:28:01 dovecot_plain authenticator failed for (biophormula.static.gvt.net.br) [186.215.107.189]:54928: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.218.133.106
description:
2025-02-05 07:29:19 dovecot_plain authenticator failed for ([103.218.133.106]) [103.218.133.106]:57752: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
description:
2025-02-05 07:28:26 dovecot_plain authenticator failed for ([218.98.160.117]) [218.98.160.117]:54648: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
description:
2025-02-05 07:28:34 dovecot_plain authenticator failed for ([27.71.27.81]) [27.71.27.81]:36948: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.157.94.187
description:
[2025-02-05 07:29:00 +0100] info [webmaild] 103.157.94.187 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Feb  5 07:29:04 ait sshd[402009]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.172.225.52
description:
2025-02-05 07:29:17 dovecot_plain authenticator failed for ([178.172.225.52]) [178.172.225.52]:54566: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.180.129.87
description:
Feb  5 07:29:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.180.129.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.11.249
description:
2025-02-05 07:28:23 dovecot_plain authenticator failed for ([202.179.85.98]) [103.207.11.249]:48300: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
description:
2025-02-05 07:29:09 dovecot_plain authenticator failed for (Bundle-Ether3.2581.static.gvt.net.br) [177.43.106.73]:41969: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
description:
2025-02-05 07:29:17 dovecot_plain authenticator failed for ([195.222.59.157]) [195.222.59.157]:41092: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.129.199
description:
2025-02-05 07:29:17 dovecot_plain authenticator failed for ([203.172.129.199]) [203.172.129.199]:54644: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.106.136.152
description:
2025-02-05 07:29:18 dovecot_plain authenticator failed for (tgw-rp.ru) [109.106.136.152]:54962: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
description:
Feb  5 07:29:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.206.91.51
description:
2025-02-05 07:29:16 dovecot_plain authenticator failed for ([85.206.91.51]) [85.206.91.51]:41108: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.109.253.182
description:
2025-02-05 07:29:17 dovecot_plain authenticator failed for ([172.109.253.182]) [172.109.253.182]:50151: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.160.128.46
description:
2025-02-05 07:29:17 dovecot_plain authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:47140: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.226.241.177
description:
2025-02-05 07:29:18 dovecot_plain authenticator failed for (pool-176-226-241-177.is74.ru) [176.226.241.177]:53714: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.250
description:
2025-02-05 07:29:19 dovecot_plain authenticator failed for ([103.69.9.250]) [103.69.9.250]:37319: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.246.45.57
description:
2025-02-05 07:29:19 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:42128: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.11.249
description:
Feb  5 07:28:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.11.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Feb  5 07:29:04 ait sshd[402009]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.109.253.182
description:
Feb  5 07:29:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.109.253.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.167.21.148
description:
Feb  5 07:29:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.167.21.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.35.188.202
description:
2025-02-05 07:29:18 dovecot_plain authenticator failed for 202-188-035-194.ip-addr.vsenet.de [194.35.188.202]:49688: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.28.51
description:
2025-02-05 07:29:21 dovecot_plain authenticator failed for ([222.128.28.51]) [222.128.28.51]:30608: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.33.87.111
description:
Feb  5 07:29:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.33.87.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.166.73
description:
2025-02-05 07:29:28 dovecot_plain authenticator failed for ([117.158.166.73]) [117.158.166.73]:35680: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.164.165
description:
2025-02-05 07:29:29 dovecot_plain authenticator failed for ([5.11.164.165]) [5.11.164.165]:57627: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.144.239.225
description:
2025-02-05 07:29:31 dovecot_plain authenticator failed for 225.sub-166-144-239.myvzw.com [166.144.239.225]:45788: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-02-05 07:29:34 dovecot_plain authenticator failed for ([128.106.196.150]) [128.106.196.150]:42073: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.213.111
description:
2025-02-05 07:29:38 dovecot_plain authenticator failed for ([65.20.213.111]) [65.20.213.111]:46118: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.46.114
description:
2025-02-05 07:29:39 dovecot_plain authenticator failed for ([125.20.46.114]) [125.20.46.114]:55864: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.154.134.146
description:
2025-02-05 07:29:41 dovecot_plain authenticator failed for ([36.154.134.146]) [36.154.134.146]:44246: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
description:
2025-02-05 07:29:20 dovecot_plain authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:34675: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.10.121.246
description:
2025-02-05 07:29:35 dovecot_plain authenticator failed for syn-098-010-121-246.res.spectrum.com (098-010-121-246.res.spectrum.com) [98.10.121.246]:49289: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-02-05 07:29:35 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:48513: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.250.23.208
description:
2025-02-05 07:29:42 dovecot_plain authenticator failed for ([72.250.23.208]) [72.250.23.208]:40464: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.184.14.233
description:
Feb  5 07:29:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.184.14.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.89.72
description:
2025-02-05 07:29:50 dovecot_plain authenticator failed for ([112.132.89.72]) [112.132.89.72]:57817: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.137.56.216
description:
2025-02-05 07:29:55 dovecot_plain authenticator failed for ([185.137.56.216]) [185.137.56.216]:50130: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.165.23
description:
2025-02-05 07:29:21 dovecot_plain authenticator failed for ([45.118.165.23]) [45.118.165.23]:52813: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.210
description:
2025-02-05 07:29:21 dovecot_plain authenticator failed for ([61.185.226.210]) [61.185.226.210]:57508: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.234.104.42
description:
2025-02-05 07:29:30 dovecot_plain authenticator failed for ([218.234.104.42]) [218.234.104.42]:50484: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
description:
2025-02-05 07:29:32 dovecot_plain authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:52882: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
description:
2025-02-05 07:29:36 dovecot_plain authenticator failed for ([186.247.238.25]) [200.149.51.186]:60120: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.240.121.31
description:
2025-02-05 07:29:38 dovecot_plain authenticator failed for cm-72-240-121-31.buckeyecom.net [72.240.121.31]:16325: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.115.211
description:
2025-02-05 07:29:39 dovecot_plain authenticator failed for (211.115.156.175.unknown.m1.com.sg) [175.156.115.211]:51514: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
description:
2025-02-05 07:29:44 dovecot_plain authenticator failed for ([37.224.119.19]) [37.224.119.19]:36790: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.137.56.216
description:
Feb  5 07:29:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.137.56.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.181.1.49
description:
2025-02-05 07:29:59 dovecot_plain authenticator failed for static-47-181-1-49.lsan.ca.frontiernet.net [47.181.1.49]:58958: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
description:
2025-02-05 07:29:20 dovecot_plain authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:59940: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
description:
2025-02-05 07:29:24 dovecot_plain authenticator failed for ([213.230.64.246]) [213.230.64.246]:58132: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.87.49.250
description:
2025-02-05 07:29:24 dovecot_plain authenticator failed for ([222.87.49.250]) [222.87.49.250]:54704: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.196.64.203
description:
Feb  5 07:30:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.196.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.200.216.246
description:
2025-02-05 07:29:22 dovecot_plain authenticator failed for ([113.200.216.246]) [113.200.216.246]:41414: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.57.111.99
description:
2025-02-05 07:29:32 dovecot_plain authenticator failed for ([211.57.111.99]) [211.57.111.99]:55962: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
description:
2025-02-05 07:29:33 dovecot_plain authenticator failed for ([220.161.52.149]) [220.161.52.149]:54051: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.85.12.142
description:
2025-02-05 07:29:34 dovecot_plain authenticator failed for ([61.85.12.142]) [61.85.12.142]:35777: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.188.103.179
description:
Feb  5 07:29:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.188.103.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.250.23.208
description:
Feb  5 07:29:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.250.23.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.14.233
description:
2025-02-05 07:29:47 dovecot_plain authenticator failed for ([112.184.14.233]) [112.184.14.233]:52151: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.144.239.225
description:
Feb  5 07:29:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.144.239.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
description:
2025-02-05 07:29:29 dovecot_plain authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:54330: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.128.40
description:
2025-02-05 07:29:32 dovecot_plain authenticator failed for 1-34-128-40.hinet-ip.hinet.net [1.34.128.40]:57103: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.188.103.179
description:
2025-02-05 07:29:39 dovecot_plain authenticator failed for (tagsdev.click) [199.188.103.179]:52752: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.159.145.190
description:
Feb  5 07:30:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.159.145.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.64.246
description:
Feb  5 07:29:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.64.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
description:
2025-02-05 07:29:25 dovecot_plain authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:36642: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.31.50
description:
2025-02-05 07:29:34 dovecot_plain authenticator failed for ([109.69.31.50]) [109.69.31.50]:54258: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.142.135
description:
2025-02-05 07:30:04 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:31789: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.66.129.26
description:
Feb  5 07:30:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.66.129.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.44.171
description:
2025-02-05 07:29:21 dovecot_plain authenticator failed for ([222.128.44.171]) [222.128.44.171]:2224: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.14.33
description:
2025-02-05 07:29:23 dovecot_plain authenticator failed for ([59.2.14.33]) [59.2.14.33]:45302: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.154.94.85
description:
2025-02-05 07:29:30 dovecot_plain authenticator failed for ([43.154.94.85]) [43.154.94.85]:53434: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
description:
Feb  5 07:29:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.135.93
description:
Feb  5 07:29:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.135.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.72.153.14
description:
2025-02-05 07:29:49 dovecot_plain authenticator failed for (160.72.153.14.lightower.net) [160.72.153.14]:58333: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
description:
2025-02-05 07:29:53 dovecot_plain authenticator failed for ([117.247.239.202]) [117.247.239.202]:36480: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.93.66
description:
2025-02-05 07:29:53 dovecot_plain authenticator failed for ([181.233.93.3]) [181.233.93.66]:38152: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.30.104
description:
2025-02-05 07:29:54 dovecot_plain authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:32908: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.145.74.157
description:
[2025-02-05 07:29:56 +0100] info [webmaild] 103.145.74.157 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.11
description:
2025-02-05 07:29:21 dovecot_plain authenticator failed for (m121-202-205-11.smartone.com) [121.202.205.11]:61787: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.161.52.149
description:
Feb  5 07:29:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.161.52.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.100.105.194
description:
2025-02-05 07:29:33 dovecot_plain authenticator failed for d96469c2.static.ziggozakelijk.nl ([217.100.105.195]) [217.100.105.194]:44288: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.91.178.253
description:
2025-02-05 07:29:36 dovecot_plain authenticator failed for ([111.91.178.253]) [111.91.178.253]:52752: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.232
description:
2025-02-05 07:29:42 dovecot_plain authenticator failed for ([196.191.212.232]) [196.191.212.232]:36608: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
description:
2025-02-05 07:29:43 dovecot_plain authenticator failed for ([218.147.6.84]) [218.147.6.84]:58218: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.72.153.14
description:
Feb  5 07:29:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.72.153.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.196.64.203
description:
2025-02-05 07:30:06 dovecot_plain authenticator failed for ([120.196.64.203]) [120.196.64.203]:45563: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.21.148
description:
2025-02-05 07:29:20 dovecot_plain authenticator failed for ([221.167.21.148]) [221.167.21.148]:33164: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.202.11
description:
2025-02-05 07:29:36 dovecot_plain authenticator failed for (381859.cloudwaysapps.com) [128.199.202.11]:31404: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.128.121.108
description:
[2025-02-05 07:29:37 +0100] info [webmaild] 177.128.121.108 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.118.145.212
description:
Feb  5 07:29:40 ait sshd[402471]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.118.145.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.204.166.99
description:
2025-02-05 07:29:40 dovecot_plain authenticator failed for ([218.204.166.99]) [218.204.166.99]:52511: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.216.2.74
description:
2025-02-05 07:29:43 dovecot_plain authenticator failed for ([222.216.2.74]) [222.216.2.74]:51110: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.245.207.104
description:
2025-02-05 07:29:22 dovecot_plain authenticator failed for ([1.245.207.104]) [1.245.207.104]:48257: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.179.8.206
description:
2025-02-05 07:29:23 dovecot_plain authenticator failed for ([210.179.8.206]) [210.179.8.206]:45873: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.217.2.45
description:
2025-02-05 07:29:32 dovecot_plain authenticator failed for static-193-217-2-45.cust.tele2.lt [193.217.2.45]:40092: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
description:
2025-02-05 07:29:39 dovecot_plain authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:45342: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.118.145.212
description:
Feb  5 07:29:40 ait sshd[402471]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.118.145.212  user=ftp


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.165
description:
2025-02-05 07:29:45 dovecot_plain authenticator failed for ([121.202.152.165]) [121.202.152.165]:19878: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.33.44.12
description:
2025-02-05 07:29:46 dovecot_plain authenticator failed for ([209.33.44.12]) [209.33.44.12]:46897: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.66.129.26
description:
2025-02-05 07:30:09 dovecot_plain authenticator failed for bb115-66-129-26.singnet.com.sg [115.66.129.26]:37628: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.235.148.73
description:
2025-02-05 07:29:21 dovecot_plain authenticator failed for ([171.235.148.73]) [171.235.148.73]:59548: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
description:
2025-02-05 07:29:23 dovecot_plain authenticator failed for ([102.90.34.90]) [102.90.34.90]:45213: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
description:
2025-02-05 07:29:25 dovecot_plain authenticator failed for ([60.173.105.206]) [60.173.105.206]:48104: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.196.174.235
description:
2025-02-05 07:29:20 dovecot_plain authenticator failed for ([183.196.174.235]) [183.196.174.235]:48109: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.106
description:
2025-02-05 07:29:20 dovecot_plain authenticator failed for 111-70-49-106.emome-ip.hinet.net [111.70.49.106]:44383: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
description:
Feb  5 07:29:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Feb  5 07:29:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-02-05 07:29:40 dovecot_plain authenticator failed for ([221.209.48.204]) [221.209.48.203]:38784: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.174
description:
2025-02-05 07:29:26 dovecot_plain authenticator failed for ([27.40.100.174]) [27.40.100.174]:46418: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.159.145.190
description:
2025-02-05 07:30:12 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:53315: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.200.216.246
description:
Feb  5 07:29:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.200.216.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.255.221
description:
2025-02-05 07:29:28 dovecot_plain authenticator failed for ([218.146.255.221]) [218.146.255.221]:51083: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.33.87.111
description:
2025-02-05 07:29:31 dovecot_plain authenticator failed for (111-86-33-194.intelcom-ug.ru) [194.33.87.111]:55346: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
description:
2025-02-05 07:29:42 dovecot_plain authenticator failed for ([210.206.24.238]) [210.206.24.234]:34707: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.87.122.207
description:
2025-02-05 07:29:49 dovecot_plain authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:46246: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.142.135
description:
Feb  5 07:30:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.142.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.153.85.132
description:
2025-02-05 07:29:22 dovecot_plain authenticator failed for ([46.153.85.132]) [46.153.85.132]:44400: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.134.209.86
description:
2025-02-05 07:29:36 dovecot_plain authenticator failed for ([183.134.209.86]) [183.134.209.86]:38957: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.135.93
description:
2025-02-05 07:29:36 dovecot_plain authenticator failed for 93.135.220.111.sta.wbroadband.net.au [111.220.135.93]:36757: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.183.1.82
description:
2025-02-05 07:29:42 dovecot_plain authenticator failed for ([1.183.1.82]) [1.183.1.82]:36231: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.115.205.253
description:
Feb  5 07:30:26 ait sshd[402773]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.115.205.253


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.161.198.33
description:
[2025-02-05 07:30:27 +0100] info [webmaild] 45.161.198.33 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.24.163.2
description:
2025-02-05 07:31:10 dovecot_login authenticator failed for syn-098-024-163-002.res.spectrum.com [98.24.163.2]:53808: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.110.200.43
description:
Feb  5 07:31:07 ait sshd[403062]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.110.200.43


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.24.163.2
description:
Feb  5 07:31:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.24.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.205.253
description:
Feb  5 07:30:26 ait sshd[402773]: pam_imunify(sshd:auth): [IM360_RBL] The IP 124.115.205.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 07:30:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.110.200.43
description:
Feb  5 07:31:07 ait sshd[403062]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.110.200.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.218.158.114
description:
Feb  5 07:31:37 ait sshd[403256]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.218.158.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.172.225.52
description:
2025-02-05 07:32:05 dovecot_plain authenticator failed for ([178.172.225.52]) [178.172.225.52]:54652: 535 Incorrect authentication data


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.45.245.35
description:
Feb  5 07:32:06 ait sshd[403303]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.45.245.35 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.202.53.42
description:
[2025-02-05 07:32:15 +0100] info [webmaild] 143.202.53.42 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.218.158.114
description:
Feb  5 07:31:37 ait sshd[403256]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.218.158.114


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.219.170.41
description:
[2025-02-05 07:31:38 +0100] info [webmaild] 102.219.170.41 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.45.245.35
description:
Feb  5 07:32:07 ait sshd[403303]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.45.245.35  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.172.79.206
description:
Feb  5 07:33:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.172.79.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.172.79.206
description:
2025-02-05 07:33:17 dovecot_plain authenticator failed for ([211.172.79.206]) [211.172.79.206]:43090: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.50
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/engine1/images/images/js/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 20.171.207.50
domain: ait-edu.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:07-32.20.171.207.50||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.246.45.57
description:
2025-02-05 07:32:48 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:55942: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.247.127.250
description:
Feb  5 07:33:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.247.127.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.204.214
description:
Feb  5 07:33:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.204.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.23.103
description:
2025-02-05 07:32:59 dovecot_plain authenticator failed for ([115.23.23.103]) [115.23.23.103]:38836: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.133.156.133
description:
Feb  5 07:32:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.133.156.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.246.45.57
description:
Feb  5 07:32:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.246.45.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.2.236.153
description:
2025-02-05 07:32:49 dovecot_login authenticator failed for (5rp4uEl9Gt) [212.2.236.153]:56111: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.193.213.179
description:
[2025-02-05 07:33:06 +0100] info [webmaild] 41.193.213.179 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.23.103
description:
Feb  5 07:32:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.23.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.196.240
description:
Feb  5 07:32:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.196.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.250
description:
2025-02-05 07:33:14 dovecot_plain authenticator failed for ([211.247.127.250]) [211.247.127.250]:54463: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 07:33:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
description:
Feb  5 07:33:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.11
description:
Feb  5 07:33:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.250
description:
Feb  5 07:33:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.133
description:
2025-02-05 07:32:47 dovecot_plain authenticator failed for ([195.133.156.133]) [195.133.156.133]:49713: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.2.236.153
description:
Feb  5 07:32:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.2.236.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
description:
2025-02-05 07:33:12 dovecot_plain authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:2584: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 66.181.183.135
description:
[2025-02-05 07:32:34 +0100] info [webmaild] 66.181.183.135 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.196.240
description:
2025-02-05 07:33:00 dovecot_plain authenticator failed for (mobile-166-195-196-240.mycingular.net) [166.195.196.240]:47782: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.204.214
description:
2025-02-05 07:33:15 dovecot_plain authenticator failed for ([117.176.204.214]) [117.176.204.214]:43244: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Feb  5 07:33:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.59.2
description:
2025-02-05 07:33:31 dovecot_plain authenticator failed for syn-074-062-059-002.biz.spectrum.com [74.62.59.2]:60260: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.97.132
description:
Feb  5 07:33:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.97.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.207.134
description:
Feb  5 07:33:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.207.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.207.134
description:
2025-02-05 07:33:36 dovecot_plain authenticator failed for ([221.2.207.134]) [221.2.207.134]:51152: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.254.136.116
description:
Feb  5 07:34:15 ait sshd[403998]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.254.136.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-02-05 07:33:30 dovecot_plain authenticator failed for ([121.202.153.186]) [121.202.153.186]:52837: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.97.132
description:
2025-02-05 07:33:34 dovecot_plain authenticator failed for (abts-mum-static-132.97.169.122.airtelbroadband.in) [122.169.97.132]:53975: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.48.181
description:
2025-02-05 07:33:53 dovecot_plain authenticator failed for broadband-37-110-48-181.ip.moscow.rt.ru [37.110.48.181]:45562: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-02-05 07:34:10 dovecot_plain authenticator failed for (ranism) [91.116.42.218]:47774: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 07:34:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.2.236.153
description:
Feb  5 07:33:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.2.236.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.81.14.113
description:
Feb  5 07:33:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.81.14.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.148.165
description:
Feb  5 07:33:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.148.165 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.36.7.162
description:
[2025-02-05 07:34:18 +0100] info [webmaild] 138.36.7.162 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.189
description:
2025-02-05 07:34:15 dovecot_plain authenticator failed for (wisred) [65.20.147.189]:36936: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.250
description:
2025-02-05 07:33:21 dovecot_plain authenticator failed for ([103.69.9.250]) [103.69.9.250]:48269: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.59.2
description:
Feb  5 07:33:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.59.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
description:
2025-02-05 07:33:59 dovecot_plain authenticator failed for (gaiptrines) [65.20.148.165]:46448: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.29.232.113
description:
Feb  5 07:34:08 ait sshd[403989]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.29.232.113


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.2.236.153
description:
2025-02-05 07:33:21 dovecot_login authenticator failed for (MSzN57) [212.2.236.153]:54695: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.81.14.113
description:
2025-02-05 07:33:24 dovecot_plain authenticator failed for ([170.81.14.113]) [170.81.14.113]:58984: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.48.181
description:
Feb  5 07:33:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.48.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Feb  5 07:34:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Feb  5 07:34:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.254.136.116
description:
Feb  5 07:34:15 ait sshd[403998]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.136.116


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.11
description:
2025-02-05 07:33:21 dovecot_plain authenticator failed for (m121-202-205-11.smartone.com) [121.202.205.11]:9501: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-02-05 07:34:07 dovecot_plain authenticator failed for (lenceo) [109.166.70.166]:3736: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.29.232.113
description:
Feb  5 07:34:08 ait sshd[403989]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.29.232.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.147.189
description:
Feb  5 07:34:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.147.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.241.150
description:
2025-02-05 07:35:09 dovecot_plain authenticator failed for ([61.143.241.150]) [61.143.241.150]:56315: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.195.67.82
description:
Feb  5 07:35:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.195.67.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.195.67.82
description:
2025-02-05 07:35:12 dovecot_plain authenticator failed for ([200.195.67.82]) [200.195.67.82]:60627: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.225.113
description:
[2025-02-05 07:35:15 +0100] info [webmaild] 168.232.225.113 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Feb  5 07:35:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.219.136.166
description:
[2025-02-05 07:34:56 +0100] info [webmaild] 186.219.136.166 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.52.204.227
description:
2025-02-05 07:35:07 dovecot_plain authenticator failed for ([46.52.204.227]) [46.52.204.227]:57589: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-02-05 07:35:18 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:21664: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.176.170.160
description:
Feb  5 07:34:29 ait sshd[404038]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.176.170.160


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.52.204.227
description:
Feb  5 07:35:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.52.204.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.241.150
description:
Feb  5 07:35:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.241.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.33.87.111
description:
2025-02-05 07:35:24 dovecot_plain authenticator failed for (111-86-33-194.intelcom-ug.ru) [194.33.87.111]:55392: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.45.37.20
description:
Feb  5 07:35:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.45.37.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.129.178
description:
2025-02-05 07:36:01 dovecot_plain authenticator failed for ([197.250.7.67]) [41.220.129.178]:36394: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
description:
2025-02-05 07:35:24 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (caphic) [81.225.30.107]:41496: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.45.37.20
description:
2025-02-05 07:35:30 dovecot_plain authenticator failed for (equentia) [41.45.37.20]:37432: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
description:
2025-02-05 07:35:41 dovecot_plain authenticator failed for (18712549.telemar.net.br) [187.76.174.254]:54775: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 07:35:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.4.12.44
description:
Feb  5 07:35:52 ait sshd[404791]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.4.12.44 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.4.12.44
description:
Feb  5 07:35:52 ait sshd[404791]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.4.12.44


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.129.178
description:
Feb  5 07:35:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.129.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Feb  5 07:35:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.33.87.111
description:
Feb  5 07:35:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.33.87.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
description:
Feb  5 07:35:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.150.40.63
description:
Feb  5 07:35:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.150.40.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.150.40.63
description:
2025-02-05 07:35:34 dovecot_plain authenticator failed for c188-150-40-63.bredband.tele2.se (schry) [188.150.40.63]:37346: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.206.61.15
description:
[2025-02-05 07:35:47 +0100] info [webmaild] 213.206.61.15 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.250
description:
Feb  5 07:35:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.250
description:
2025-02-05 07:35:30 dovecot_plain authenticator failed for 111-70-23-250.emome-ip.hinet.net [111.70.23.250]:45000: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.218
description:
Feb  5 07:37:18 ait sshd[405054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.218  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 07:36:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.131.77.254
description:
[2025-02-05 07:37:08 +0100] info [webmaild] 177.131.77.254 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.189
description:
Feb  5 07:37:15 ait sshd[405057]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
description:
Feb  5 07:37:15 ait sshd[405057]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.223.168.116
description:
[2025-02-05 07:37:46 +0100] info [webmaild] 186.223.168.116 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 27.71.27.234
description:
Feb  5 07:37:49 ait sshd[405450]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.71.27.234


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.125.253.75
description:
[2025-02-05 07:37:55 +0100] info [webmaild] 154.125.253.75 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 109.234.164.117
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-37.109.234.164.117


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.218
description:
Feb  5 07:37:43 ait sshd[405264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.218  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.100.80.252
description:
[2025-02-05 07:38:29 +0100] info [webmaild] 191.100.80.252 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.234.132.226
description:
2025-02-05 07:38:35 dovecot_login authenticator failed for (static-TB-132-226.kbcnet.rs) [91.234.132.226]:34375: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.215.107.189
description:
Feb  5 07:39:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.215.107.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.132.226
description:
Feb  5 07:38:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.132.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.126.90.28
description:
Feb  5 07:39:02 ait sshd[405818]: pam_imunify(sshd:auth): [IM360_RBL] The IP 101.126.90.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.107.43
description:
Feb  5 07:38:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.107.43 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.90.28
description:
Feb  5 07:39:02 ait sshd[405818]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.90.28


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.107.189
description:
2025-02-05 07:39:20 dovecot_plain authenticator failed for (biophormula.static.gvt.net.br) [186.215.107.189]:58762: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.107.43
description:
2025-02-05 07:38:45 dovecot_login authenticator failed for 110-25-107-43.adsl.fetnet.net [110.25.107.43]:57069: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.237.193
description:
Feb  5 07:39:59 ait sshd[406309]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.245.237.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.1.154
description:
2025-02-05 07:39:34 dovecot_plain authenticator failed for 110-4-1-154.static.pccw-hkt.com [110.4.1.154]:38403: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Feb  5 07:39:59 ait sshd[406307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.245.237.193
description:
Feb  5 07:39:59 ait sshd[406309]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.245.237.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.1.154
description:
Feb  5 07:39:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.1.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Feb  5 07:39:59 ait sshd[406307]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.52.180
description:
[2025-02-05 07:40:18 +0100] info [webmaild] 170.239.52.180 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
description:
2025-02-05 07:41:07 dovecot_plain authenticator failed for ([110.77.137.236]) [110.77.137.236]:55510: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.199.60.35
description:
[2025-02-05 07:40:55 +0100] info [webmaild] 181.199.60.35 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.44.217.237
description:
Feb  5 07:41:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.44.217.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.77.137.236
description:
Feb  5 07:41:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.77.137.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 07:41:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Feb  5 07:41:20 ait sshd[406862]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.87.166.158
description:
[2025-02-05 07:40:57 +0100] info [webmaild] 177.87.166.158 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.50
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/engine1/images/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/engine1


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 20.171.207.50
domain: ait-edu.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:07-41.20.171.207.50||RSV:6.65||T:APACHE||


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-41.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.38.239.52
description:
Feb  5 07:41:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.38.239.52 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.57.246
description:
47.128.57.246 - - [05/Feb/2025:07:40:27 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=8317677 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/7/?duration=medium&filtering=1&instructor=2&level=intermediate%2Cbeginner%2Call_levels" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.57.246


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 57.129.17.80
description:
Feb  5 07:41:31 ait sshd[406895]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=57.129.17.80


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.77.25.247
description:
Feb  5 07:41:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.77.25.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
description:
2025-02-05 07:41:46 dovecot_plain authenticator failed for (lumpen) [65.20.233.110]:57960: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.38.239.52
description:
2025-02-05 07:41:21 dovecot_plain authenticator failed for ([118.38.239.52]) [118.38.239.52]:34250: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.230
description:
2025-02-05 07:41:23 dovecot_plain authenticator failed for ([27.40.100.230]) [27.40.100.230]:50771: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.235.148.73
description:
Feb  5 07:41:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.235.148.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.212.219
description:
Feb  5 07:41:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.212.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.43.174
description:
2025-02-05 07:41:32 dovecot_plain authenticator failed for (189-113-43-174.netturbo.com.br) [189.113.43.174]:59574: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.233.110
description:
Feb  5 07:41:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.233.110 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.10.245.107
description:
Feb  5 07:41:22 ait sshd[406862]: Failed password for invalid user ait from 216.10.245.107 port 57326 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.44.217.237
description:
2025-02-05 07:41:21 dovecot_login authenticator failed for ([121.44.217.237]) [121.44.217.237]:40929: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
description:
2025-02-05 07:41:31 dovecot_plain authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:40275: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.248.55
description:
Feb  5 07:41:50 ait sshd[407067]: pam_imunify(sshd:auth): [IM360_RBL] The IP 209.38.248.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.230
description:
Feb  5 07:41:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.235.148.73
description:
2025-02-05 07:41:27 dovecot_plain authenticator failed for ([171.235.148.73]) [171.235.148.73]:53856: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.17.80
description:
Feb  5 07:41:31 ait sshd[406895]: pam_imunify(sshd:auth): [IM360_RBL] The IP 57.129.17.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.77.25.247
description:
2025-02-05 07:41:35 dovecot_plain authenticator failed for (static-76-77-25-247.networklubbock.net) [76.77.25.247]:39586: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 209.38.248.55
description:
Feb  5 07:41:50 ait sshd[407067]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.248.55


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.113.43.174
description:
Feb  5 07:41:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.113.43.174 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.136.97.210
description:
[2025-02-05 07:41:29 +0100] info [webmaild] 178.136.97.210 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.59.228.24
description:
Feb  5 07:42:52 ait sshd[407486]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.228.24


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.37.212.85
description:
Feb  5 07:42:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.37.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.223
description:
Feb  5 07:42:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.223
description:
2025-02-05 07:42:28 dovecot_plain authenticator failed for (pocang) [65.20.155.223]:36979: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.137.6.158
description:
Feb  5 07:42:35 ait sshd[407156]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.137.6.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.59.228.24
description:
Feb  5 07:42:52 ait sshd[407486]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.59.228.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.122.251.252
description:
[2025-02-05 07:42:54 +0100] info [webmaild] 178.122.251.252 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
description:
2025-02-05 07:42:23 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (vence) [176.37.212.85]:59525: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.12.90.118
description:
Feb  5 07:42:29 ait sshd[407148]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.90.118


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.137.6.158
description:
Feb  5 07:42:35 ait sshd[407156]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.137.6.158  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.202.148.110
description:
2025-02-05 07:44:19 dovecot_plain authenticator failed for ([94.202.148.110]) [94.202.148.110]:54714: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.48.178.213
description:
[2025-02-05 07:43:47 +0100] info [webmaild] 189.48.178.213 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
description:
Feb  5 07:43:27 ait sshd[407543]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.95.174
description:
2025-02-05 07:43:46 dovecot_plain authenticator failed for ([186.177.95.174]) [186.177.95.174]:44620: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.140
description:
Feb  5 07:44:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.2.198
description:
2025-02-05 07:43:56 dovecot_login authenticator failed for 111-70-2-198.emome-ip.hinet.net [111.70.2.198]:45389: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 128.201.206.71
description:
[2025-02-05 07:44:07 +0100] info [webmaild] 128.201.206.71 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Feb  5 07:43:27 ait sshd[407543]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.83
description:
Feb  5 07:43:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.2.198
description:
Feb  5 07:43:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.2.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-02-05 07:44:06 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:38070: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.202.148.110
description:
Feb  5 07:44:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.202.148.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.113.3.87
description:
Feb  5 07:43:39 ait sshd[407582]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.113.3.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.59.157
description:
Feb  5 07:43:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.59.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
description:
2025-02-05 07:43:54 dovecot_plain authenticator failed for ([195.222.59.157]) [195.222.59.157]:48268: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.177.95.174
description:
Feb  5 07:43:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.177.95.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.140
description:
2025-02-05 07:44:02 dovecot_plain authenticator failed for ([27.40.100.140]) [27.40.100.140]:55998: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Feb  5 07:44:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.150
description:
2025-02-05 07:44:19 dovecot_plain authenticator failed for ([1.28.192.150]) [1.28.192.150]:43261: 535 Incorrect authentication data (set_id=admin@elma-hk.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.179.80.12
description:
Feb  5 07:43:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.179.80.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.80.12
description:
2025-02-05 07:43:44 dovecot_login authenticator failed for ([186.179.80.12]) [186.179.80.12]:46644: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.213.164.27
description:
Feb  5 07:43:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.213.164.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.213.164.27
description:
2025-02-05 07:43:59 dovecot_login authenticator failed for ([1.213.164.27]) [1.213.164.27]:39622: 535 Incorrect authentication data (set_id=test@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.150
description:
Feb  5 07:44:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.150 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.138.115
description:
[2025-02-05 07:43:33 +0100] info [webmaild] 177.37.138.115 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.113.3.87
description:
Feb  5 07:43:39 ait sshd[407582]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.113.3.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.83
description:
2025-02-05 07:43:55 dovecot_plain authenticator failed for 083.42.246.220.static.netvigator.com [220.246.42.83]:56751: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.216.5.134
description:
Feb  5 07:44:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.216.5.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.76.95.152
description:
2025-02-05 07:44:42 dovecot_plain authenticator failed for ([62.76.95.152]) [62.76.95.152]:43394: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.225.185.154
description:
Feb  5 07:44:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.225.185.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.59.245.133
description:
2025-02-05 07:44:58 dovecot_plain authenticator failed for 133.red-80-59-245.staticip.rima-tde.net [80.59.245.133]:35066: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Feb  5 07:44:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.247.85
description:
Feb  5 07:44:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.247.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.30.104
description:
2025-02-05 07:44:51 dovecot_plain authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:48192: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.233.77.136
description:
Feb  5 07:44:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.233.77.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.216.5.134
description:
2025-02-05 07:44:44 dovecot_plain authenticator failed for ([114.216.5.134]) [114.216.5.134]:45866: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.144.187.114
description:
Feb  5 07:44:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.144.187.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.190.109.138
description:
Feb  5 07:44:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.190.109.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.196.84.188
description:
Feb  5 07:44:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.196.84.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
description:
Feb  5 07:45:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.79.247
description:
Feb  5 07:44:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.79.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.0.3
description:
2025-02-05 07:44:54 dovecot_plain authenticator failed for ([177.174.0.3]) [177.174.0.3]:37900: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.0.3
description:
Feb  5 07:44:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.0.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.204.109
description:
2025-02-05 07:44:53 dovecot_plain authenticator failed for (ucicinemas.static.gvt.net.br) [186.215.204.109]:40967: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.142.157
description:
Feb  5 07:44:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.142.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.85.164
description:
Feb  5 07:44:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.85.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.85.164
description:
2025-02-05 07:44:36 dovecot_plain authenticator failed for (23-94-85-164-host.colocrossing.com) [23.94.85.164]:46988: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.170.255.146
description:
Feb  5 07:44:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.170.255.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.79.247
description:
2025-02-05 07:44:39 dovecot_plain authenticator failed for ([14.37.79.247]) [14.37.79.247]:60312: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.206.91.51
description:
2025-02-05 07:44:51 dovecot_plain authenticator failed for ([85.206.91.51]) [85.206.91.51]:46434: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.196.84.188
description:
2025-02-05 07:44:57 dovecot_plain authenticator failed for static-168-196-84-188.hilink.net.br [168.196.84.188]:55871: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.135.93
description:
Feb  5 07:45:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.135.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Feb  5 07:44:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.144.187.114
description:
2025-02-05 07:44:40 dovecot_plain authenticator failed for ([89.144.187.114]) [89.144.187.114]:47484: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.104.122.159
description:
2025-02-05 07:44:41 dovecot_plain authenticator failed for host-216-104-122-159.public.eastlink.ca [216.104.122.159]:49934: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.102
description:
2025-02-05 07:44:42 dovecot_plain authenticator failed for (nsg-corporate-102.234.187.122.airtel.in) [122.187.234.102]:60336: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.61.7.100
description:
Feb  5 07:44:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.61.7.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.200.229.33
description:
2025-02-05 07:45:07 dovecot_plain authenticator failed for ([119.200.229.33]) [119.200.229.33]:56127: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.135.93
description:
2025-02-05 07:45:09 dovecot_plain authenticator failed for 93.135.220.111.sta.wbroadband.net.au [111.220.135.93]:44244: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.153.13.161
description:
Feb  5 07:44:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.153.13.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.170.255.146
description:
2025-02-05 07:44:40 dovecot_plain authenticator failed for ([222.170.255.146]) [222.170.255.146]:40071: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.153.13.161
description:
2025-02-05 07:44:41 dovecot_plain authenticator failed for ([219.153.13.161]) [219.153.13.161]:59313: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.247.92.186
description:
Feb  5 07:44:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.247.92.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.172.79.206
description:
Feb  5 07:44:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.172.79.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.225.239.115
description:
Feb  5 07:44:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.225.239.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-02-05 07:44:40 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:42724: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.3
description:
2025-02-05 07:44:40 dovecot_plain authenticator failed for (nsg-corporate-3.234.187.122.airtel.in) [122.187.234.3]:48851: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.32.132.170
description:
Feb  5 07:44:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.32.132.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.172.79.206
description:
2025-02-05 07:45:01 dovecot_plain authenticator failed for ([211.172.79.206]) [211.172.79.206]:34908: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.234.165.73
description:
2025-02-05 07:45:08 dovecot_plain authenticator failed for ([58.234.165.73]) [58.234.165.73]:35358: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.104.122.159
description:
Feb  5 07:44:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.104.122.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.199.209.60
description:
2025-02-05 07:44:42 dovecot_plain authenticator failed for (ws60-209.199.103.rcil.gov.in) [103.199.209.60]:43004: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.7.100
description:
2025-02-05 07:44:51 dovecot_plain authenticator failed for 100.7.61.94.rev.vodafone.pt [94.61.7.100]:53602: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.77.136
description:
2025-02-05 07:44:57 dovecot_plain authenticator failed for ([80.233.77.136]) [80.233.77.136]:14013: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.202.11
description:
2025-02-05 07:45:01 dovecot_plain authenticator failed for (381859.cloudwaysapps.com) [128.199.202.11]:28966: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.3
description:
Feb  5 07:44:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.225.239.115
description:
2025-02-05 07:44:39 dovecot_plain authenticator failed for ([58.225.239.115]) [58.225.239.115]:59937: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.75.30.6
description:
2025-02-05 07:44:54 dovecot_plain authenticator failed for ([218.75.30.6]) [218.75.30.6]:58415: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.202.11
description:
Feb  5 07:44:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.199.202.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.241.252
description:
2025-02-05 07:45:20 dovecot_plain authenticator failed for ([183.220.241.252]) [183.220.241.252]:37106: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-02-05 07:45:17 dovecot_plain authenticator failed for (13-78-123-185.host.cirex.ru) [185.123.78.13]:34074: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
description:
2025-02-05 07:44:34 dovecot_plain authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:39560: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
description:
2025-02-05 07:44:40 dovecot_plain authenticator failed for ([187.51.128.233]) [189.44.133.238]:37543: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
description:
2025-02-05 07:44:40 dovecot_plain authenticator failed for ([183.99.89.74]) [183.99.89.74]:39290: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.206.91.51
description:
Feb  5 07:44:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.206.91.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.75.30.6
description:
Feb  5 07:44:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.75.30.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.190.109.138
description:
2025-02-05 07:44:43 dovecot_plain authenticator failed for ([222.190.109.138]) [222.190.109.138]:33339: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.30.104
description:
Feb  5 07:44:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.30.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Feb  5 07:44:56 ait sshd[408030]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.220.33
description:
Feb  5 07:45:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.220.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.129
description:
2025-02-05 07:44:29 dovecot_login authenticator failed for ([118.220.149.129]) [118.220.149.129]:48528: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.81
description:
Feb  5 07:44:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.27.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.247.85
description:
2025-02-05 07:44:50 dovecot_plain authenticator failed for ([183.220.247.85]) [183.220.247.85]:41766: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.215.204.109
description:
Feb  5 07:44:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.215.204.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.247.92.186
description:
2025-02-05 07:44:52 dovecot_plain authenticator failed for ([60.247.92.186]) [60.247.92.186]:41215: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.225.185.154
description:
2025-02-05 07:44:57 dovecot_plain authenticator failed for ([124.225.185.154]) [124.225.185.154]:51118: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.32.132.170
description:
2025-02-05 07:44:57 dovecot_plain authenticator failed for ([117.32.132.170]) [117.32.132.170]:41839: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.28
description:
2025-02-05 07:45:01 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.152.28]:56544: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.220.149.129
description:
Feb  5 07:44:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.220.149.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.99.89.74
description:
Feb  5 07:44:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.99.89.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.199.209.60
description:
Feb  5 07:44:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.199.209.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.76.95.152
description:
Feb  5 07:44:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.76.95.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.59.245.133
description:
Feb  5 07:44:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.59.245.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.241.252
description:
Feb  5 07:45:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.241.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
description:
2025-02-05 07:45:04 dovecot_plain authenticator failed for (nsg-corporate-194.153.186.122.airtel.in) [106.51.220.33]:28296: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.200.229.33
description:
Feb  5 07:45:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.200.229.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-02-05 07:44:37 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:63256: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.133.238
description:
Feb  5 07:44:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.102
description:
Feb  5 07:44:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
description:
2025-02-05 07:44:45 dovecot_plain authenticator failed for ([27.71.27.81]) [27.71.27.81]:41732: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Feb  5 07:44:56 ait sshd[408030]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Feb  5 07:45:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-02-05 07:45:53 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (cakeitte) [87.103.126.54]:2136: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.225.134.13
description:
Feb  5 07:45:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.225.134.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 149.78.62.191
description:
[2025-02-05 07:46:09 +0100] info [webmaild] 149.78.62.191 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.42.173.64
description:
Feb  5 07:46:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.42.173.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.42.173.64
description:
2025-02-05 07:46:16 dovecot_plain authenticator failed for ([115.42.173.64]) [115.42.173.64]:56310: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.172.225.52
description:
2025-02-05 07:45:34 dovecot_plain authenticator failed for ([178.172.225.52]) [178.172.225.52]:38962: 535 Incorrect authentication data (set_id=nyarko@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.89.67
description:
Feb  5 07:46:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.89.67 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 140.238.28.248
domain: afaccra.u3l.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-includes/js/tinymce/skins/wordpress/images/index.php||SC:/home/titlemas/public_html/afaccra.u3l.us/wp-includes/js/tinymce/skins/wordpress/images/index.php


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.89.67
description:
2025-02-05 07:46:13 dovecot_plain authenticator failed for ([106.246.89.67]) [106.246.89.67]:39058: 535 Incorrect authentication data (set_id=nyarko)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.51.25.129
description:
[2025-02-05 07:45:35 +0100] info [webmaild] 189.51.25.129 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.225.134.13
description:
2025-02-05 07:45:57 dovecot_plain authenticator failed for ([182.225.134.13]) [182.225.134.13]:55165: 535 Incorrect authentication data (set_id=nyarko@ait.edu.gh)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 140.238.28.248
domain: afaccra.u3l.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:07-46.140.238.28.248||RSV:6.65||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.178.187.29
description:
[2025-02-05 07:46:14 +0100] info [webmaild] 103.178.187.29 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.172.225.52
description:
Feb  5 07:45:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.172.225.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.228.105.192
description:
Feb  5 07:46:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.228.105.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.228.105.192
description:
2025-02-05 07:46:26 dovecot_plain authenticator failed for ([58.228.105.192]) [58.228.105.192]:57878: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 128.201.255.244
description:
[2025-02-05 07:46:44 +0100] info [webmaild] 128.201.255.244 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.45.37.20
description:
2025-02-05 07:47:56 dovecot_plain authenticator failed for (lorthist) [41.45.37.20]:60627: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.35.136.21
description:
[2025-02-05 07:48:19 +0100] info [webmaild] 46.35.136.21 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.185.189.151
description:
Feb  5 07:47:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.185.189.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.218.158.114
description:
Feb  5 07:47:46 ait sshd[408880]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.218.158.114 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.218.158.114
description:
Feb  5 07:47:46 ait sshd[408880]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.218.158.114


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.189.151
description:
2025-02-05 07:47:45 dovecot_plain authenticator failed for 5.185.189.151.ipv4.public.orange.pl (looed) [5.185.189.151]:47406: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.45.37.20
description:
Feb  5 07:47:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.45.37.20 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.215.126.102
description:
[2025-02-05 07:48:57 +0100] info [webmaild] 179.215.126.102 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
description:
Feb  5 07:49:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
description:
2025-02-05 07:49:02 dovecot_plain authenticator failed for (yelessil) [88.87.84.104]:53692: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.37.89.177
description:
Feb  5 07:49:12 ait sshd[409516]: pam_imunify(sshd:auth): [IM360_RBL] The IP 70.37.89.177 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 70.37.89.177
description:
Feb  5 07:49:12 ait sshd[409516]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.37.89.177


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.229.139.210
description:
[2025-02-05 07:48:53 +0100] info [webmaild] 196.229.139.210 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.230.83.162
description:
Feb  5 07:49:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.230.83.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.230.83.162
description:
2025-02-05 07:49:53 dovecot_plain authenticator failed for 81-230-83-162-no600.tbcn.telia.com (suredites) [81.230.83.162]:48301: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 07:50:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.185.174.170
description:
[2025-02-05 07:49:27 +0100] info [webmaild] 197.185.174.170 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.87.171.242
description:
[2025-02-05 07:51:00 +0100] info [webmaild] 185.87.171.242 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.16.124.204
description:
Feb  5 07:51:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.16.124.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.16.124.204
description:
2025-02-05 07:51:17 dovecot_plain authenticator failed for (uparrin) [165.16.124.204]:55814: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 07:52:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.37.89.177
description:
Feb  5 07:52:04 ait sshd[410650]: pam_imunify(sshd:auth): [IM360_RBL] The IP 70.37.89.177 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.80.60.60
description:
[2025-02-05 07:51:41 +0100] info [webmaild] 170.80.60.60 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.73.130.43
description:
Feb  5 07:51:51 ait sshd[410492]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.73.130.43 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.73.130.43
description:
Feb  5 07:51:51 ait sshd[410492]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.73.130.43


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.250.142.168
description:
[2025-02-05 07:51:52 +0100] info [webmaild] 179.250.142.168 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 70.37.89.177
description:
Feb  5 07:52:04 ait sshd[410650]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.37.89.177


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.221.67.205
description:
[2025-02-05 07:52:24 +0100] info [webmaild] 131.221.67.205 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
description:
Feb  5 07:53:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
description:
2025-02-05 07:53:10 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:49543: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.192.170.100
description:
[2025-02-05 07:53:45 +0100] info [webmaild] 154.192.170.100 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.91
description:
2025-02-05 07:53:56 dovecot_plain authenticator failed for (coxce) [65.20.155.91]:35877: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 80.94.95.157
domain: www.admissions.ait.edu.gh
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/network.php||SC:/home/ait02/public_html/admissions.ait.edu.gh/wp-admin/images/network.php


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 80.94.95.157
domain: www.admissions.ait.edu.gh
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:07-54.80.94.95.157||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.224.122.114
description:
Feb  5 07:53:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.224.122.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.224.122.114
description:
2025-02-05 07:53:22 dovecot_plain authenticator failed for ([183.224.122.114]) [183.224.122.114]:47260: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 07:53:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.91
description:
Feb  5 07:53:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.91 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.29.144.135
description:
[2025-02-05 07:54:59 +0100] info [webmaild] 189.29.144.135 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.181.179.23
description:
[2025-02-05 07:54:22 +0100] info [webmaild] 168.181.179.23 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 157.66.55.50
domain: jaster.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/autoload_classmap.php||SC:/home/titlemas/public_html/www.jaster.us/wp-admin


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 116.204.148.206
description:
[2025-02-05 07:54:29 +0100] info [webmaild] 116.204.148.206 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
description:
Feb  5 07:54:42 ait sshd[411345]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 157.66.55.50
domain: jaster.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:07-54.157.66.55.50||RSV:6.65||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Feb  5 07:55:15 ait sshd[411760]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 80.94.95.157
domain: www.admissions.ait.edu.gh
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-content/uploads/network.php||SC:/home/ait02/public_html/admissions.ait.edu.gh/wp-content/uploads/network.php


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
description:
Feb  5 07:54:42 ait sshd[411345]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Feb  5 07:55:15 ait sshd[411760]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.76.250.194
description:
Feb  5 07:55:55 ait sshd[411837]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.76.250.194 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.76.250.194
description:
Feb  5 07:55:55 ait sshd[411837]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.250.194


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 07:55:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-56.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 07:55:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.235.82.88
description:
2025-02-05 07:57:06 dovecot_login authenticator failed for ([222.235.82.88]) [222.235.82.88]:45432: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.30.65.17
description:
[2025-02-05 07:57:16 +0100] info [webmaild] 95.30.65.17 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.110.200.43
description:
Feb  5 07:56:27 ait sshd[412017]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.110.200.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 07:56:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.251.202.80
description:
Feb  5 07:56:47 ait sshd[412051]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.251.202.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.235.82.88
description:
Feb  5 07:57:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.235.82.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.176.170.160
description:
Feb  5 07:57:05 ait sshd[412236]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.176.170.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.168.173.87
description:
Feb  5 07:57:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.168.173.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.58.67.218
description:
2025-02-05 07:57:19 dovecot_login authenticator failed for ([103.58.67.218]) [103.58.67.218]:47414: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.110.200.43
description:
Feb  5 07:56:27 ait sshd[412017]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.110.200.43


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.67.218
description:
Feb  5 07:57:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.67.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.221.11.147
description:
[2025-02-05 07:56:21 +0100] info [webmaild] 177.221.11.147 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.248.65.30
description:
Feb  5 07:56:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.248.65.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
description:
2025-02-05 07:56:32 dovecot_login authenticator failed for ([219.248.65.30]) [219.248.65.30]:43856: 535 Incorrect authentication data (set_id=test@aitvarsity.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.235.228
description:
Feb  5 07:56:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.235.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
description:
Feb  5 07:56:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
description:
2025-02-05 07:56:55 dovecot_plain authenticator failed for (vallogint) [102.53.15.56]:42378: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.176.170.160
description:
Feb  5 07:57:05 ait sshd[412236]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.176.170.160


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.251.202.80
description:
Feb  5 07:56:47 ait sshd[412051]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.251.202.80


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.235.228
description:
2025-02-05 07:56:53 dovecot_login authenticator failed for ([92.118.235.228]) [92.118.235.228]:44180: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.82.59.131
description:
[2025-02-05 07:56:59 +0100] info [webmaild] 177.82.59.131 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 07:57:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.55.177.39
description:
2025-02-05 07:58:11 dovecot_login authenticator failed for ([218.55.177.39]) [218.55.177.39]:53920: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.124
description:
Feb  5 07:57:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.124 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Feb  5 07:57:57 ait sshd[412383]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 64.227.176.103
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-57.64.227.176.103


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Feb  5 07:57:57 ait sshd[412383]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.82
description:
2025-02-05 07:58:00 dovecot_login authenticator failed for (m121-202-152-82.smartone.com) [121.202.152.82]:50375: 535 Incorrect authentication data (set_id=test@worldwide-university.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.168.173.87
description:
2025-02-05 07:57:21 dovecot_plain authenticator failed for (cophurr) [185.168.173.87]:60112: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.190.111.104
description:
Feb  5 07:57:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.190.111.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.190.111.104
description:
2025-02-05 07:57:28 dovecot_plain authenticator failed for 107-190-111-104.cpe.teksavvy.com [107.190.111.104]:40356: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
description:
2025-02-05 07:57:40 dovecot_plain authenticator failed for ([196.28.226.124]) [196.28.226.124]:35764: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.237.160
description:
Feb  5 07:58:02 ait sshd[412517]: pam_imunify(sshd:auth): [IM360_RBL] The IP 143.110.237.160 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 143.110.237.160
description:
Feb  5 07:58:02 ait sshd[412517]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.110.237.160  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.55.177.39
description:
Feb  5 07:58:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.55.177.39 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.89.246.95
description:
[2025-02-05 07:57:48 +0100] info [webmaild] 190.89.246.95 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.82
description:
Feb  5 07:57:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.82 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.177.40.147
description:
Feb  5 07:58:26 ait sshd[412728]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.177.40.147  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.163
description:
Feb  5 07:58:30 ait sshd[412732]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.11.160.60
description:
2025-02-05 07:58:45 dovecot_plain authenticator failed for ([121.11.160.60]) [121.11.160.60]:36757: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
description:
2025-02-05 07:58:50 dovecot_plain authenticator failed for (solouncy) [41.248.243.181]:42066: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 07:58:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.124.127.56
description:
Feb  5 07:58:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.124.127.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.124.127.56
description:
2025-02-05 07:58:29 dovecot_plain authenticator failed for ([98.124.127.56]) [98.124.127.56]:45102: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.163
description:
Feb  5 07:58:30 ait sshd[412732]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
description:
Feb  5 07:58:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
description:
2025-02-05 07:58:51 dovecot_login authenticator failed for ([61.153.208.38]) [61.153.208.38]:19893: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.148.130.25
description:
Feb  5 07:59:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.148.130.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.19.108
description:
2025-02-05 07:59:10 dovecot_plain authenticator failed for (forevally) [149.0.19.108]:60086: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.11.160.60
description:
Feb  5 07:58:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.11.160.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.248.243.181
description:
Feb  5 07:58:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.248.243.181 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.129.186.23
description:
[2025-02-05 07:59:03 +0100] info [webmaild] 177.129.186.23 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.148.130.25
description:
2025-02-05 07:59:04 dovecot_login authenticator failed for ([197.148.130.25]) [197.148.130.25]:46680: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.74
description:
Feb  5 07:58:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
description:
2025-02-05 07:58:31 dovecot_login authenticator failed for (201-28-33-49.customer.tdatabrasil.net.br) [186.239.41.74]:54320: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.19.108
description:
Feb  5 07:59:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.19.108 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.166.187.115
description:
[2025-02-05 07:59:41 +0100] info [webmaild] 103.166.187.115 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.135.96.213
description:
Feb  5 08:00:17 ait sshd[413583]: pam_imunify(sshd:auth): [IM360_RBL] The IP 137.135.96.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.96.43.215
description:
Feb  5 07:59:38 ait sshd[413170]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.96.43.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.157.107.67
description:
Feb  5 07:59:56 ait sshd[413234]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.157.107.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.157.107.67
description:
Feb  5 07:59:56 ait sshd[413234]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.157.107.67


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 93.116.195.137
description:
[2025-02-05 07:59:57 +0100] info [webmaild] 93.116.195.137 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 137.135.96.213
description:
Feb  5 08:00:17 ait sshd[413583]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.135.96.213


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.96.43.215
description:
Feb  5 07:59:38 ait sshd[413170]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.43.215


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.73.130.43
description:
Feb  5 08:00:28 ait sshd[413695]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.73.130.43 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.177.40.147
description:
Feb  5 08:00:51 ait sshd[413831]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.177.40.147  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.216
description:
Feb  5 08:00:28 ait sshd[413697]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.216  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.131.163.41
description:
Feb  5 08:01:09 ait sshd[414042]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.163.41


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.106.172.226
description:
Feb  5 08:01:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.106.172.226 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.73.130.43
description:
Feb  5 08:00:28 ait sshd[413695]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.73.130.43


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.238.132.38
description:
[2025-02-05 08:00:31 +0100] info [webmaild] 160.238.132.38 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.15.21.169
description:
Feb  5 08:00:42 ait sshd[413782]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.21.169  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.62.153.51
description:
Feb  5 08:01:07 ait sshd[414035]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.62.153.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.62.153.51
description:
Feb  5 08:01:07 ait sshd[414035]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.62.153.51  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.223
description:
Feb  5 08:00:24 ait sshd[413668]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.106.172.226
description:
2025-02-05 08:01:12 dovecot_plain authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:55200: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.148.213.242
description:
Feb  5 08:00:41 ait sshd[413744]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.148.213.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.15.21.169
description:
Feb  5 08:00:42 ait sshd[413782]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.15.21.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.131.163.41
description:
Feb  5 08:01:09 ait sshd[414042]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.131.163.41 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.223
description:
Feb  5 08:00:24 ait sshd[413668]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.223  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.216
description:
Feb  5 08:00:28 ait sshd[413697]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.216 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.148.213.242
description:
Feb  5 08:00:41 ait sshd[413744]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.148.213.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.159.14.187
description:
2025-02-05 08:01:23 dovecot_plain authenticator failed for (200-168-190-81.jandaia.com) [200.159.14.187]:59455: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.59.125
description:
Feb  5 08:01:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.59.125 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.12.90.118
description:
Feb  5 08:01:49 ait sshd[414161]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.90.118


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.159.14.187
description:
Feb  5 08:01:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.159.14.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.59.125
description:
2025-02-05 08:01:34 dovecot_plain authenticator failed for ([103.171.59.125]) [103.171.59.125]:42198: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.90.118
description:
Feb  5 08:01:49 ait sshd[414161]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.12.90.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.135.96.213
description:
Feb  5 08:01:55 ait sshd[414192]: pam_imunify(sshd:auth): [IM360_RBL] The IP 137.135.96.213 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 137.135.96.213
description:
Feb  5 08:01:55 ait sshd[414192]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.135.96.213


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.224.62.206
description:
Feb  5 08:01:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.224.62.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.193.104.203
description:
[2025-02-05 08:01:46 +0100] info [webmaild] 191.193.104.203 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
description:
2025-02-05 08:01:44 dovecot_plain authenticator failed for ([41.224.62.206]) [41.224.62.206]:54053: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.216.81.126
description:
Feb  5 08:02:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.216.81.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
description:
2025-02-05 08:02:34 dovecot_plain authenticator failed for ([196.216.81.126]) [196.216.81.126]:35196: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.194.6.172
description:
[2025-02-05 08:02:23 +0100] info [webmaild] 186.194.6.172 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 143.110.237.160
description:
Feb  5 08:02:25 ait sshd[414420]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.110.237.160


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.237.160
description:
Feb  5 08:02:25 ait sshd[414420]: pam_imunify(sshd:auth): [IM360_RBL] The IP 143.110.237.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.80.2
description:
Feb  5 08:02:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.80.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.80.2
description:
2025-02-05 08:02:49 dovecot_plain authenticator failed for ([1.28.80.2]) [1.28.80.2]:39842: 535 Incorrect authentication data (set_id=ads20a00071y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.167.48.130
description:
2025-02-05 08:02:24 dovecot_plain authenticator failed for (trablerood) [5.167.48.130]:57077: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 80.94.95.157
domain: phd.ait.edu.gh
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/ait02/public_html/phd.ait.edu.gh/wp-admin/images/index.php


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 80.94.95.157
domain: phd.ait.edu.gh
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:08-03.80.94.95.157||RSV:6.65||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.49.49.136
description:
[2025-02-05 08:03:09 +0100] info [webmaild] 186.49.49.136 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.167.48.130
description:
Feb  5 08:02:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.167.48.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.34.3.195
description:
[2025-02-05 08:02:38 +0100] info [webmaild] 190.34.3.195 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.69.157.215
description:
2025-02-05 08:03:58 dovecot_login authenticator failed for ([151.69.157.215]) [151.69.157.215]:58153: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.62.153.51
description:
Feb  5 08:03:59 ait sshd[415008]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.62.153.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.113.3.87
description:
Feb  5 08:04:16 ait sshd[415173]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.113.3.87 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.116.0
description:
Feb  5 08:03:52 ait sshd[414975]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.116.0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 08:03:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.113.3.87
description:
Feb  5 08:04:16 ait sshd[415173]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.113.3.87


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.148.213.242
description:
Feb  5 08:03:50 ait sshd[414977]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.148.213.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-02-05 08:03:53 dovecot_plain authenticator failed for ([203.177.65.26]) [58.69.17.18]:37674: 535 Incorrect authentication data (set_id=dzidonu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.69.157.215
description:
Feb  5 08:03:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.69.157.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 143.110.237.160
description:
Feb  5 08:03:38 ait sshd[414895]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.110.237.160


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Feb  5 08:03:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.148.213.242
description:
Feb  5 08:03:50 ait sshd[414977]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.148.213.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.221.59
description:
Feb  5 08:03:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.221.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.116.0
description:
Feb  5 08:03:52 ait sshd[414975]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.116.0 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.95.195
description:
2025-02-05 08:03:51 dovecot_login authenticator failed for ([47.206.95.195]) [47.206.95.195]:35717: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.62.153.51
description:
Feb  5 08:03:59 ait sshd[415008]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.62.153.51


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.237.160
description:
Feb  5 08:03:38 ait sshd[414895]: pam_imunify(sshd:auth): [IM360_RBL] The IP 143.110.237.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.221.59
description:
2025-02-05 08:03:42 dovecot_plain authenticator failed for (abts-north-static-059.221.160.122.airtelbroadband.in) [122.160.221.59]:34544: 535 Incorrect authentication data (set_id=dzidonu@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.206.95.195
description:
Feb  5 08:03:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.206.95.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.43.139.142
description:
Feb  5 08:04:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.43.139.142 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 202.29.30.124
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-05.202.29.30.124


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.156.230.127
description:
[2025-02-05 08:05:13 +0100] info [webmaild] 38.156.230.127 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.168.169.191
description:
[2025-02-05 08:05:20 +0100] info [webmaild] 105.168.169.191 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.229.118.208
description:
Feb  5 08:04:56 ait sshd[415279]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.229.118.208 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.229.118.208
description:
Feb  5 08:04:56 ait sshd[415279]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.229.118.208


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.145.0.60
description:
[2025-02-05 08:04:36 +0100] info [webmaild] 177.145.0.60 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.186.241.102
description:
Feb  5 08:04:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.186.241.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.241.102
description:
2025-02-05 08:04:39 dovecot_plain authenticator failed for ([112.186.241.102]) [112.186.241.102]:51760: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.43.139.142
description:
2025-02-05 08:04:56 dovecot_plain authenticator failed for ([211.43.139.142]) [211.43.139.142]:60315: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.62.153.51
description:
Feb  5 08:05:25 ait sshd[415773]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.62.153.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Feb  5 08:05:28 ait sshd[415814]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.118.9.59
description:
Feb  5 08:05:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.118.9.59 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.61.114.188
description:
[2025-02-05 08:06:00 +0100] info [webmaild] 187.61.114.188 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.103
description:
Feb  5 08:06:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.148.213.242
description:
Feb  5 08:05:21 ait sshd[415631]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.148.213.242 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.148.213.242
description:
Feb  5 08:05:23 ait sshd[415631]: Failed password for invalid user ajarami from 103.148.213.242 port 40350 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Feb  5 08:05:28 ait sshd[415814]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.254.23.40
description:
Feb  5 08:06:16 ait sshd[416133]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.254.23.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
description:
Feb  5 08:06:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.148.213.242
description:
Feb  5 08:05:21 ait sshd[415631]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.148.213.242


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.62.153.51
description:
Feb  5 08:05:25 ait sshd[415773]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.62.153.51


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.118.9.59
description:
2025-02-05 08:05:46 dovecot_plain authenticator failed for ([123.118.9.75]) [123.118.9.59]:60415: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.131
description:
2025-02-05 08:06:05 dovecot_plain authenticator failed for ([1.235.192.131]) [1.235.192.131]:54589: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.192.131
description:
Feb  5 08:06:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.192.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.103
description:
2025-02-05 08:06:05 dovecot_plain authenticator failed for 111-70-49-103.emome-ip.hinet.net [111.70.49.103]:54446: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.254.23.40
description:
Feb  5 08:06:16 ait sshd[416133]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.254.23.40


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.231.159
description:
Feb  5 08:06:22 ait sshd[416167]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.205.231.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.131.163.41
description:
Feb  5 08:07:00 ait sshd[416276]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.131.163.41 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.131.163.41
description:
Feb  5 08:07:00 ait sshd[416276]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.163.41


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
description:
2025-02-05 08:06:21 dovecot_plain authenticator failed for 51.174.157.77.rev.sfr.net [77.157.174.51]:45669: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.183.103.117
description:
Feb  5 08:06:37 ait sshd[416204]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.183.103.117 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.231.159
description:
Feb  5 08:06:22 ait sshd[416167]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.231.159


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.183.103.117
description:
Feb  5 08:06:37 ait sshd[416204]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.103.117


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 08:07:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.46
description:
47.128.119.46 - - [05/Feb/2025:08:07:21 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16398417 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning?page_id=prednisolone-to-buy-uk" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.46


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Feb  5 08:07:25 ait sshd[416449]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 149.19.161.227
description:
[2025-02-05 08:07:31 +0100] info [webmaild] 149.19.161.227 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.228.122.55
description:
[2025-02-05 08:08:09 +0100] info [webmaild] 91.228.122.55 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.90.195.68
description:
2025-02-05 08:08:38 dovecot_login authenticator failed for ([197.90.195.68]) [197.90.195.68]:36698: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.52.216.16
description:
[2025-02-05 08:08:55 +0100] info [webmaild] 38.52.216.16 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
description:
Feb  5 08:09:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.35.242.51
description:
2025-02-05 08:09:14 dovecot_plain authenticator failed for host-79-35-242-51.retail.telecomitalia.it [79.35.242.51]:46104: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.35.242.51
description:
Feb  5 08:09:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.35.242.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
description:
2025-02-05 08:08:40 dovecot_login authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:56368: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.184.154.52
description:
[2025-02-05 08:08:22 +0100] info [webmaild] 177.184.154.52 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.251.143.14
description:
Feb  5 08:08:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.251.143.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
description:
2025-02-05 08:08:26 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:43312: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.103
description:
2025-02-05 08:08:45 dovecot_login authenticator failed for 111-70-49-103.emome-ip.hinet.net [111.70.49.103]:34481: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.192
description:
Feb  5 08:08:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
description:
2025-02-05 08:09:03 dovecot_login authenticator failed for ([175.182.64.203]) [175.182.64.203]:39058: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.90.195.68
description:
Feb  5 08:08:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.90.195.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.221.130.246
description:
Feb  5 08:08:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.221.130.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.221.130.246
description:
2025-02-05 08:08:47 dovecot_plain authenticator failed for ([211.221.130.246]) [211.221.130.246]:34430: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.142.105.18
description:
2025-02-05 08:08:56 dovecot_plain authenticator failed for ([180.142.105.18]) [180.142.105.18]:58997: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
description:
2025-02-05 08:09:11 dovecot_plain authenticator failed for ([106.245.246.26]) [106.245.246.26]:58549: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.198.18.3
description:
Feb  5 08:08:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.198.18.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
description:
Feb  5 08:08:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.221
description:
Feb  5 08:08:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.245.246.26
description:
Feb  5 08:09:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.245.246.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.18.3
description:
2025-02-05 08:08:28 dovecot_login authenticator failed for ([175.198.18.3]) [175.198.18.3]:57072: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.103
description:
Feb  5 08:08:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.221
description:
2025-02-05 08:08:50 dovecot_login authenticator failed for (m121-202-152-221.smartone.com) [121.202.152.221]:57527: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.192
description:
2025-02-05 08:08:54 dovecot_login authenticator failed for ([178.178.194.192]) [178.178.194.192]:48888: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.142.105.18
description:
Feb  5 08:08:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.142.105.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
description:
2025-02-05 08:09:52 dovecot_plain authenticator failed for (entworting) [185.65.238.250]:36156: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.181.210.18
description:
Feb  5 08:10:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.181.210.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.80.209
description:
Feb  5 08:09:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.80.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.80.209
description:
2025-02-05 08:09:24 dovecot_plain authenticator failed for ([2.55.80.209]) [2.55.80.209]:59328: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.167.140.130
description:
2025-02-05 08:10:02 dovecot_login authenticator failed for (109-167-140-130.westcall.net) [109.167.140.130]:56326: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
description:
2025-02-05 08:10:04 dovecot_login authenticator failed for ([218.147.6.84]) [218.147.6.84]:33660: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.215.21.164
description:
2025-02-05 08:10:16 dovecot_plain authenticator failed for (dynamicip-176-215-21-164.pppoe.ekat.ertelecom.ru) [176.215.21.164]:55252: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
description:
2025-02-05 08:09:50 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (micare) [176.37.212.85]:34525: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.65.238.250
description:
Feb  5 08:09:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.65.238.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.167.140.130
description:
Feb  5 08:10:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.167.140.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.181.210.18
description:
2025-02-05 08:10:15 dovecot_login authenticator failed for ([216.181.210.18]) [216.181.210.18]:44134: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.37.212.85
description:
Feb  5 08:09:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.37.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
description:
Feb  5 08:10:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.215.21.164
description:
Feb  5 08:10:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.215.21.164 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.167.58.135
description:
[2025-02-05 08:10:18 +0100] info [webmaild] 45.167.58.135 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.246.49.99
description:
2025-02-05 08:10:56 dovecot_plain authenticator failed for (abts-mp-static-185.120.168.122.airtelbroadband.in) [115.246.49.99]:58866: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.46.7
description:
Feb  5 08:10:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.46.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.10.121.246
description:
Feb  5 08:10:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.10.121.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.3.72
description:
Feb  5 08:10:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.3.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.246.49.99
description:
Feb  5 08:10:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.246.49.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.6.43.236
description:
Feb  5 08:11:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.6.43.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.170.255.146
description:
2025-02-05 08:11:08 dovecot_plain authenticator failed for ([222.170.255.146]) [222.170.255.146]:50834: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.43.236
description:
2025-02-05 08:11:10 dovecot_login authenticator failed for ([183.6.43.236]) [183.6.43.236]:42669: 535 Incorrect authentication data (set_id=test@lemsas.net)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.46.120
description:
47.128.46.120 - - [05/Feb/2025:08:10:36 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6821217 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/6c4eb4" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.46.120


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.191.163.102
description:
Feb  5 08:10:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.191.163.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.191.163.102
description:
2025-02-05 08:10:49 dovecot_plain authenticator failed for ([61.191.163.102]) [61.191.163.102]:46284: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.148.95.217
description:
Feb  5 08:11:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.148.95.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.7
description:
2025-02-05 08:10:32 dovecot_plain authenticator failed for 007.46.246.220.static.netvigator.com [220.246.46.7]:52655: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.226.126.88
description:
[2025-02-05 08:10:56 +0100] info [webmaild] 45.226.126.88 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.170.255.146
description:
Feb  5 08:11:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.170.255.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.20.131
description:
Feb  5 08:11:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.20.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.20.131
description:
2025-02-05 08:11:14 dovecot_plain authenticator failed for ([123.212.20.131]) [123.212.20.131]:37796: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.97.114.149
description:
Feb  5 08:10:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.97.114.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.3.72
description:
2025-02-05 08:10:55 dovecot_login authenticator failed for ([101.13.3.72]) [101.13.3.72]:42922: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.198.146.65
description:
Feb  5 08:11:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.198.146.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.10.121.246
description:
2025-02-05 08:10:45 dovecot_plain authenticator failed for syn-098-010-121-246.res.spectrum.com (098-010-121-246.res.spectrum.com) [98.10.121.246]:54831: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.97.114.149
description:
2025-02-05 08:10:51 dovecot_plain authenticator failed for c-73-97-114-149.hsd1.wa.comcast.net [73.97.114.149]:36321: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.100.105.194
description:
Feb  5 08:11:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.100.105.194 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.116.0
description:
Feb  5 08:11:56 ait sshd[418338]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.116.0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.103.125.13
description:
[2025-02-05 08:11:56 +0100] info [webmaild] 103.103.125.13 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
description:
2025-02-05 08:11:22 dovecot_login authenticator failed for ([38.148.95.217]) [38.148.95.217]:55888: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.226.88
description:
2025-02-05 08:11:43 dovecot_login authenticator failed for (187.161.226.88-clientes-izzi.mx) [187.161.226.88]:52890: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.243.37
description:
Feb  5 08:11:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.243.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 08:11:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.198.146.65
description:
2025-02-05 08:11:22 dovecot_plain authenticator failed for 6dc69241.rev.dansknet.dk [109.198.146.65]:36319: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.209.18
description:
2025-02-05 08:11:33 dovecot_login authenticator failed for bb121-7-209-18.singnet.com.sg [121.7.209.18]:35618: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.2.161.66
description:
2025-02-05 08:11:46 dovecot_login authenticator failed for ([177.2.161.89]) [177.2.161.66]:54053: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.239.1.134
description:
Feb  5 08:11:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.239.1.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
description:
Feb  5 08:11:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
description:
2025-02-05 08:11:25 dovecot_login authenticator failed for ([61.72.59.106]) [61.72.59.106]:34034: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.134.243.37
description:
2025-02-05 08:11:56 dovecot_login authenticator failed for ([31.134.243.37]) [31.134.243.37]:42238: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.239.231.61
description:
2025-02-05 08:11:24 dovecot_login authenticator failed for ([222.239.231.61]) [222.239.231.61]:54820: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.231.61
description:
Feb  5 08:11:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.239.231.61 has been locked due to Imunify RBL


