# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.71.199.46
description:
Feb  5 23:15:51 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.71.199.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.71.199.46
description:
2025-02-05 23:15:53 dovecot_login authenticator failed for ([120.71.199.46]) [120.71.199.46]:53246: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.190.39.142
description:
2025-02-05 23:15:58 dovecot_plain authenticator failed for ([196.201.20.98]) [41.190.39.142]:38926: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.210.98
description:
Feb  5 23:15:15 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.1.154
description:
2025-02-05 23:15:37 dovecot_login authenticator failed for 110-4-1-154.static.pccw-hkt.com [110.4.1.154]:58745: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.118.91.72
description:
[2025-02-05 23:15:43 +0100] info [webmaild] 138.118.91.72 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.210.98
description:
2025-02-05 23:15:17 dovecot_login authenticator failed for ([121.168.210.98]) [121.168.210.98]:42636: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-02-05 23:15:44 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:54488: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.85.8.169
description:
[2025-02-05 23:15:42 +0100] info [webmaild] 191.85.8.169 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.243.2
description:
Feb  5 23:15:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.243.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.243.2
description:
2025-02-05 23:15:55 dovecot_login authenticator failed for ([183.220.243.2]) [183.220.243.2]:37912: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.104.144.93
description:
2025-02-05 23:15:03 dovecot_login authenticator failed for ([86.104.144.93]) [86.104.144.93]:46016: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.134.57.238
description:
[2025-02-05 23:15:09 +0100] info [webmaild] 103.134.57.238 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.83.60.248
description:
[2025-02-05 23:15:13 +0100] info [webmaild] 170.83.60.248 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.1.154
description:
Feb  5 23:15:35 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.1.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Feb  5 23:15:42 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.190.39.142
description:
Feb  5 23:15:56 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.190.39.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 86.104.144.93
description:
Feb  5 23:15:01 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 86.104.144.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.138
description:
Feb  5 23:16:58 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.138
description:
2025-02-05 23:17:00 dovecot_login authenticator failed for (m121-202-155-138.smartone.com) [121.202.155.138]:42188: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.222.166.212
description:
Feb  5 23:16:10 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.222.166.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
description:
2025-02-05 23:16:12 dovecot_plain authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:41497: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.106.194.74
description:
Feb  5 23:17:02 ait sshd[848145]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.106.194.74


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.115.172.96
description:
[2025-02-05 23:17:44 +0100] info [webmaild] 181.115.172.96 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.194.74
description:
Feb  5 23:17:02 ait sshd[848145]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.106.194.74 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.143.81
description:
[2025-02-05 23:17:37 +0100] info [webmaild] 157.100.143.81 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.154.90.47
description:
Feb  5 23:17:14 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.154.90.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.47
description:
2025-02-05 23:17:16 dovecot_login authenticator failed for ([121.154.90.47]) [121.154.90.47]:34274: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77210801
name: IM360 WAF: Request Indicates a Security Scanner Scanned the Site
abuser: 154.161.162.149
domain: lemsas.net
description:
IM360 WAF: Request Indicates a Security Scanner Scanned the Site||MV:sqlmap/1.8.9#stable (https://sqlmap.org)||RSV:6.65||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.106.194.74
description:
Feb  5 23:18:32 ait sshd[848763]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.106.194.74


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.241.179.229
description:
Feb  5 23:18:53 ait sshd[848890]: pam_imunify(sshd:auth): [IM360_RBL] The IP 81.241.179.229 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 81.241.179.229
description:
Feb  5 23:18:53 ait sshd[848890]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.241.179.229


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.234.194.255
description:
[2025-02-05 23:18:07 +0100] info [webmaild] 177.234.194.255 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.165.117.102
description:
[2025-02-05 23:18:17 +0100] info [webmaild] 200.165.117.102 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.235.246
description:
2025-02-05 23:18:25 dovecot_plain authenticator failed for h77-53-235-246.cust.bredband2.com [77.53.235.246]:42868: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.106.194.74
description:
Feb  5 23:18:34 ait sshd[848763]: Failed password for invalid user yudi from 103.106.194.74 port 38572 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.29.109.174
description:
Feb  5 23:18:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.29.109.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.219.177.95
description:
Feb  5 23:18:49 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.219.177.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.235.246
description:
Feb  5 23:18:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.235.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.29.109.174
description:
2025-02-05 23:18:38 dovecot_plain authenticator failed for ([112.29.109.174]) [112.29.109.174]:33575: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.194.74
description:
Feb  5 23:18:32 ait sshd[848763]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.106.194.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.219.177.95
description:
2025-02-05 23:18:51 dovecot_plain authenticator failed for ([113.219.177.95]) [113.219.177.95]:51344: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 154.161.162.149
description:
154.161.162.149 - - [05/Feb/2025:23:18:54 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11576315 HTTP/2.0" 302 0 lemsas.net "https://lemsas.net/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:154.161.162.149


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.96.151.110
description:
Feb  5 23:19:01 ait sshd[848887]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.96.151.110


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Feb  5 23:19:47 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.96.151.110
description:
Feb  5 23:19:03 ait sshd[848887]: Failed password for invalid user postgres from 122.96.151.110 port 37072 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.20.229
description:
2025-02-05 23:19:28 dovecot_plain authenticator failed for ([92.202.82.102]) [154.47.20.229]:19732: 535 Incorrect authentication data (set_id=rnunator)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 147.50.121.104
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:RubyO||WPU:RubyO||RSV:6.65||T:APACHE||MV:23-19.147.50.121.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.0.134.10
description:
Feb  5 23:19:01 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.0.134.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.96.151.110
description:
Feb  5 23:19:01 ait sshd[848887]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.96.151.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 23:19:06 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.47.20.229
description:
Feb  5 23:19:26 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.47.20.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-02-05 23:19:49 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com (scuressly) [83.233.242.245]:44560: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.0.134.10
description:
2025-02-05 23:19:03 dovecot_plain authenticator failed for ([153.0.134.10]) [153.0.134.10]:34497: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.98.28.43
description:
Feb  5 23:19:11 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.98.28.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
description:
2025-02-05 23:19:13 dovecot_plain authenticator failed for ([14.98.28.43]) [14.98.28.43]:45310: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.255.160.74
description:
[2025-02-05 23:20:48 +0100] info [webmaild] 131.255.160.74 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.200.62.22
description:
[2025-02-05 23:20:58 +0100] info [webmaild] 177.200.62.22 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Feb  5 23:20:03 ait sshd[849176]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.146.179.105
description:
[2025-02-05 23:20:17 +0100] info [webmaild] 197.146.179.105 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.0.83.52
description:
[2025-02-05 23:20:23 +0100] info [webmaild] 138.0.83.52 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.90.207.82
description:
Feb  5 23:21:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.90.207.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.90.207.82
description:
2025-02-05 23:21:25 dovecot_plain authenticator failed for ([182.90.207.82]) [182.90.207.82]:46788: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.45.114.161
description:
2025-02-05 23:21:39 dovecot_plain authenticator failed for 121-45-114-161.tpgi.com.au [121.45.114.161]:39780: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.45.114.161
description:
Feb  5 23:21:37 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.45.114.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.139.88.148
description:
Feb  5 23:22:58 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.139.88.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.88.148
description:
2025-02-05 23:23:00 dovecot_plain authenticator failed for 148.red-2-139-88.dynamicip.rima-tde.net (prewpezat) [2.139.88.148]:36320: 535 Incorrect authentication data (set_id=eng19b00195y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.117.73
description:
Feb  5 23:22:50 ait sshd[850519]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.117.73 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.117.73
description:
Feb  5 23:22:50 ait sshd[850519]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.117.73  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.185.79.108
description:
[2025-02-05 23:22:50 +0100] info [webmaild] 177.185.79.108 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.67.167.81
description:
Feb  5 23:22:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.67.167.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.117.73
description:
Feb  5 23:23:17 ait sshd[850597]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.117.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.110.77
description:
Feb  5 23:23:41 ait sshd[850879]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.110.77 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.117.73
description:
Feb  5 23:23:17 ait sshd[850597]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.117.73  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.220.154.69
description:
[2025-02-05 23:23:19 +0100] info [webmaild] 178.220.154.69 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 89.211.205.183
description:
[2025-02-05 23:23:39 +0100] info [webmaild] 89.211.205.183 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.110.77
description:
Feb  5 23:23:41 ait sshd[850879]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.110.77


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.5.106.231
description:
[2025-02-05 23:23:05 +0100] info [webmaild] 186.5.106.231 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Feb  5 23:24:28 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.179.85.98
description:
Feb  5 23:24:42 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.179.85.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.13.25.186
description:
Feb  5 23:24:47 ait sshd[851165]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.13.25.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Feb  5 23:24:17 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
description:
2025-02-05 23:24:19 dovecot_plain authenticator failed for (genect) [102.53.15.54]:56501: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
description:
2025-02-05 23:24:30 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (duntrumway) [94.45.76.149]:34503: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.179.85.98
description:
2025-02-05 23:24:44 dovecot_plain authenticator failed for ([202.179.85.98]) [202.179.85.98]:37353: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.13.25.186
description:
Feb  5 23:24:47 ait sshd[851165]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.13.25.186


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.55.177.39
description:
2025-02-05 23:25:46 dovecot_plain authenticator failed for ([218.55.177.39]) [218.55.177.39]:54040: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.198.173.137
description:
Feb  5 23:25:54 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.198.173.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.137
description:
2025-02-05 23:25:58 dovecot_plain authenticator failed for (gapinal) [65.20.251.137]:47537: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.153.85.132
description:
Feb  5 23:25:18 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.153.85.132 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.12.253.3
description:
[2025-02-05 23:25:25 +0100] info [webmaild] 200.12.253.3 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.137
description:
Feb  5 23:25:56 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.157.246.26
description:
2025-02-05 23:25:02 dovecot_plain authenticator failed for ([117.157.246.26]) [117.157.246.26]:55994: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.55.177.39
description:
Feb  5 23:25:44 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.55.177.39 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.89.29.241
description:
[2025-02-05 23:25:56 +0100] info [webmaild] 190.89.29.241 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.153.85.132
description:
2025-02-05 23:25:20 dovecot_plain authenticator failed for ([46.153.85.132]) [46.153.85.132]:40112: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.183.209
description:
Feb  5 23:25:07 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.183.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.183.209
description:
2025-02-05 23:25:09 dovecot_plain authenticator failed for (ocycles) [65.20.183.209]:42486: 535 Incorrect authentication data (set_id=eng17b00218y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.152.143.29
description:
[2025-02-05 23:25:46 +0100] info [webmaild] 179.152.143.29 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
description:
2025-02-05 23:25:56 dovecot_login authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:37171: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.157.246.26
description:
Feb  5 23:25:00 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.157.246.26 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.142.29.91
description:
[2025-02-05 23:26:20 +0100] info [webmaild] 102.142.29.91 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.91
description:
Feb  5 23:26:00 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.225.207.166
description:
Feb  5 23:26:34 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.225.207.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.87.230
description:
2025-02-05 23:26:49 dovecot_plain authenticator failed for ([1.31.87.230]) [1.31.87.230]:44514: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.104.137.177
description:
Feb  5 23:26:18 ait sshd[851959]: pam_imunify(sshd:auth): [IM360_RBL] The IP 172.104.137.177 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 172.104.137.177
description:
Feb  5 23:26:18 ait sshd[851959]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.104.137.177


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
description:
2025-02-05 23:26:25 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:41992: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.76.250.194
description:
Feb  5 23:26:45 ait sshd[852179]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.250.194


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.225.207.166
description:
2025-02-05 23:26:36 dovecot_plain authenticator failed for ([111.225.207.166]) [111.225.207.166]:54737: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.31.87.230
description:
Feb  5 23:26:47 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.31.87.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.91
description:
2025-02-05 23:26:02 dovecot_plain authenticator failed for (noanpuning) [65.20.155.91]:41624: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.119.144.86
description:
Feb  5 23:26:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.119.144.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.253.125.205
description:
2025-02-05 23:27:58 dovecot_plain authenticator failed for ([183.253.125.205]) [183.253.125.205]:40908: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.84.31.106
description:
Feb  5 23:27:40 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.84.31.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.123.72.205
description:
2025-02-05 23:27:55 dovecot_plain authenticator failed for ([187.123.72.205]) [187.123.72.205]:34076: 535 Incorrect authentication data (set_id=test@ait-ext.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.54
description:
2025-02-05 23:27:04 dovecot_plain authenticator failed for (m121-202-154-54.smartone.com) [121.202.154.54]:24117: 535 Incorrect authentication data (set_id=test@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.199.57.220
description:
Feb  5 23:27:14 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.199.57.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.199.57.220
description:
2025-02-05 23:27:16 dovecot_plain authenticator failed for ([192.199.57.220]) [192.199.57.220]:36211: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.76
description:
47.128.121.76 - - [05/Feb/2025:23:27:21 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21607344 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=79%2C183%2C120&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.76


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.89.76
description:
2025-02-05 23:27:42 dovecot_plain authenticator failed for (76.89.132.112.adsl-pool.ah.cnuninet.net) [112.132.89.76]:60728: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.61.92.114
description:
[2025-02-05 23:27:51 +0100] info [webmaild] 187.61.92.114 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.253.125.205
description:
Feb  5 23:27:56 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.253.125.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.54
description:
Feb  5 23:27:02 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.84.31.106
description:
2025-02-05 23:27:42 dovecot_plain authenticator failed for ([223.84.31.106]) [223.84.31.106]:1156: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.123.72.205
description:
Feb  5 23:27:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.123.72.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.89.76
description:
Feb  5 23:27:40 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.89.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.76
description:
Feb  5 23:28:10 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.63.175
description:
Feb  5 23:28:19 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.63.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.249.93
description:
Feb  5 23:28:05 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.249.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.249.93
description:
2025-02-05 23:28:07 dovecot_login authenticator failed for ([96.79.249.93]) [96.79.249.93]:53621: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.196.67
description:
Feb  5 23:28:12 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.126.196.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.76
description:
2025-02-05 23:28:12 dovecot_plain authenticator failed for (95.0.252.76.static.ttnet.com.tr) [95.0.252.76]:45992: 535 Incorrect authentication data (set_id=test@ait-ext.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.10.96.172
description:
[2025-02-05 23:28:54 +0100] info [webmaild] 197.10.96.172 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.98.125
description:
Feb  5 23:28:10 ait sshd[852798]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.98.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.254
description:
2025-02-05 23:28:08 dovecot_plain authenticator failed for (nsg-corporate-254.230.187.122.airtel.in) [122.187.230.254]:60417: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.250.93.159
description:
2025-02-05 23:28:32 dovecot_plain authenticator failed for ([114.250.93.159]) [114.250.93.159]:31888: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.241.102
description:
2025-02-05 23:28:00 dovecot_plain authenticator failed for ([112.186.241.102]) [112.186.241.102]:35637: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.254
description:
Feb  5 23:28:06 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.250.93.159
description:
Feb  5 23:28:30 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.250.93.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.235.37.254
description:
[2025-02-05 23:28:16 +0100] info [webmaild] 186.235.37.254 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.63.175
description:
2025-02-05 23:28:21 dovecot_plain authenticator failed for ([182.135.63.175]) [182.135.63.175]:38489: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.196.67
description:
2025-02-05 23:28:14 dovecot_login authenticator failed for ([91.126.196.67]) [91.126.196.67]:52226: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.114.33.178
description:
[2025-02-05 23:28:21 +0100] info [webmaild] 190.114.33.178 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.147.94
description:
Feb  5 23:29:26 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.147.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
description:
2025-02-05 23:29:28 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:36994: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.98
description:
Feb  5 23:29:15 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.98
description:
2025-02-05 23:29:17 dovecot_login authenticator failed for ([5.32.107.98]) [5.32.107.98]:35701: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-29.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 23:29:57 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
description:
2025-02-05 23:30:31 dovecot_plain authenticator failed for ([20.46.45.121]) [20.46.45.121]:62244: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.139.39.106
description:
Feb  5 23:30:35 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.139.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.124.241.138
description:
Feb  5 23:30:44 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.124.241.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.128.109.245
description:
[2025-02-05 23:30:45 +0100] info [webmaild] 177.128.109.245 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.124.241.138
description:
2025-02-05 23:30:46 dovecot_plain authenticator failed for ([116.124.241.138]) [116.124.241.138]:40586: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.189.56.199
description:
[2025-02-05 23:30:54 +0100] info [webmaild] 45.189.56.199 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.162.249
description:
2025-02-05 23:30:55 dovecot_plain authenticator failed for 1-34-162-249.hinet-ip.hinet.net [1.34.162.249]:45578: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.236.213.190
description:
2025-02-05 23:30:59 dovecot_plain authenticator failed for 179-236-213-190.user.veloxzone.com.br [179.236.213.190]:52636: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.57.255.179
description:
[2025-02-05 23:30:25 +0100] info [webmaild] 167.57.255.179 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.46.45.121
description:
Feb  5 23:30:29 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.46.45.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.39.106
description:
2025-02-05 23:30:37 dovecot_plain authenticator failed for ([219.139.39.106]) [219.139.39.106]:43995: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.34.162.249
description:
Feb  5 23:30:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.34.162.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.236.213.190
description:
Feb  5 23:30:57 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.236.213.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.80.158
description:
2025-02-05 23:31:15 dovecot_plain authenticator failed for ([222.114.80.158]) [222.114.80.158]:51104: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.236.221.212
description:
[2025-02-05 23:31:17 +0100] info [webmaild] 176.236.221.212 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
description:
Feb  5 23:31:39 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
description:
2025-02-05 23:31:41 dovecot_plain authenticator failed for ([111.171.127.190]) [111.171.127.190]:50545: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.72.156
description:
Feb  5 23:31:49 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.72.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.72.156
description:
2025-02-05 23:31:51 dovecot_plain authenticator failed for ([95.165.72.156]) [95.165.72.156]:54302: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.7.203.177
description:
Feb  5 23:31:00 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.7.203.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.7.203.177
description:
2025-02-05 23:31:02 dovecot_plain authenticator failed for ([59.7.203.177]) [59.7.203.177]:33518: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.80.158
description:
Feb  5 23:31:13 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.80.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.164.246.53
description:
Feb  5 23:31:57 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.164.246.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.164.246.53
description:
2025-02-05 23:31:59 dovecot_plain authenticator failed for 53.246.164.109.static.wline.lns.sme.cust.swisscom.ch (zotes) [109.164.246.53]:57504: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.37.159.125
description:
[2025-02-05 23:32:53 +0100] info [webmaild] 95.37.159.125 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.139.107.146
description:
Feb  5 23:32:56 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.139.107.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
description:
2025-02-05 23:32:58 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:60144: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.43.144.70
description:
Feb  5 23:33:03 ait sshd[855087]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.43.144.70


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.61.209
description:
Feb  5 23:33:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.61.209 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 148.101.22.245
description:
[2025-02-05 23:33:24 +0100] info [webmaild] 148.101.22.245 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.233.33.151
description:
[2025-02-05 23:33:55 +0100] info [webmaild] 170.233.33.151 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
description:
2025-02-05 23:33:58 dovecot_plain authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:46201: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.224.22.135
description:
Feb  5 23:33:15 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.224.22.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.6.81.59
description:
Feb  5 23:33:46 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.6.81.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.90.34.90
description:
Feb  5 23:33:22 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.90.34.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.26.153.84
description:
Feb  5 23:33:26 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.26.153.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.43.144.70
description:
Feb  5 23:33:03 ait sshd[855087]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.43.144.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.249.93
description:
Feb  5 23:33:28 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.249.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.242.71.107
description:
Feb  5 23:33:32 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.242.71.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.242.71.107
description:
2025-02-05 23:33:34 dovecot_plain authenticator failed for ([36.32.223.199]) [58.242.71.107]:47778: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.67.133.193
description:
Feb  5 23:33:41 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.67.133.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
description:
Feb  5 23:33:51 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.76.127
description:
2025-02-05 23:33:53 dovecot_plain authenticator failed for ([183.107.76.127]) [183.107.76.127]:49274: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.76.194.159
description:
Feb  5 23:33:56 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.76.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.224.22.135
description:
2025-02-05 23:33:17 dovecot_login authenticator failed for ([50.224.22.135]) [50.224.22.135]:43050: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.234.239.3
description:
[2025-02-05 23:33:23 +0100] info [webmaild] 177.234.239.3 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.84
description:
2025-02-05 23:33:28 dovecot_plain authenticator failed for ([118.26.153.84]) [118.26.153.84]:65158: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.117.105
description:
Feb  5 23:33:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.117.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.172.120.32
description:
Feb  5 23:33:42 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.172.120.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
description:
2025-02-05 23:33:24 dovecot_plain authenticator failed for ([102.90.34.90]) [102.90.34.90]:33248: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.249.93
description:
2025-02-05 23:33:30 dovecot_plain authenticator failed for ([96.79.249.93]) [96.79.249.93]:49059: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.117.105
description:
2025-02-05 23:33:38 dovecot_plain authenticator failed for ([119.206.117.105]) [119.206.117.105]:42804: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.67.133.193
description:
2025-02-05 23:33:43 dovecot_plain authenticator failed for ([222.67.133.193]) [222.67.133.193]:21170: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.172.120.32
description:
2025-02-05 23:33:44 dovecot_plain authenticator failed for ([111.172.120.32]) [111.172.120.32]:51908: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
description:
2025-02-05 23:33:48 dovecot_plain authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:40473: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.61.209
description:
2025-02-05 23:33:55 dovecot_login authenticator failed for ([39.165.61.209]) [39.165.61.209]:54414: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.113.3.87
description:
Feb  5 23:34:40 ait sshd[855667]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.113.3.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.105.113
description:
Feb  5 23:34:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.105.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.51.0.170
description:
Feb  5 23:34:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.51.0.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
description:
Feb  5 23:34:54 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.19.80.138
description:
2025-02-05 23:34:53 dovecot_plain authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:45236: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.77.206
description:
2025-02-05 23:34:54 dovecot_plain authenticator failed for (pc0.zz.ha.cn) [218.28.77.206]:36449: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.67.143.142
description:
2025-02-05 23:34:57 dovecot_plain authenticator failed for (netcomafrica.com) [41.67.143.142]:58368: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
description:
2025-02-05 23:34:59 dovecot_plain authenticator failed for ([222.114.200.160]) [222.114.200.160]:37070: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.44
description:
Feb  5 23:34:51 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.144.187.114
description:
Feb  5 23:34:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.144.187.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.115.19.225
description:
Feb  5 23:34:54 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.115.19.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.45.68
description:
2025-02-05 23:34:55 dovecot_plain authenticator failed for ([218.146.45.68]) [218.146.45.68]:47675: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.160.70
description:
2025-02-05 23:34:58 dovecot_plain authenticator failed for ([183.238.160.70]) [183.238.160.70]:59626: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.97.253.246
description:
Feb  5 23:34:50 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.97.253.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.201.58
description:
Feb  5 23:34:58 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.201.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.168.78
description:
Feb  5 23:34:12 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.168.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-02-05 23:34:52 dovecot_plain authenticator failed for (70.246.50.116.ids.service.static.eastern-tele.com) [58.69.17.18]:52590: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.124.66
description:
2025-02-05 23:34:55 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:33276: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.83.78
description:
Feb  5 23:34:57 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.83.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.0.170
description:
2025-02-05 23:34:55 dovecot_plain authenticator failed for ([179.51.0.170]) [179.51.0.170]:48640: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.144.187.114
description:
2025-02-05 23:34:55 dovecot_plain authenticator failed for ([89.144.187.114]) [89.144.187.114]:49144: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.47.74.210
description:
Feb  5 23:34:51 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.47.74.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
description:
2025-02-05 23:34:52 dovecot_plain authenticator failed for ([200.106.49.149]) [200.106.49.149]:50794: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.232.39.165
description:
2025-02-05 23:34:52 dovecot_plain authenticator failed for ([185.232.39.165]) [185.232.39.165]:46454: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.172.156.150
description:
Feb  5 23:34:52 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.172.156.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
description:
2025-02-05 23:34:53 dovecot_plain authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:38594: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
description:
2025-02-05 23:34:56 dovecot_plain authenticator failed for ([39.165.183.70]) [39.165.183.70]:32992: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.154.80.50
description:
Feb  5 23:34:47 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.154.80.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.17.90.246
description:
2025-02-05 23:34:53 dovecot_plain authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:51870: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.204.158.2
description:
2025-02-05 23:34:53 dovecot_plain authenticator failed for 2.189-204-158.bestelclientes.com.mx [189.204.158.2]:13843: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.105.113
description:
2025-02-05 23:34:55 dovecot_plain authenticator failed for (177-174-105-113.user.vivozap.com.br) [177.174.105.113]:42660: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.170.189.164
description:
2025-02-05 23:34:13 dovecot_login authenticator failed for ([79.170.189.164]) [79.170.189.164]:46347: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.138.200
description:
Feb  5 23:34:52 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.138.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.6.56.226
description:
Feb  5 23:34:55 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.6.56.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.47.74.210
description:
2025-02-05 23:34:53 dovecot_plain authenticator failed for ([103.47.74.210]) [103.47.74.210]:59466: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.160.70
description:
Feb  5 23:34:56 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.160.70 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.20.155
description:
47.128.20.155 - - [05/Feb/2025:23:34:16 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12899194 HTTP/2.0" 302 0 worldwide-university.com "https://worldwide-university.com/questions/profile/arlierealbutogmx-net/?__im-sPPZCxSm=14217472657129624823" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.20.155


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.232.39.165
description:
Feb  5 23:34:50 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.232.39.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.78.40
description:
2025-02-05 23:34:50 dovecot_plain authenticator failed for 40.ip-79-137-78.eu [79.137.78.40]:42124: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.204.158.2
description:
Feb  5 23:34:51 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.204.158.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.45.68
description:
Feb  5 23:34:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.45.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.124.66
description:
Feb  5 23:34:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.124.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.59.157
description:
Feb  5 23:34:47 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.59.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
description:
Feb  5 23:34:49 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.17.90.246
description:
Feb  5 23:34:51 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.17.90.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.248.7
description:
Feb  5 23:34:51 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.28.77.206
description:
Feb  5 23:34:52 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.28.77.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.74.138.200
description:
2025-02-05 23:34:54 dovecot_plain authenticator failed for ([41.74.138.200]) [41.74.138.200]:59378: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.115.19.225
description:
2025-02-05 23:34:56 dovecot_plain authenticator failed for 24.115.19.225.res-cmts.sm3.ptd.net [24.115.19.225]:55448: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.56.226
description:
2025-02-05 23:34:57 dovecot_plain authenticator failed for ([187.6.56.226]) [187.6.56.226]:46065: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.78.40
description:
Feb  5 23:34:48 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.78.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.50
description:
2025-02-05 23:34:49 dovecot_plain authenticator failed for ([213.154.80.21]) [213.154.80.50]:41509: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.102.199.89
description:
Feb  5 23:34:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.102.199.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.92.208.12
description:
Feb  5 23:34:54 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.92.208.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
description:
2025-02-05 23:34:53 dovecot_plain authenticator failed for ([103.147.248.44]) [103.147.248.44]:48702: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.172.156.150
description:
2025-02-05 23:34:54 dovecot_plain authenticator failed for ([110.172.156.150]) [110.172.156.150]:36906: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.132.113
description:
Feb  5 23:34:58 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.132.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.132.113
description:
2025-02-05 23:35:00 dovecot_plain authenticator failed for ([188.226.132.113]) [188.226.132.113]:50724: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.170.189.164
description:
Feb  5 23:34:11 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.170.189.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.67.143.142
description:
Feb  5 23:34:55 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.67.143.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.170.255.146
description:
Feb  5 23:34:56 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.170.255.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.82.66.194
description:
Feb  5 23:34:56 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.82.66.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.170.255.146
description:
2025-02-05 23:34:58 dovecot_plain authenticator failed for ([222.170.255.146]) [222.170.255.146]:47883: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.168.78
description:
2025-02-05 23:34:14 dovecot_plain authenticator failed for (78-168-168-45.weblinknet.com.br) [45.168.168.78]:47398: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Feb  5 23:34:50 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
description:
2025-02-05 23:34:51 dovecot_plain authenticator failed for (88x87x84x104.static-customer.volgograd.ertelecom.ru) [88.87.84.104]:53452: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
description:
2025-02-05 23:34:52 dovecot_plain authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:56007: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.82.66.194
description:
2025-02-05 23:34:58 dovecot_plain authenticator failed for ([120.82.66.194]) [120.82.66.194]:51742: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
description:
Feb  5 23:34:57 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.201.58
description:
2025-02-05 23:35:00 dovecot_plain authenticator failed for ([220.178.201.58]) [220.178.201.58]:37738: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.83.78
description:
2025-02-05 23:34:59 dovecot_plain authenticator failed for ([182.78.83.78]) [182.78.83.78]:47572: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
description:
2025-02-05 23:34:49 dovecot_plain authenticator failed for ([195.222.59.157]) [195.222.59.157]:48470: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.106.49.149
description:
Feb  5 23:34:50 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.106.49.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.19.80.138
description:
Feb  5 23:34:51 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.19.80.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.199.89
description:
2025-02-05 23:34:55 dovecot_plain authenticator failed for ([112.102.199.89]) [112.102.199.89]:49611: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.92.208.12
description:
2025-02-05 23:34:56 dovecot_plain authenticator failed for ([116.92.208.12]) [116.92.208.12]:35104: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.4.42.19
description:
Feb  5 23:34:59 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.4.42.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.11.241.139
description:
2025-02-05 23:35:08 dovecot_plain authenticator failed for ([112.11.241.139]) [112.11.241.139]:54246: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.46.210.254
description:
[2025-02-05 23:35:24 +0100] info [webmaild] 181.46.210.254 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.193.163.2
description:
2025-02-05 23:35:37 dovecot_plain authenticator failed for ([1.193.163.2]) [1.193.163.2]:34208: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
description:
2025-02-05 23:35:14 dovecot_plain authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:55796: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.173.61.81
description:
2025-02-05 23:35:06 dovecot_plain authenticator failed for ([112.173.61.81]) [112.173.61.81]:45408: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.165.148.166
description:
Feb  5 23:35:07 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.165.148.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.160.114.72
description:
Feb  5 23:35:15 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.160.114.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.68
description:
Feb  5 23:35:26 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.15.101.6
description:
Feb  5 23:35:07 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.15.101.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.235.25.35
description:
Feb  5 23:35:15 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.235.25.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.160.45.26
description:
Feb  5 23:35:15 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.160.45.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.191.221.158
description:
2025-02-05 23:35:42 dovecot_plain authenticator failed for syn-075-191-221-158.res.spectrum.com [75.191.221.158]:54357: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.169.151
description:
Feb  5 23:35:00 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.169.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.124.241.138
description:
Feb  5 23:35:01 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.124.241.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.235.25.35
description:
2025-02-05 23:35:17 dovecot_plain authenticator failed for ([77.235.25.35]) [77.235.25.35]:46947: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.49.250
description:
Feb  5 23:35:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
description:
2025-02-05 23:35:12 dovecot_plain authenticator failed for ([116.113.254.26]) [116.113.254.26]:58142: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 81.90.216.140
description:
[2025-02-05 23:35:56 +0100] info [webmaild] 81.90.216.140 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.233.26
description:
2025-02-05 23:35:11 dovecot_plain authenticator failed for ([104.241.233.26]) [104.241.233.26]:39584: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.73
description:
2025-02-05 23:35:05 dovecot_plain authenticator failed for (m121-202-155-73.smartone.com) [121.202.155.73]:24395: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.121.193.126
description:
Feb  5 23:35:07 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.121.193.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.146.201.37
description:
2025-02-05 23:35:08 dovecot_plain authenticator failed for ([221.146.201.37]) [221.146.201.37]:53366: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.218.102.225
description:
2025-02-05 23:35:09 dovecot_plain authenticator failed for (180-218-102-225.dynamic.twmbroadband.net) [180.218.102.225]:60702: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
description:
2025-02-05 23:35:24 dovecot_plain authenticator failed for ([106.51.120.94]) [106.51.220.33]:28516: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.37
description:
Feb  5 23:35:31 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.90.72.14
description:
2025-02-05 23:35:50 dovecot_plain authenticator failed for ([125.90.72.14]) [125.90.72.14]:37686: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.11.126
description:
2025-02-05 23:35:11 dovecot_plain authenticator failed for ([220.182.11.126]) [220.182.11.126]:47309: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 48.218.170.53
description:
Feb  5 23:35:03 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 48.218.170.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.124.241.138
description:
2025-02-05 23:35:03 dovecot_plain authenticator failed for ([116.124.241.138]) [116.124.241.138]:43214: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.124.47.11
description:
Feb  5 23:35:05 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.124.47.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
description:
Feb  5 23:35:09 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.225.185.154
description:
2025-02-05 23:35:17 dovecot_plain authenticator failed for ([124.225.185.154]) [124.225.185.154]:55602: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.180.193.176
description:
Feb  5 23:35:13 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.180.193.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.160.114.72
description:
2025-02-05 23:35:17 dovecot_plain authenticator failed for ([182.160.114.72]) [182.160.114.72]:37528: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.141.97.2
description:
Feb  5 23:35:28 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.141.97.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.201.37
description:
Feb  5 23:35:06 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.201.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Feb  5 23:35:08 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.255.221
description:
Feb  5 23:35:16 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.255.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.182
description:
2025-02-05 23:35:28 dovecot_plain authenticator failed for ([121.202.155.182]) [121.202.155.182]:38761: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.52.80.36
description:
[2025-02-05 23:35:53 +0100] info [webmaild] 177.52.80.36 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.220.33
description:
Feb  5 23:35:22 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.220.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
description:
Feb  5 23:35:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.90
description:
Feb  5 23:35:29 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.145.54.48
description:
2025-02-05 23:35:05 dovecot_plain authenticator failed for ([103.145.54.48]) [103.145.54.48]:51441: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.91.97.228
description:
Feb  5 23:35:09 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.91.97.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.141.97.2
description:
2025-02-05 23:35:30 dovecot_plain authenticator failed for ([36.141.97.2]) [36.141.97.2]:41030: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 48.218.170.53
description:
2025-02-05 23:35:05 dovecot_plain authenticator failed for ([48.218.170.53]) [48.218.170.53]:45054: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.26.86
description:
Feb  5 23:35:29 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.26.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.124.47.11
description:
2025-02-05 23:35:07 dovecot_plain authenticator failed for ([111.124.47.11]) [111.124.47.11]:57414: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.142.39.13
description:
2025-02-05 23:35:10 dovecot_plain authenticator failed for ([125.142.39.13]) [125.142.39.13]:60910: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.25
description:
2025-02-05 23:35:12 dovecot_plain authenticator failed for ([121.202.154.25]) [121.202.154.25]:5397: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.89.99
description:
Feb  5 23:35:13 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.89.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.225.185.154
description:
Feb  5 23:35:15 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.225.185.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.255.221
description:
2025-02-05 23:35:18 dovecot_plain authenticator failed for ([218.146.255.221]) [218.146.255.221]:51981: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.199.29.111
description:
Feb  5 23:35:27 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.199.29.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.132.43.94
description:
2025-02-05 23:35:32 dovecot_plain authenticator failed for ([116.132.43.94]) [116.132.43.94]:10644: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.191.221.158
description:
Feb  5 23:35:40 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.191.221.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.169.151
description:
2025-02-05 23:35:02 dovecot_plain authenticator failed for ([65.20.169.151]) [65.20.169.151]:35106: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
description:
2025-02-05 23:35:11 dovecot_plain authenticator failed for ([203.128.181.121]) [203.128.181.121]:51811: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.25.18.18
description:
Feb  5 23:35:12 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.25.18.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.180.193.176
description:
2025-02-05 23:35:15 dovecot_plain authenticator failed for wsip-184-180-193-176.tu.ok.cox.net [184.180.193.176]:38180: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.4.42.19
description:
2025-02-05 23:35:01 dovecot_plain authenticator failed for (host-194-4-42-19.net.intranetwifi.it) [194.4.42.19]:34168: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
description:
Feb  5 23:35:03 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
description:
Feb  5 23:35:06 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.233.26
description:
Feb  5 23:35:09 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.233.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
description:
2025-02-05 23:35:09 dovecot_plain authenticator failed for ([190.121.193.126]) [190.121.193.126]:60626: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.215.243.6
description:
2025-02-05 23:35:09 dovecot_plain authenticator failed for ([58.215.243.6]) [58.215.243.6]:51168: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.6.109
description:
2025-02-05 23:35:11 dovecot_plain authenticator failed for 95-31-6-109.static.corbina.ru [95.31.6.109]:51786: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Feb  5 23:35:24 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.173.61.81
description:
Feb  5 23:35:04 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.173.61.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.142.39.13
description:
Feb  5 23:35:08 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.142.39.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.89.99
description:
2025-02-05 23:35:15 dovecot_plain authenticator failed for ([177.174.89.105]) [177.174.89.99]:54937: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.160.45.26
description:
2025-02-05 23:35:17 dovecot_plain authenticator failed for ([124.160.45.26]) [124.160.45.26]:41696: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-02-05 23:35:26 dovecot_plain authenticator failed for ([14.88.228.202]) [14.88.228.202]:37004: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
description:
2025-02-05 23:35:05 dovecot_plain authenticator failed for ([200.149.51.186]) [200.149.51.186]:34693: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.25
description:
Feb  5 23:35:10 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.26.86
description:
2025-02-05 23:35:31 dovecot_plain authenticator failed for ([65.76.26.86]) [65.76.26.86]:40784: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.90
description:
2025-02-05 23:35:31 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:45330: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.254.26
description:
Feb  5 23:35:10 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.254.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.165.61
description:
Feb  5 23:35:15 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.165.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.37
description:
2025-02-05 23:35:33 dovecot_plain authenticator failed for ([101.13.5.37]) [101.13.5.37]:33886: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.215.243.6
description:
Feb  5 23:35:07 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.215.243.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.193.163.2
description:
Feb  5 23:35:35 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.193.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.90.72.14
description:
Feb  5 23:35:48 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.90.72.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.148.43
description:
2025-02-05 23:35:05 dovecot_plain authenticator failed for ([183.109.148.43]) [183.109.148.43]:45746: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.68
description:
2025-02-05 23:35:28 dovecot_plain authenticator failed for ([144.48.49.68]) [144.48.49.68]:58769: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.137.159
description:
2025-02-05 23:35:06 dovecot_plain authenticator failed for (abts-tn-static-159.137.165.122.airtelbroadband.in) [122.165.137.159]:34954: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.191.145.123
description:
Feb  5 23:35:06 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.191.145.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.191.145.123
description:
2025-02-05 23:35:08 dovecot_plain authenticator failed for ([61.191.145.123]) [61.191.145.123]:53467: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
description:
Feb  5 23:35:12 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.97.228
description:
2025-02-05 23:35:11 dovecot_plain authenticator failed for syn-172-091-097-228.res.spectrum.com (172-091-097-228.res.spectrum.com) [172.91.97.228]:51156: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.24.210.27
description:
Feb  5 23:35:19 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.24.210.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.25.18.18
description:
2025-02-05 23:35:14 dovecot_plain authenticator failed for ([1.25.18.18]) [1.25.18.18]:54886: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.182
description:
Feb  5 23:35:26 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.184
description:
2025-02-05 23:35:24 dovecot_plain authenticator failed for (nsg-corporate-184.230.187.122.airtel.in) [122.187.230.184]:35133: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.199.29.111
description:
2025-02-05 23:35:29 dovecot_plain authenticator failed for ([124.199.29.111]) [124.199.29.111]:60106: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-02-05 23:35:10 dovecot_plain authenticator failed for ([216.194.174.103]) [216.194.174.27]:26226: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
description:
2025-02-05 23:35:08 dovecot_plain authenticator failed for ([169.211.232.182]) [169.211.232.182]:59108: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.143.231.208
description:
2025-02-05 23:35:20 dovecot_plain authenticator failed for ([43.143.231.208]) [43.143.231.208]:44642: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.24.210.27
description:
2025-02-05 23:35:21 dovecot_plain authenticator failed for ([1.24.210.27]) [1.24.210.27]:58048: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.15.101.6
description:
2025-02-05 23:35:09 dovecot_plain authenticator failed for ([190.15.101.6]) [190.15.101.6]:32933: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.49.250
description:
2025-02-05 23:35:25 dovecot_plain authenticator failed for ([58.16.49.250]) [58.16.49.250]:41034: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
description:
2025-02-05 23:35:25 dovecot_plain authenticator failed for (189-108-147-210.customer.tdatabrasil.net.br) [189.108.147.210]:42989: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.11.241.139
description:
Feb  5 23:35:06 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.11.241.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.218.102.225
description:
Feb  5 23:35:07 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.218.102.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.6.109
description:
Feb  5 23:35:09 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.6.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.11.126
description:
Feb  5 23:35:09 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.11.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
description:
2025-02-05 23:35:09 dovecot_plain authenticator failed for ([200.165.163.121]) [200.165.148.166]:60630: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
description:
2025-02-05 23:35:17 dovecot_plain authenticator failed for ([41.63.165.61]) [41.63.165.61]:37262: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.184
description:
Feb  5 23:35:22 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.132.43.94
description:
Feb  5 23:35:30 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.132.43.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.143.231.208
description:
Feb  5 23:35:18 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.143.231.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.88.96.37
description:
Feb  5 23:36:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.88.96.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 23:36:10 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.190.139.137
description:
Feb  5 23:36:11 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.190.139.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.88.96.37
description:
2025-02-05 23:36:25 dovecot_plain authenticator failed for ([58.131.97.5]) [180.88.96.37]:5847: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.192.33.201
description:
[2025-02-05 23:36:29 +0100] info [webmaild] 177.192.33.201 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.190.139.137
description:
2025-02-05 23:36:13 dovecot_plain authenticator failed for (c-50-190-139-137.unallocated.comcastbusiness.net) [50.190.139.137]:53833: 535 Incorrect authentication data (set_id=test@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 23:36:24 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.169
description:
2025-02-05 23:37:43 dovecot_plain authenticator failed for ([220.77.182.169]) [220.77.182.169]:34786: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.132.150.162
description:
Feb  5 23:37:51 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.132.150.162 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 4.240.73.64
description:
Feb  5 23:37:16 ait sshd[857333]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=4.240.73.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.182.169
description:
Feb  5 23:37:41 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.182.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.240.73.64
description:
Feb  5 23:37:16 ait sshd[857333]: pam_imunify(sshd:auth): [IM360_RBL] The IP 4.240.73.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
description:
2025-02-05 23:37:53 dovecot_plain authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:56226: 535 Incorrect authentication data (set_id=ug88m8880009)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 87.76.3.162
description:
[2025-02-05 23:37:58 +0100] info [webmaild] 87.76.3.162 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.104.41
description:
Feb  5 23:38:46 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.104.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.237.83.130
description:
Feb  5 23:38:59 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.237.83.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.174.3.182
description:
Feb  5 23:38:45 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.174.3.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.39.158
description:
2025-02-05 23:38:50 dovecot_plain authenticator failed for 95-31-39-158.broadband.corbina.ru [95.31.39.158]:59570: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.122
description:
Feb  5 23:38:59 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.122 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.50.182.90
description:
Feb  5 23:38:17 ait sshd[857893]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.182.90


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.176.57
description:
Feb  5 23:38:27 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.176.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.223
description:
2025-02-05 23:38:29 dovecot_plain authenticator failed for (colubblan) [65.20.155.223]:35472: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.7.200.152
description:
Feb  5 23:38:31 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.7.200.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.43.144.63
description:
Feb  5 23:38:33 ait sshd[858077]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.43.144.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.93.156.147
description:
Feb  5 23:38:35 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.93.156.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.39.158
description:
Feb  5 23:38:48 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.39.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.87.34.133
description:
2025-02-05 23:38:50 dovecot_plain authenticator failed for syn-023-087-034-133.res.spectrum.com [23.87.34.133]:40618: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.253.27.222
description:
[2025-02-05 23:38:27 +0100] info [webmaild] 187.253.27.222 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 23:38:29 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.176.57
description:
2025-02-05 23:38:29 dovecot_plain authenticator failed for ([39.152.176.57]) [39.152.176.57]:38996: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
description:
2025-02-05 23:38:33 dovecot_plain authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:51848: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.221.2.199
description:
Feb  5 23:38:42 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.221.2.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.177.40.85
description:
Feb  5 23:38:44 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.177.40.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.50.182.90
description:
Feb  5 23:38:17 ait sshd[857893]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.50.182.90 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.107.77.14
description:
[2025-02-05 23:38:37 +0100] info [webmaild] 200.107.77.14 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.93.156.147
description:
2025-02-05 23:38:37 dovecot_plain authenticator failed for ip4-193-93-156-147.blue-net.com.pl ([193.93.156.149]) [193.93.156.147]:58812: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.104.41
description:
2025-02-05 23:38:48 dovecot_plain authenticator failed for visaustralia.com [216.70.104.41]:41610: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.87.34.133
description:
Feb  5 23:38:48 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.87.34.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.174.3.182
description:
2025-02-05 23:38:47 dovecot_plain authenticator failed for 182.3.174.178.static.wline.lns.sme.cust.swisscom.ch [178.174.3.182]:51730: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.241.247.150
description:
Feb  5 23:38:48 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.241.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.241.247.150
description:
2025-02-05 23:38:50 dovecot_plain authenticator failed for ([191.241.247.150]) [191.241.247.150]:41876: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.43.144.63
description:
Feb  5 23:38:33 ait sshd[858077]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.43.144.63


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.221.2.199
description:
2025-02-05 23:38:44 dovecot_plain authenticator failed for ([114.221.2.199]) [114.221.2.199]:46568: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.40.85
description:
2025-02-05 23:38:46 dovecot_plain authenticator failed for ([103.177.40.85]) [103.177.40.85]:37642: 535 Incorrect authentication data (set_id=ads21a00042y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.237.83.130
description:
2025-02-05 23:39:01 dovecot_plain authenticator failed for ([23.237.83.130]) [23.237.83.130]:49204: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.66.153.194
description:
Feb  5 23:39:00 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.66.153.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.122
description:
2025-02-05 23:39:01 dovecot_plain authenticator failed for ([103.79.175.122]) [103.79.175.122]:40505: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.127.233
description:
Feb  5 23:39:28 ait sshd[858282]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.127.233


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.66.153.194
description:
2025-02-05 23:39:02 dovecot_plain authenticator failed for ([95.66.153.194]) [95.66.153.194]:51685: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.227.248.225
description:
2025-02-05 23:39:04 dovecot_plain authenticator failed for ([139.227.248.225]) [139.227.248.225]:43678: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.104.164.108
description:
[2025-02-05 23:39:10 +0100] info [webmaild] 179.104.164.108 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 23:39:27 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.127.233
description:
Feb  5 23:39:28 ait sshd[858282]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.127.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.227.248.225
description:
Feb  5 23:39:02 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.227.248.225 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.151.47.100
description:
[2025-02-05 23:40:28 +0100] info [webmaild] 103.151.47.100 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.68.226.87
description:
Feb  5 23:40:41 ait sshd[858891]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.226.87


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.199.206.26
description:
Feb  5 23:40:28 ait sshd[858724]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.206.26


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.206.26
description:
Feb  5 23:40:28 ait sshd[858724]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.206.26 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 157.66.55.50
domain: jaster.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-content/uploads/wp-conflg.php||SC:/home/titlemas/public_html/www.jaster.us/wp-content


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.57.71
description:
Feb  5 23:40:43 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.57.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.84.241.94
description:
Feb  5 23:40:43 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.84.241.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.84.241.94
description:
2025-02-05 23:40:45 dovecot_plain authenticator failed for ([119.84.241.94]) [119.84.241.94]:59680: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.196.92
description:
2025-02-05 23:40:58 dovecot_plain authenticator failed for (223-197-196-92.static.imsbiz.com) [223.197.196.92]:53360: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.20.137
description:
2025-02-05 23:40:58 dovecot_plain authenticator failed for ([2.192.20.137]) [2.192.20.137]:56066: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 24.48.214.3
description:
[2025-02-05 23:40:57 +0100] info [webmaild] 24.48.214.3 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.68.226.87
description:
Feb  5 23:40:41 ait sshd[858891]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.68.226.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.192.20.137
description:
Feb  5 23:40:56 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.192.20.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.207.60
description:
Feb  5 23:40:40 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.207.60 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 157.66.55.50
domain: jaster.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:23-40.157.66.55.50||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.207.60
description:
2025-02-05 23:40:42 dovecot_plain authenticator failed for ([121.202.207.60]) [121.202.207.60]:37076: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.57.71
description:
2025-02-05 23:40:45 dovecot_plain authenticator failed for n220246057071.netvigator.com [220.246.57.71]:56709: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.196.92
description:
Feb  5 23:40:56 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.196.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Feb  5 23:41:18 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-02-05 23:41:20 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:40172: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 23:41:22 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.74.9.190
description:
2025-02-05 23:41:30 dovecot_login authenticator failed for ([101.230.0.49]) [124.74.9.190]:59279: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.250.23.208
description:
Feb  5 23:41:14 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.250.23.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Feb  5 23:41:16 ait sshd[859057]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Feb  5 23:41:16 ait sshd[859057]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.250.23.208
description:
2025-02-05 23:41:16 dovecot_plain authenticator failed for ([72.250.23.208]) [72.250.23.208]:33926: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.23.39.210
description:
[2025-02-05 23:41:45 +0100] info [webmaild] 187.23.39.210 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 59.36.78.66
description:
Feb  5 23:41:57 ait sshd[859426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.36.78.66


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.74.9.190
description:
Feb  5 23:41:28 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.74.9.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 23:41:08 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 23:41:14 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.169.144.176
description:
Feb  5 23:41:26 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.169.144.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.122.67.237
description:
Feb  5 23:41:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.122.67.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.122.67.237
description:
2025-02-05 23:41:55 dovecot_login authenticator failed for ppp-124-122-67-237.revip2.asianet.co.th [124.122.67.237]:49313: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.97.40.224
description:
[2025-02-05 23:41:11 +0100] info [webmaild] 138.97.40.224 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.169.144.176
description:
2025-02-05 23:41:28 dovecot_plain authenticator failed for 136.169.144.176.dynamic.ufanet.ru [136.169.144.176]:52394: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.90.117.84
description:
Feb  5 23:41:37 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.90.117.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.90.117.84
description:
2025-02-05 23:41:39 dovecot_login authenticator failed for ([165.90.117.84]) [165.90.117.84]:36254: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.85.114
description:
Feb  5 23:42:00 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.85.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.59.53
description:
2025-02-05 23:42:21 dovecot_plain authenticator failed for ([185.167.59.53]) [185.167.59.53]:42440: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.84.149
description:
Feb  5 23:42:21 ait sshd[859513]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.69.84.149 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.87.33.94
description:
[2025-02-05 23:43:00 +0100] info [webmaild] 177.87.33.94 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-02-05 23:42:08 dovecot_login authenticator failed for ([171.244.40.228]) [171.244.40.236]:29411: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.85.114
description:
2025-02-05 23:42:02 dovecot_plain authenticator failed for (189-20-32-73.customer.tdatabrasil.net.br) [186.200.85.114]:59887: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.212
description:
Feb  5 23:42:41 ait sshd[859699]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.212  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Feb  5 23:42:06 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.59.53
description:
Feb  5 23:42:19 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.59.53 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.69.84.149
description:
Feb  5 23:42:21 ait sshd[859513]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.69.84.149


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.212
description:
Feb  5 23:42:41 ait sshd[859699]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 143.110.180.0
description:
Feb  5 23:43:01 ait sshd[859758]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.110.180.0


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.68.226.87
description:
Feb  5 23:43:21 ait sshd[859843]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.68.226.87 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-43.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.122
description:
2025-02-05 23:43:56 dovecot_plain authenticator failed for ([103.79.175.122]) [103.79.175.122]:55208: 535 Incorrect authentication data (set_id=eng19b00228y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.180.0
description:
Feb  5 23:43:01 ait sshd[859758]: pam_imunify(sshd:auth): [IM360_RBL] The IP 143.110.180.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.181.74
description:
Feb  5 23:43:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.181.74 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 86.108.18.115
description:
[2025-02-05 23:43:40 +0100] info [webmaild] 86.108.18.115 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.146
description:
Feb  5 23:43:42 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.146 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.115.29
description:
47.128.115.29 - - [05/Feb/2025:23:43:50 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10867704 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=79%2C121%2C198%2C183&filtering=1&instructor=1&price_type=paid&rating_filter=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.115.29


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.176.231
description:
2025-02-05 23:43:56 dovecot_login authenticator failed for ([61.184.176.231]) [61.184.176.231]:38763: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.158.26.219
description:
[2025-02-05 23:43:29 +0100] info [webmaild] 186.158.26.219 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.212
description:
Feb  5 23:43:02 ait sshd[859699]: error: maximum authentication attempts exceeded for root from 218.92.0.212 port 31146 ssh2 [preauth]


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.68.226.87
description:
Feb  5 23:43:21 ait sshd[859843]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.226.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.146
description:
2025-02-05 23:43:44 dovecot_plain authenticator failed for ([185.255.212.146]) [185.255.212.146]:63367: 535 Incorrect authentication data (set_id=eng19b00228y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.176.231
description:
Feb  5 23:43:54 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.176.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.122
description:
Feb  5 23:43:54 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.181.74
description:
2025-02-05 23:43:38 dovecot_login authenticator failed for ([103.65.227.71]) [114.130.181.74]:59945: 535 Incorrect authentication data (set_id=mail@aitlemass.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.85.251.16
description:
2025-02-05 23:44:05 dovecot_login authenticator failed for ([220.85.251.16]) [220.85.251.16]:55250: 535 Incorrect authentication data (set_id=mail@aitsmartschool.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.72.22.64
description:
[2025-02-05 23:44:14 +0100] info [webmaild] 131.72.22.64 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.199.206.26
description:
Feb  5 23:44:14 ait sshd[860135]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.206.26


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.68.226.87
description:
Feb  5 23:44:37 ait sshd[860317]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.226.87


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 116.118.51.209
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-44.116.118.51.209


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-02-05 23:44:13 dovecot_plain authenticator failed for ([112.111.61.229]) [112.111.61.229]:49652: 535 Incorrect authentication data (set_id=eng19b00228y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.82
description:
2025-02-05 23:44:22 dovecot_login authenticator failed for ([58.230.236.82]) [58.230.236.82]:51582: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.68.226.87
description:
Feb  5 23:44:39 ait sshd[860317]: Failed password for invalid user server from 51.68.226.87 port 41144 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.85.251.16
description:
Feb  5 23:44:03 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.85.251.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.82
description:
Feb  5 23:44:20 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.68.226.87
description:
Feb  5 23:44:37 ait sshd[860317]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.68.226.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Feb  5 23:44:11 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.206.26
description:
Feb  5 23:44:14 ait sshd[860135]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.206.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.84.149
description:
Feb  5 23:45:25 ait sshd[860645]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.69.84.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.206.26
description:
Feb  5 23:45:36 ait sshd[860679]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.206.26 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.199.206.26
description:
Feb  5 23:45:36 ait sshd[860679]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.206.26


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 59.36.78.66
description:
Feb  5 23:45:40 ait sshd[860777]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.36.78.66


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.69.84.149
description:
Feb  5 23:45:25 ait sshd[860645]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.69.84.149


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.175.196.125
description:
[2025-02-05 23:45:31 +0100] info [webmaild] 85.175.196.125 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.154
description:
Feb  5 23:46:11 ait sshd[861011]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.154  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Feb  5 23:46:17 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-02-05 23:46:19 dovecot_plain authenticator failed for (vistoid) [77.51.214.170]:48758: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
description:
Feb  5 23:46:20 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
description:
2025-02-05 23:46:22 dovecot_plain authenticator failed for ([195.222.57.190]) [195.222.57.190]:57414: 535 Incorrect authentication data (set_id=7606e1dcc1da)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.200.38.247
description:
[2025-02-05 23:46:50 +0100] info [webmaild] 190.200.38.247 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.20.171.88
description:
[2025-02-05 23:46:01 +0100] info [webmaild] 201.20.171.88 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.154
description:
Feb  5 23:46:11 ait sshd[861011]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.137.38.119
description:
Feb  5 23:46:11 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.137.38.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-02-05 23:46:20 dovecot_login authenticator failed for ([1.28.192.118]) [1.28.192.118]:33822: 535 Incorrect authentication data (set_id=iric)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.184
description:
Feb  5 23:46:31 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.184 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 59.36.78.66
description:
Feb  5 23:46:50 ait sshd[861393]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.36.78.66


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.69.84.149
description:
Feb  5 23:46:56 ait sshd[861433]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.69.84.149


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.63.148.250
description:
[2025-02-05 23:46:12 +0100] info [webmaild] 187.63.148.250 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
description:
Feb  5 23:46:18 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.184
description:
2025-02-05 23:46:33 dovecot_login authenticator failed for (nsg-corporate-184.230.187.122.airtel.in) [122.187.230.184]:38902: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.102.141.123
description:
Feb  5 23:46:40 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.102.141.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.102.141.123
description:
2025-02-05 23:46:42 dovecot_login authenticator failed for ([75.102.141.123]) [75.102.141.123]:37287: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.84.149
description:
Feb  5 23:46:56 ait sshd[861433]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.69.84.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.243.37
description:
Feb  5 23:46:09 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.243.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.134.243.37
description:
2025-02-05 23:46:11 dovecot_login authenticator failed for ([31.134.243.37]) [31.134.243.37]:55495: 535 Incorrect authentication data (set_id=iric@aitopen.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.137.38.119
description:
2025-02-05 23:46:13 dovecot_plain authenticator failed for ([36.137.38.119]) [36.137.38.119]:42962: 535 Incorrect authentication data (set_id=7606e1dcc1da@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
description:
Feb  5 23:47:56 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
description:
2025-02-05 23:47:58 dovecot_plain authenticator failed for ([65.20.205.197]) [65.20.205.197]:33153: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.154
description:
Feb  5 23:47:33 ait sshd[861585]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.154 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.154
description:
Feb  5 23:47:33 ait sshd[861585]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.154  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.224.55.211
description:
[2025-02-05 23:48:11 +0100] info [webmaild] 103.224.55.211 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.250.134.35
description:
Feb  5 23:48:13 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.250.134.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.250.134.35
description:
2025-02-05 23:48:15 dovecot_plain authenticator failed for ([130.250.134.35]) [130.250.134.35]:39968: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.14.31.158
description:
Feb  5 23:48:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.14.31.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
description:
2025-02-05 23:48:25 dovecot_plain authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr (dicaime) [80.14.31.158]:51705: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 89.32.61.181
description:
[2025-02-05 23:48:39 +0100] info [webmaild] 89.32.61.181 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.182.209.56
description:
[2025-02-05 23:48:48 +0100] info [webmaild] 45.182.209.56 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.140.31.232
description:
[2025-02-05 23:49:21 +0100] info [webmaild] 177.140.31.232 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.102.66.226
description:
Feb  5 23:49:32 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.102.66.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.102.66.226
description:
2025-02-05 23:49:34 dovecot_plain authenticator failed for ([207.102.66.226]) [207.102.66.226]:49914: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.254
description:
Feb  5 23:49:38 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.254
description:
2025-02-05 23:49:40 dovecot_plain authenticator failed for (nsg-corporate-254.230.187.122.airtel.in) [122.187.230.254]:50619: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.45.68
description:
Feb  5 23:49:47 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.45.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.140.176.170
description:
Feb  5 23:49:48 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.140.176.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.45.68
description:
2025-02-05 23:49:49 dovecot_plain authenticator failed for ([218.146.45.68]) [218.146.45.68]:41088: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.140.176.170
description:
2025-02-05 23:49:50 dovecot_plain authenticator failed for ([219.140.176.170]) [219.140.176.170]:55895: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.128
description:
2025-02-05 23:49:57 dovecot_plain authenticator failed for ([178.178.194.128]) [178.178.194.128]:57372: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 23:49:03 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 23:49:30 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.128
description:
Feb  5 23:49:55 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-02-05 23:50:25 dovecot_plain authenticator failed for ([171.244.40.236]) [171.244.40.236]:45660: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.224.164.194
description:
Feb  5 23:50:40 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.224.164.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.33.162
description:
2025-02-05 23:50:21 dovecot_plain authenticator failed for ([183.237.33.162]) [183.237.33.162]:50820: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.114.242
description:
2025-02-05 23:50:22 dovecot_plain authenticator failed for (242.114.95.187.static.liggatelecom.com.br) [187.95.114.242]:4172: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.226.228
description:
2025-02-05 23:50:28 dovecot_plain authenticator failed for broadband-77-37-226-228.ip.moscow.rt.ru [77.37.226.228]:51244: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.218.168.192
description:
Feb  5 23:50:32 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.218.168.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.63.46.34
description:
Feb  5 23:50:21 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.63.46.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.129.25.70
description:
2025-02-05 23:50:22 dovecot_plain authenticator failed for ([39.129.25.70]) [39.129.25.70]:43042: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.25.233.22
description:
2025-02-05 23:50:38 dovecot_plain authenticator failed for ([218.25.233.2]) [218.25.233.22]:53318: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.170
description:
2025-02-05 23:50:41 dovecot_plain authenticator failed for ([220.77.182.170]) [220.77.182.170]:36430: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.202.206.163
description:
2025-02-05 23:50:21 dovecot_plain authenticator failed for 163.189-202-206.bestelclientes.com.mx [189.202.206.163]:41038: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.145.163.164
description:
Feb  5 23:50:27 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.145.163.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.190.109.138
description:
2025-02-05 23:50:29 dovecot_plain authenticator failed for ([222.190.109.138]) [222.190.109.138]:34074: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
description:
2025-02-05 23:50:36 dovecot_plain authenticator failed for ([196.28.226.124]) [196.28.226.124]:56854: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.196.214
description:
Feb  5 23:50:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.196.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.163.164
description:
2025-02-05 23:50:29 dovecot_plain authenticator failed for ([61.145.163.164]) [61.145.163.164]:48172: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
description:
2025-02-05 23:50:44 dovecot_plain authenticator failed for ([88.87.84.104]) [88.87.84.104]:42960: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.113.9.34
description:
2025-02-05 23:50:24 dovecot_plain authenticator failed for ([111.113.9.34]) [111.113.9.34]:42329: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.60.184
description:
Feb  5 23:50:43 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.60.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.14.135
description:
2025-02-05 23:50:27 dovecot_plain authenticator failed for 111-70-14-135.emome-ip.hinet.net [111.70.14.135]:53354: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.227.214.33
description:
Feb  5 23:50:20 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.227.214.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.99.61.248
description:
Feb  5 23:50:31 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.99.61.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
description:
2025-02-05 23:50:32 dovecot_plain authenticator failed for ([102.90.34.90]) [102.90.34.90]:35554: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
description:
2025-02-05 23:50:33 dovecot_plain authenticator failed for ([14.99.61.248]) [14.99.61.248]:60532: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.161.184.58
description:
Feb  5 23:50:49 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.161.184.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.201.58
description:
2025-02-05 23:50:50 dovecot_plain authenticator failed for ([220.178.201.58]) [220.178.201.58]:34618: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.33.162
description:
Feb  5 23:50:19 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.33.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.226.228
description:
Feb  5 23:50:26 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.226.228 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.101.153.253
description:
[2025-02-05 23:50:38 +0100] info [webmaild] 85.101.153.253 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.208.136.225
description:
Feb  5 23:50:42 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.208.136.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.164.194
description:
2025-02-05 23:50:42 dovecot_plain authenticator failed for ([122.224.164.194]) [122.224.164.194]:53937: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.184
description:
2025-02-05 23:50:45 dovecot_plain authenticator failed for ([171.244.60.184]) [171.244.60.184]:43383: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.202.206.163
description:
Feb  5 23:50:19 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.202.206.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.222
description:
2025-02-05 23:50:27 dovecot_plain authenticator failed for ([121.202.205.222]) [121.202.205.222]:24308: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.113.9.34
description:
Feb  5 23:50:22 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.113.9.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.33.96.3
description:
2025-02-05 23:50:23 dovecot_plain authenticator failed for ([14.33.96.3]) [14.33.96.3]:42739: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.14.135
description:
Feb  5 23:50:25 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.14.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
description:
2025-02-05 23:50:25 dovecot_plain authenticator failed for syn-208-105-196-214.biz.spectrum.com (rrcs-208-105-196-214.nys.biz.rr.com) [208.105.196.214]:59507: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.222
description:
Feb  5 23:50:25 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Feb  5 23:50:47 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.226.122
description:
Feb  5 23:50:49 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.226.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.33.96.3
description:
Feb  5 23:50:21 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.33.96.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-02-05 23:50:49 dovecot_plain authenticator failed for ([221.209.48.204]) [221.209.48.203]:55110: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.63.46.34
description:
2025-02-05 23:50:23 dovecot_plain authenticator failed for ([203.29.84.253]) [203.63.46.34]:44317: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.183.1.82
description:
Feb  5 23:50:31 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.183.1.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.168.192
description:
2025-02-05 23:50:34 dovecot_plain authenticator failed for (189.218.168.192-clientes-izzi.mx) [189.218.168.192]:52209: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
description:
2025-02-05 23:50:39 dovecot_plain authenticator failed for ([196.191.142.67]) [196.191.142.67]:57878: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.182.170
description:
Feb  5 23:50:39 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.182.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
description:
Feb  5 23:50:42 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.41.197.10
description:
Feb  5 23:50:44 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.41.197.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.227.214.33
description:
2025-02-05 23:50:22 dovecot_plain authenticator failed for ([182.227.214.33]) [182.227.214.33]:54298: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.216.176.90
description:
2025-02-05 23:50:10 dovecot_plain authenticator failed for 32-216-176-90.bng02.brpt.ct.frontiernet.net [32.216.176.90]:63398: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.25.233.22
description:
Feb  5 23:50:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.25.233.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.142.67
description:
Feb  5 23:50:37 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.142.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.201.58
description:
Feb  5 23:50:48 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.201.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.58
description:
2025-02-05 23:50:51 dovecot_plain authenticator failed for ([131.161.184.58]) [131.161.184.58]:55116: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.216.176.90
description:
Feb  5 23:50:08 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.216.176.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.90.34.90
description:
Feb  5 23:50:30 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.90.34.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.124
description:
Feb  5 23:50:34 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.250.93.159
description:
2025-02-05 23:50:35 dovecot_plain authenticator failed for ([114.250.93.159]) [114.250.93.159]:32131: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.95.114.242
description:
Feb  5 23:50:20 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.95.114.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.183.1.82
description:
2025-02-05 23:50:33 dovecot_plain authenticator failed for ([1.183.1.82]) [1.183.1.82]:59612: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.250.93.159
description:
Feb  5 23:50:33 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.250.93.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.94.190
description:
2025-02-05 23:50:36 dovecot_plain authenticator failed for ([39.164.94.190]) [39.164.94.190]:56592: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.136.225
description:
2025-02-05 23:50:44 dovecot_plain authenticator failed for 31-208-136-225.cust.bredband2.com [31.208.136.225]:42987: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.41.197.10
description:
2025-02-05 23:50:46 dovecot_plain authenticator failed for ([59.41.197.10]) [59.41.197.10]:55426: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Feb  5 23:50:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.94.190
description:
Feb  5 23:50:34 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.94.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.122
description:
2025-02-05 23:50:51 dovecot_plain authenticator failed for ([61.185.226.122]) [61.185.226.122]:54233: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.63
description:
Feb  5 23:50:57 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.190.109.138
description:
Feb  5 23:50:27 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.190.109.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.63
description:
2025-02-05 23:50:59 dovecot_plain authenticator failed for (m121-202-201-63.smartone.com) [121.202.201.63]:19838: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.129.25.70
description:
Feb  5 23:50:20 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.129.25.70 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Feb  5 23:51:42 ait sshd[863946]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.99
description:
Feb  5 23:51:03 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
description:
2025-02-05 23:51:05 dovecot_plain authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:39231: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.81.68.214
description:
[2025-02-05 23:51:09 +0100] info [webmaild] 170.81.68.214 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.98.177.66
description:
Feb  5 23:51:19 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.98.177.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Feb  5 23:51:42 ait sshd[863946]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.147.45
description:
Feb  5 23:51:19 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.147.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
description:
2025-02-05 23:51:21 dovecot_plain authenticator failed for (millete) [65.20.147.45]:33944: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.104.255.24
description:
[2025-02-05 23:51:37 +0100] info [webmaild] 177.104.255.24 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.48.88.31
description:
[2025-02-05 23:52:07 +0100] info [webmaild] 182.48.88.31 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.166
description:
2025-02-05 23:52:36 dovecot_login authenticator failed for 111-70-32-166.emome-ip.hinet.net [111.70.32.166]:51175: 535 Incorrect authentication data (set_id=mail@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.203.251.209
description:
Feb  5 23:52:53 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.203.251.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.203.251.209
description:
2025-02-05 23:52:55 dovecot_plain authenticator failed for ([111.203.251.210]) [111.203.251.209]:40844: 535 Incorrect authentication data (set_id=eng19b00160y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.34.162.249
description:
Feb  5 23:52:21 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.34.162.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.162.249
description:
2025-02-05 23:52:23 dovecot_login authenticator failed for 1-34-162-249.hinet-ip.hinet.net [1.34.162.249]:58758: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.48.197
description:
Feb  5 23:52:30 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.48.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.172.48.197
description:
2025-02-05 23:52:32 dovecot_login authenticator failed for ([103.172.48.197]) [103.172.48.197]:39024: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.166
description:
Feb  5 23:52:34 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.174.3.182
description:
Feb  5 23:52:47 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.174.3.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.174.3.182
description:
2025-02-05 23:52:49 dovecot_login authenticator failed for 182.3.174.178.static.wline.lns.sme.cust.swisscom.ch [178.174.3.182]:41407: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.204.107.129
description:
[2025-02-05 23:53:15 +0100] info [webmaild] 138.204.107.129 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
description:
2025-02-05 23:53:17 dovecot_plain authenticator failed for ([211.109.75.66]) [211.109.75.69]:58211: 535 Incorrect authentication data (set_id=eng19b00160y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.239.202
description:
Feb  5 23:53:46 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.239.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.6.251.57
description:
[2025-02-05 23:53:46 +0100] info [webmaild] 189.6.251.57 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
description:
2025-02-05 23:53:48 dovecot_login authenticator failed for ([117.247.239.202]) [117.247.239.202]:35032: 535 Incorrect authentication data (set_id=mail@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
description:
Feb  5 23:53:15 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.1.85.123
description:
[2025-02-05 23:54:49 +0100] info [webmaild] 179.1.85.123 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.151.71.8
description:
Feb  5 23:55:01 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.151.71.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.51
description:
Feb  5 23:54:05 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.51
description:
2025-02-05 23:54:07 dovecot_login authenticator failed for 111-70-32-51.emome-ip.hinet.net [111.70.32.51]:50526: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.161.178.136
description:
[2025-02-05 23:54:17 +0100] info [webmaild] 45.161.178.136 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.99.210
description:
Feb  5 23:54:44 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.99.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.99.210
description:
2025-02-05 23:54:46 dovecot_plain authenticator failed for ([222.160.99.210]) [222.160.99.210]:34943: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Feb  5 23:55:24 ait sshd[865386]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.57.104.252
description:
2025-02-05 23:55:32 dovecot_login authenticator failed for 95.57.104.252.dynamic.telecom.kz [95.57.104.252]:59848: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.57.104.252
description:
Feb  5 23:55:30 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.57.104.252 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.143.252.8
description:
[2025-02-05 23:55:53 +0100] info [webmaild] 190.143.252.8 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.71.8
description:
2025-02-05 23:55:03 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:34987: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.173.61.81
description:
Feb  5 23:55:13 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.173.61.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.173.61.81
description:
2025-02-05 23:55:15 dovecot_login authenticator failed for ([112.173.61.81]) [112.173.61.81]:57035: 535 Incorrect authentication data (set_id=mail@lemsas.net)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Feb  5 23:55:24 ait sshd[865386]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.196.67
description:
Feb  5 23:56:03 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.126.196.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.196.67
description:
2025-02-05 23:56:05 dovecot_plain authenticator failed for (cli-5b7ec443.ast.adamo.es) [91.126.196.67]:54612: 535 Incorrect authentication data (set_id=mail@myait.org)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.127.233
description:
Feb  5 23:56:21 ait sshd[865830]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.127.233


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.215.33.144
description:
[2025-02-05 23:56:22 +0100] info [webmaild] 37.215.33.144 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.152.3
description:
2025-02-05 23:56:41 dovecot_plain authenticator failed for ([120.197.152.3]) [120.197.152.3]:43304: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.253.226
description:
Feb  5 23:56:54 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.253.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.157.124.84
description:
2025-02-05 23:56:16 dovecot_login authenticator failed for ([219.157.124.84]) [219.157.124.84]:37636: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.127.233
description:
Feb  5 23:56:21 ait sshd[865830]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.127.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.152.225.58
description:
Feb  5 23:56:32 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.152.225.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.152.225.58
description:
2025-02-05 23:56:34 dovecot_plain authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:52744: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.152.3
description:
Feb  5 23:56:39 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.152.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.222.255
description:
2025-02-05 23:56:03 dovecot_login authenticator failed for ([41.215.222.255]) [41.215.222.255]:43544: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.157.124.84
description:
Feb  5 23:56:14 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.157.124.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.18.20.64
description:
Feb  5 23:56:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.18.20.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.83.71.207
description:
Feb  5 23:56:24 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.83.71.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.18.20.64
description:
2025-02-05 23:56:25 dovecot_plain authenticator failed for ([112.18.20.64]) [112.18.20.64]:59376: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.83.71.207
description:
2025-02-05 23:56:26 dovecot_plain authenticator failed for ([151.83.71.207]) [151.83.71.207]:47776: 535 Incorrect authentication data (set_id=mail@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.127.16.197
description:
Feb  5 23:56:31 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.127.16.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.127.16.197
description:
2025-02-05 23:56:33 dovecot_plain authenticator failed for ip-188-127-16-197.ennet.pl [188.127.16.197]:53986: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
description:
2025-02-05 23:56:56 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:35121: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.39.22.121
description:
[2025-02-05 23:56:48 +0100] info [webmaild] 46.39.22.121 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.196.174.235
description:
2025-02-05 23:57:09 dovecot_login authenticator failed for ([183.196.174.235]) [183.196.174.235]:1871: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.196.24.18
description:
[2025-02-05 23:57:22 +0100] info [webmaild] 168.196.24.18 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 23:57:45 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.196.174.235
description:
Feb  5 23:57:07 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.196.174.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 23:58:13 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.163.87.73
description:
[2025-02-05 23:58:29 +0100] info [webmaild] 45.163.87.73 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 23:58:32 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.158.77.43
description:
2025-02-05 23:58:54 dovecot_login authenticator failed for ec2-54-158-77-43.compute-1.amazonaws.com (ait.edu.gh) [54.158.77.43]:61616: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.235.157.38
description:
[2025-02-05 23:59:21 +0100] info [webmaild] 187.235.157.38 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 23:59:28 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.254.151.48
description:
[2025-02-05 23:59:54 +0100] info [webmaild] 179.254.151.48 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.131.76.77
description:
[2025-02-05 23:59:01 +0100] info [webmaild] 177.131.76.77 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.252.38.24
description:
Feb  5 23:59:10 ait sshd[866996]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.252.38.24 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.252.38.24
description:
Feb  5 23:59:10 ait sshd[866996]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.252.38.24


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.17.80
description:
Feb  6 00:00:27 ait sshd[867656]: pam_imunify(sshd:auth): [IM360_RBL] The IP 57.129.17.80 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 57.129.17.80
description:
Feb  6 00:00:27 ait sshd[867656]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=57.129.17.80


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Feb  6 00:00:46 ait sshd[867732]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.239.251.214
description:
Feb  6 00:01:45 ait sshd[868200]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.239.251.214


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.93.134
description:
Feb  6 00:00:00 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.93.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.251.214
description:
Feb  6 00:01:45 ait sshd[868200]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.239.251.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 5.183.209.179
description:
Feb  6 00:00:59 ait sshd[867884]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.183.209.179  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 36.50.11.167
description:
[2025-02-06 00:01:06 +0100] info [webmaild] 36.50.11.167 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 47.236.119.54
description:
Feb  6 00:01:38 ait dovecot[392347]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=47.236.119.54, lip=136.243.145.84, TLS, session=<N+iiG20t0okv7Hc2>


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Feb  6 00:00:46 ait sshd[867732]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.228.241.5
description:
[2025-02-06 00:01:35 +0100] info [webmaild] 45.228.241.5 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.68.194.54
description:
Feb  6 00:00:35 ait sshd[867703]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.68.194.54


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.220.198.226
description:
[2025-02-06 00:02:03 +0100] info [webmaild] 186.220.198.226 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.239.144
description:
2025-02-06 00:02:19 dovecot_login authenticator failed for ([178.158.239.144]) [178.158.239.144]:58127: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.210.176
description:
Feb  6 00:02:30 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.210.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 102.209.16.253
description:
Feb  6 00:02:30 ait sshd[868505]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.209.16.253  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.121.24.16
description:
[2025-02-06 00:02:33 +0100] info [webmaild] 186.121.24.16 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.210.176
description:
2025-02-06 00:02:32 dovecot_login authenticator failed for ([183.107.210.176]) [183.107.210.176]:36636: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.85.107.135
description:
Feb  6 00:03:11 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.85.107.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.85.107.135
description:
2025-02-06 00:03:13 dovecot_plain authenticator failed for ([222.85.107.135]) [222.85.107.135]:46964: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.45.114.161
description:
Feb  6 00:03:25 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.45.114.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.45.114.161
description:
2025-02-06 00:03:27 dovecot_plain authenticator failed for 121-45-114-161.tpgi.com.au [121.45.114.161]:41594: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.219.210.187
description:
[2025-02-06 00:03:39 +0100] info [webmaild] 102.219.210.187 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.191.203.226
description:
[2025-02-06 00:04:09 +0100] info [webmaild] 38.191.203.226 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.51.0.170
description:
Feb  6 00:04:11 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.51.0.170 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Feb  6 00:04:12 ait sshd[869097]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.50.182.90
description:
Feb  6 00:04:14 ait sshd[869100]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.50.182.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  6 00:04:37 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.10
description:
2025-02-06 00:04:44 dovecot_plain authenticator failed for ([196.189.126.10]) [196.189.126.10]:33510: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.26.65.51
description:
2025-02-06 00:04:56 dovecot_plain authenticator failed for ([112.26.65.51]) [112.26.65.51]:50243: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.250.23.208
description:
Feb  6 00:04:57 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.250.23.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Feb  6 00:04:12 ait sshd[869097]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.0.170
description:
2025-02-06 00:04:13 dovecot_plain authenticator failed for ([179.51.0.170]) [179.51.0.170]:42191: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.92.208.12
description:
Feb  6 00:04:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.92.208.12 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.0.18.186
description:
[2025-02-06 00:04:38 +0100] info [webmaild] 143.0.18.186 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.92.208.12
description:
2025-02-06 00:04:38 dovecot_plain authenticator failed for ([116.92.208.12]) [116.92.208.12]:44048: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.126.10
description:
Feb  6 00:04:42 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.126.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
description:
Feb  6 00:04:52 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.250.23.208
description:
2025-02-06 00:04:59 dovecot_plain authenticator failed for ([72.250.23.208]) [72.250.23.208]:46508: 535 Incorrect authentication data (set_id=mail@elmisa.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.50.182.90
description:
Feb  6 00:04:14 ait sshd[869100]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.182.90


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-02-06 00:04:54 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:60767: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
description:
Feb  6 00:04:24 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
description:
2025-02-06 00:04:26 dovecot_plain authenticator failed for ([27.223.100.94]) [27.223.100.90]:42008: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.26.65.51
description:
Feb  6 00:04:54 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.26.65.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.176.170.160
description:
Feb  6 00:05:35 ait sshd[869667]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.176.170.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.243.62
description:
Feb  6 00:05:35 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.243.62 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.176.170.160
description:
Feb  6 00:05:35 ait sshd[869667]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.176.170.160


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.38.37.48
description:
[2025-02-06 00:05:34 +0100] info [whostmgrd] 45.38.37.48 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.243.62
description:
2025-02-06 00:05:37 dovecot_plain authenticator failed for ([183.220.243.62]) [183.220.243.62]:57262: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.242.210.41
description:
[2025-02-06 00:05:11 +0100] info [webmaild] 191.242.210.41 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.127.233
description:
Feb  6 00:05:29 ait sshd[869632]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.127.233 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.127.233
description:
Feb  6 00:05:29 ait sshd[869632]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.127.233


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.250
description:
Feb  6 00:06:27 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  6 00:06:27 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.98.157
description:
2025-02-06 00:06:51 dovecot_login authenticator failed for ([222.119.98.157]) [222.119.98.157]:47792: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.250
description:
2025-02-06 00:06:29 dovecot_login authenticator failed for (m121-202-154-250.smartone.com) [121.202.154.250]:29756: 535 Incorrect authentication data (set_id=mail@ait-edu.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.154.53.221
description:
2025-02-06 00:06:38 dovecot_login authenticator failed for ([101.230.251.217]) [180.154.53.221]:52484: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.227.178.69
description:
[2025-02-06 00:06:47 +0100] info [webmaild] 168.227.178.69 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.98.157
description:
Feb  6 00:06:49 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.98.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Feb  6 00:06:11 ait sshd[869969]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.154.53.221
description:
Feb  6 00:06:36 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.154.53.221 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.49.236.107
description:
[2025-02-06 00:06:15 +0100] info [webmaild] 179.49.236.107 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Feb  6 00:06:11 ait sshd[869969]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.240.121.228
description:
Feb  6 00:06:46 ait sshd[870193]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.240.121.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.240.121.228
description:
Feb  6 00:06:46 ait sshd[870193]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.240.121.228  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.248.243.181
description:
Feb  6 00:08:05 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.248.243.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
description:
2025-02-06 00:08:07 dovecot_plain authenticator failed for (tescreext) [41.248.243.181]:59492: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.232.91.119
description:
[2025-02-06 00:08:55 +0100] info [webmaild] 186.232.91.119 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.114.61.50
description:
Feb  6 00:08:01 ait sshd[870650]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.114.61.50 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.114.61.50
description:
Feb  6 00:08:01 ait sshd[870650]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.114.61.50  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.156.255.186
description:
2025-02-06 00:09:39 dovecot_plain authenticator failed for syn-098-156-255-186.res.spectrum.com [98.156.255.186]:54452: 535 Incorrect authentication data (set_id=sarpong-nsiah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.85.166.141
description:
[2025-02-06 00:09:43 +0100] info [webmaild] 177.85.166.141 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.110.161.134
description:
Feb  6 00:09:09 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.110.161.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.110.161.134
description:
2025-02-06 00:09:11 dovecot_plain authenticator failed for ([36.110.161.134]) [36.110.161.134]:32860: 535 Incorrect authentication data (set_id=sarpong-nsiah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.85.183.153
description:
[2025-02-06 00:09:24 +0100] info [webmaild] 177.85.183.153 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.156.255.186
description:
Feb  6 00:09:37 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.156.255.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.198.191.130
description:
Feb  6 00:10:29 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.198.191.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.130
description:
2025-02-06 00:10:31 dovecot_plain authenticator failed for ([119.198.191.130]) [119.198.191.130]:38280: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.99.64
description:
Feb  6 00:10:43 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.99.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.99.64
description:
2025-02-06 00:10:45 dovecot_plain authenticator failed for ([116.86.99.64]) [116.86.99.64]:35686: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 132.255.119.102
description:
[2025-02-06 00:10:17 +0100] info [webmaild] 132.255.119.102 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.6.38
description:
2025-02-06 00:11:43 dovecot_plain authenticator failed for 111-70-6-38.emome-ip.hinet.net [111.70.6.38]:56104: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.13.138.138
description:
Feb  6 00:11:47 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.13.138.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.13.138.138
description:
2025-02-06 00:11:49 dovecot_plain authenticator failed for (hn.kd.smx.adsl) [221.13.138.138]:57501: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.39.191.14
description:
Feb  6 00:11:18 ait sshd[871958]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.191.14


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.139.35.161
description:
Feb  6 00:11:26 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.139.35.161 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.99.32.98
description:
[2025-02-06 00:11:31 +0100] info [webmaild] 191.99.32.98 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.39.191.14
description:
Feb  6 00:11:18 ait sshd[871958]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.39.191.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.139.35.161
description:
2025-02-06 00:11:28 dovecot_plain authenticator failed for 161.sm-u1.dialup.garlic.net [216.139.35.161]:54992: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.6.38
description:
Feb  6 00:11:41 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.188.248.193
description:
2025-02-06 00:12:05 dovecot_plain authenticator failed for ([121.188.248.193]) [121.188.248.193]:51546: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.230.252.103
description:
Feb  6 00:12:29 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.230.252.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.230.252.103
description:
2025-02-06 00:12:31 dovecot_plain authenticator failed for ([183.230.252.103]) [183.230.252.103]:35158: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.152.108.61
description:
2025-02-06 00:12:42 dovecot_plain authenticator failed for syn-098-152-108-061.biz.spectrum.com [98.152.108.61]:37588: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.188.248.193
description:
Feb  6 00:12:03 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.188.248.193 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-12.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.104.125.204
description:
[2025-02-06 00:12:19 +0100] info [webmaild] 179.104.125.204 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.47.48.178
description:
2025-02-06 00:12:32 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:56596: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.152.108.61
description:
Feb  6 00:12:40 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.152.108.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.47.48.178
description:
Feb  6 00:12:30 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.47.48.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.104.199.251
description:
Feb  6 00:12:13 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.104.199.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.199.251
description:
2025-02-06 00:12:15 dovecot_plain authenticator failed for ([190.104.199.251]) [190.104.199.251]:44986: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.229.191.37
description:
[2025-02-06 00:12:53 +0100] info [webmaild] 103.229.191.37 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.51.239.42
description:
[2025-02-06 00:12:03 +0100] info [webmaild] 179.51.239.42 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.36.238.213
description:
2025-02-06 00:13:58 dovecot_login authenticator failed for ip213.ip-54-36-238.eu [54.36.238.213]:57708: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.40.72.101
description:
Feb  6 00:13:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.40.72.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.40.72.101
description:
2025-02-06 00:13:25 dovecot_plain authenticator failed for ([89.40.72.101]) [89.40.72.101]:58622: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.95.114.242
description:
Feb  6 00:13:37 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.95.114.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.114.242
description:
2025-02-06 00:13:39 dovecot_plain authenticator failed for (242.114.95.187.static.liggatelecom.com.br) [187.95.114.242]:46207: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.238.213
description:
Feb  6 00:13:56 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.238.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.117.92.118
description:
2025-02-06 00:14:54 dovecot_login authenticator failed for ([202.117.92.118]) [202.117.92.118]:60204: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.178.132
description:
Feb  6 00:14:05 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.178.132 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.233.111.138
description:
[2025-02-06 00:14:09 +0100] info [webmaild] 186.233.111.138 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.84.175
description:
2025-02-06 00:14:35 dovecot_plain authenticator failed for ([222.114.84.175]) [222.114.84.175]:54986: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.193.131
description:
2025-02-06 00:14:35 dovecot_login authenticator failed for ([5.26.193.131]) [5.26.193.131]:34116: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.117.92.118
description:
Feb  6 00:14:52 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.117.92.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.185.248.60
description:
[2025-02-06 00:14:39 +0100] info [webmaild] 177.185.248.60 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
description:
2025-02-06 00:14:39 dovecot_plain authenticator failed for ([185.255.212.178]) [185.255.212.178]:62537: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.178.132
description:
2025-02-06 00:14:07 dovecot_login authenticator failed for (132-178-53-194.mairnet.net) [194.53.178.132]:51772: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.180.129.87
description:
Feb  6 00:14:23 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.180.129.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.222.190.70
description:
Feb  6 00:14:46 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.222.190.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.222.190.70
description:
2025-02-06 00:14:48 dovecot_plain authenticator failed for (client.fttb.2day.kz) [176.222.190.70]:53426: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.77.34.6
description:
[2025-02-06 00:14:49 +0100] info [webmaild] 105.77.34.6 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
description:
2025-02-06 00:14:25 dovecot_login authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:47166: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.84.175
description:
Feb  6 00:14:33 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.84.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
description:
Feb  6 00:14:37 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.35.237.38
description:
Feb  6 00:15:11 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.35.237.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.47
description:
Feb  6 00:15:46 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.180
description:
Feb  6 00:15:04 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.58
description:
2025-02-06 00:15:21 dovecot_plain authenticator failed for 058.151.48.116.static.netvigator.com [116.48.151.58]:49567: 535 Incorrect authentication data (set_id=postmaster@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
description:
2025-02-06 00:15:30 dovecot_plain authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:37838: 535 Incorrect authentication data (set_id=postmaster@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  6 00:15:15 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.151.58
description:
Feb  6 00:15:19 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.151.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
description:
Feb  6 00:15:28 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
description:
2025-02-06 00:15:06 dovecot_login authenticator failed for ([102.53.15.180]) [102.53.15.180]:46613: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.36.30.49
description:
[2025-02-06 00:15:23 +0100] info [webmaild] 138.36.30.49 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.47
description:
2025-02-06 00:15:48 dovecot_plain authenticator failed for ([178.178.222.47]) [178.178.222.47]:42154: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.35.237.38
description:
2025-02-06 00:15:13 dovecot_plain authenticator failed for ([183.105.138.168]) [211.35.237.38]:47306: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
description:
Feb  6 00:16:44 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
description:
2025-02-06 00:16:46 dovecot_plain authenticator failed for ([103.174.34.49]) [103.174.34.49]:61515: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.88.152.182
description:
2025-02-06 00:16:48 dovecot_login authenticator failed for tdev152-182.codetel.net.do [200.88.152.182]:55947: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.38.202.60
description:
2025-02-06 00:16:53 dovecot_plain authenticator failed for ([136.38.202.60]) [136.38.202.60]:46471: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.66.113.58
description:
Feb  6 00:16:19 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.66.113.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.66.113.58
description:
2025-02-06 00:16:21 dovecot_plain authenticator failed for ([183.66.113.58]) [183.66.113.58]:53596: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.146.210.180
description:
2025-02-06 00:16:35 dovecot_plain authenticator failed for mail-02.03.perm.ru [46.146.210.180]:12500: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.67.143.142
description:
2025-02-06 00:16:41 dovecot_plain authenticator failed for (netcomafrica.com) [41.67.143.142]:50162: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.79
description:
2025-02-06 00:16:46 dovecot_plain authenticator failed for 079.42.246.220.static.netvigator.com [220.246.42.79]:55960: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 47.236.144.38
description:
Feb  6 00:16:35 ait sshd[873863]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.144.38


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.15.58.85
description:
[2025-02-06 00:16:45 +0100] info [webmaild] 157.15.58.85 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.149.203.183
description:
Feb  6 00:17:00 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.149.203.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.146.210.180
description:
Feb  6 00:16:33 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.146.210.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.188.248.193
description:
2025-02-06 00:16:39 dovecot_plain authenticator failed for ([121.188.248.193]) [121.188.248.193]:53814: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.67.143.142
description:
Feb  6 00:16:39 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.67.143.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.79
description:
Feb  6 00:16:44 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.188.248.193
description:
Feb  6 00:16:37 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.188.248.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.88.152.182
description:
Feb  6 00:16:46 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.88.152.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.38.202.60
description:
Feb  6 00:16:51 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.38.202.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.94.106
description:
2025-02-06 00:17:17 dovecot_login authenticator failed for ([60.191.94.106]) [60.191.94.106]:46892: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
description:
Feb  6 00:17:19 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.205.112.156
description:
Feb  6 00:17:22 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.205.112.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-02-06 00:17:21 dovecot_login authenticator failed for ([190.211.250.118]) [190.211.250.122]:44217: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.203.183
description:
2025-02-06 00:17:02 dovecot_plain authenticator failed for ([221.149.203.183]) [221.149.203.183]:55300: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.191.94.106
description:
Feb  6 00:17:15 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.191.94.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 74.123.48.224
description:
[2025-02-06 00:17:37 +0100] info [webmaild] 74.123.48.224 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.2.110
description:
Feb  6 00:17:06 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.2.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.2.110
description:
2025-02-06 00:17:08 dovecot_login authenticator failed for ([187.12.2.110]) [187.12.2.110]:54453: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.205.112.156
description:
2025-02-06 00:17:24 dovecot_login authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:23280: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.188.204.213
description:
Feb  6 00:17:08 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.188.204.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
description:
2025-02-06 00:17:10 dovecot_login authenticator failed for ([50.188.204.213]) [50.188.204.213]:45862: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.0.74.101
description:
[2025-02-06 00:17:13 +0100] info [webmaild] 170.0.74.101 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.20.111.164
description:
Feb  6 00:17:05 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.20.111.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.111.164
description:
2025-02-06 00:17:07 dovecot_login authenticator failed for ([38.20.111.164]) [38.20.111.164]:45666: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.205.203.246
description:
Feb  6 00:18:12 ait sshd[874632]: pam_imunify(sshd:auth): [IM360_RBL] The IP 172.205.203.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 172.205.203.246
description:
Feb  6 00:18:12 ait sshd[874632]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.205.203.246  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.115.88.130
description:
[2025-02-06 00:18:13 +0100] info [webmaild] 190.115.88.130 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Feb  6 00:18:40 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-02-06 00:18:42 dovecot_plain authenticator failed for ([128.106.196.150]) [128.106.196.150]:42449: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.153.108
description:
Feb  6 00:19:01 ait sshd[875035]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.12.153.108 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.12.153.108
description:
Feb  6 00:19:01 ait sshd[875035]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.153.108


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.13.20.22
description:
[2025-02-06 00:19:37 +0100] info [webmaild] 191.13.20.22 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.71.173.250
description:
2025-02-06 00:19:50 dovecot_login authenticator failed for ([14.97.7.138]) [182.71.173.250]:42110: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.74.138.200
description:
2025-02-06 00:19:07 dovecot_plain authenticator failed for ([41.74.138.200]) [41.74.138.200]:55833: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.138.200
description:
Feb  6 00:19:05 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.138.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.146.210
description:
2025-02-06 00:19:37 dovecot_login authenticator failed for ([122.227.146.210]) [122.227.146.210]:58934: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.43.144.63
description:
Feb  6 00:19:45 ait sshd[875376]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.43.144.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.71.173.250
description:
Feb  6 00:19:48 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.71.173.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.230.206.236
description:
[2025-02-06 00:19:52 +0100] info [webmaild] 185.230.206.236 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.146.210
description:
Feb  6 00:19:35 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.146.210 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.43.144.63
description:
Feb  6 00:19:45 ait sshd[875376]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.43.144.63  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.190.157.131
country_id: 3996063
description:
[2025-02-06 00:21:54 +0100] info [webmaild] 187.190.157.131 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.99.10.255
country_id: 6252001
description:
Feb  6 00:21:35 ait sshd[879519]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.10.255


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.38.130
country_id: 1814991
description:
2025-02-06 00:21:37 dovecot_plain authenticator failed for (130.38.212.118.adsl-pool.jx.chinaunicom.com) [118.212.38.130]:37976: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.212.38.130
country_id: 1814991
description:
Feb  6 00:21:35 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.212.38.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.10.255
country_id: 6252001
description:
Feb  6 00:21:35 ait sshd[879519]: pam_imunify(sshd:auth): [IM360_RBL] The IP 167.99.10.255 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.177.38.117
country_id: 290557
description:
[2025-02-06 00:22:48 +0100] info [webmaild] 109.177.38.117 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.56.0.143
country_id: 3469034
description:
[2025-02-06 00:23:24 +0100] info [webmaild] 187.56.0.143 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.148.98.44
country_id: 3469034
description:
[2025-02-06 00:22:30 +0100] info [webmaild] 200.148.98.44 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.76.250.194
country_id: 1269750
description:
Feb  6 00:24:04 ait sshd[882704]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.76.250.194 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 00:24:05 ait sshd[882763]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.96.43.215
country_id: 1562822
description:
Feb  6 00:24:07 ait sshd[882766]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.43.215  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.57.217.38
country_id: 1643084
description:
Feb  6 00:24:10 ait sshd[882783]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.57.217.38  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.24.154.232
country_id: 2510769
description:
Feb  6 00:24:11 ait sshd[882801]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.24.154.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.42.104.163
country_id: 1527747
description:
Feb  6 00:24:22 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.42.104.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.42.104.163
country_id: 1527747
description:
2025-02-06 00:24:24 dovecot_plain authenticator failed for (212-42-104-163.static.elcat.kg) [212.42.104.163]:44018: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.76.250.194
country_id: 1269750
description:
Feb  6 00:24:04 ait sshd[882704]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.250.194


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.57.217.38
country_id: 1643084
description:
Feb  6 00:24:10 ait sshd[882783]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.57.217.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.180.0
country_id: 1269750
description:
Feb  6 00:24:16 ait sshd[882813]: pam_imunify(sshd:auth): [IM360_RBL] The IP 143.110.180.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 00:24:05 ait sshd[882763]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 104.28.202.179
country_id: 6252001
domain: elibrary.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ENG23A00071Y||WPU:ENG23A00071Y||RSV:6.65||T:APACHE||MV:00-24.104.28.202.179


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.24.154.232
country_id: 2510769
description:
Feb  6 00:24:11 ait sshd[882801]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.24.154.232  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 143.110.180.0
country_id: 1269750
description:
Feb  6 00:24:16 ait sshd[882813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.110.180.0  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.96.43.215
country_id: 1562822
description:
Feb  6 00:24:07 ait sshd[882766]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.96.43.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.52
country_id: 2017370
description:
Feb  6 00:24:31 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.205.48.62
country_id: 6252001
description:
Feb  6 00:24:52 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.205.48.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
country_id: 2264397
description:
2025-02-06 00:25:07 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:40124: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.125.152
country_id: 1880251
description:
47.128.125.152 - - [06/Feb/2025:00:25:07 +0100] "GET /wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.css?ver=5.15.3 HTTP/2.0" 200 1602 elibrary.ait-edu.us "https://elibrary.ait-edu.us/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=14646581" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"1" PEER:47.128.125.152


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.134.110
country_id: 1814991
description:
Feb  6 00:24:30 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.134.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
country_id: 2264397
description:
Feb  6 00:25:05 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.82
country_id: 1814991
description:
2025-02-06 00:25:16 dovecot_plain authenticator failed for ([183.249.1.82]) [183.249.1.82]:52501: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.52
country_id: 2017370
description:
2025-02-06 00:24:33 dovecot_plain authenticator failed for ([178.178.222.52]) [178.178.222.52]:41082: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.132.43.94
country_id: 1814991
description:
2025-02-06 00:24:50 dovecot_plain authenticator failed for ([116.132.43.94]) [116.132.43.94]:31528: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.37
country_id: 192950
description:
2025-02-06 00:24:54 dovecot_login authenticator failed for ([102.215.188.37]) [102.215.188.37]:54602: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.82
country_id: 1814991
description:
Feb  6 00:25:14 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.134.110
country_id: 1814991
description:
2025-02-06 00:24:32 dovecot_login authenticator failed for ([61.143.134.110]) [61.143.134.110]:51696: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.19.117
country_id: 1835841
description:
2025-02-06 00:24:34 dovecot_login authenticator failed for ([222.116.19.117]) [222.116.19.117]:57640: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.107.213.99
country_id: 3469034
description:
[2025-02-06 00:24:36 +0100] info [webmaild] 179.107.213.99 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.132.43.94
country_id: 1814991
description:
Feb  6 00:24:48 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.132.43.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.215.188.37
country_id: 192950
description:
Feb  6 00:24:52 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.215.188.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.205.48.62
country_id: 6252001
description:
2025-02-06 00:24:54 dovecot_login authenticator failed for 47-205-48-62.tamp.fl.frontiernet.net [47.205.48.62]:47454: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.35.131.230
country_id: 3469034
description:
[2025-02-06 00:25:06 +0100] info [webmaild] 177.35.131.230 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.162.16.2
country_id: 6252001
description:
Feb  6 00:25:12 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.162.16.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.116.19.117
country_id: 1835841
description:
Feb  6 00:24:32 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.116.19.117 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.154.91.8
country_id: 3469034
description:
[2025-02-06 00:25:27 +0100] info [webmaild] 177.154.91.8 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.162.16.2
country_id: 6252001
description:
2025-02-06 00:25:14 dovecot_login authenticator failed for syn-024-162-016-002.res.spectrum.com [24.162.16.2]:43081: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.159.57.4
country_id: 1814991
description:
Feb  6 00:25:33 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.159.57.4 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.241.50.241
country_id: 3996063
description:
[2025-02-06 00:26:02 +0100] info [webmaild] 177.241.50.241 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
description:
Feb  6 00:26:18 ait sshd[883692]: Connection reset by invalid user admin 178.175.142.134 port 62981 [preauth]


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.175.142.134
country_id: 617790
description:
Feb  6 00:26:14 ait sshd[883692]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.175.142.134


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.251.202.80
country_id: 1835841
description:
Feb  6 00:25:35 ait sshd[883609]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.251.202.80


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.57.4
country_id: 1814991
description:
2025-02-06 00:25:35 dovecot_plain authenticator failed for ([219.159.57.4]) [219.159.57.4]:44284: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.174.45
country_id: 2017370
description:
Feb  6 00:25:38 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.174.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.174.45
country_id: 2017370
description:
2025-02-06 00:25:40 dovecot_plain authenticator failed for ([37.204.174.45]) [37.204.174.45]:55600: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
country_id: 1814991
description:
Feb  6 00:25:49 ait auth[796985]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.7.52.183
country_id: 1814991
description:
2025-02-06 00:25:51 dovecot_plain authenticator failed for ([110.7.52.183]) [110.7.52.183]:58756: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.188.80
country_id: 1835841
description:
Feb  6 00:27:06 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.205.188.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.167.35
country_id: 6252001
description:
Feb  6 00:27:08 ait sshd[883966]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.178.167.35 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.178.167.35
country_id: 6252001
description:
Feb  6 00:27:08 ait sshd[883966]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.178.167.35


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.222.71.146
country_id: 3625428
description:
[2025-02-06 00:27:08 +0100] info [webmaild] 38.222.71.146 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
country_id: 1880251
description:
2025-02-06 00:27:29 dovecot_plain authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:43050: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.205.188.80
country_id: 1835841
description:
2025-02-06 00:27:08 dovecot_plain authenticator failed for ([119.205.188.80]) [119.205.188.80]:39132: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
country_id: 1880251
description:
Feb  6 00:27:27 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 00:27:54 ait sshd[884263]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
country_id: 6252001
description:
2025-02-06 00:28:13 dovecot_plain authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:43414: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2025-02-06 00:27:32 dovecot_plain authenticator failed for ([221.199.172.66]) [221.199.172.66]:33650: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.87.112.43
country_id: 3469034
description:
[2025-02-06 00:27:38 +0100] info [webmaild] 187.87.112.43 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.121.199.203
country_id: 6252001
description:
Feb  6 00:28:11 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.121.199.203 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.24.170.152
country_id: 3439705
description:
[2025-02-06 00:28:05 +0100] info [webmaild] 179.24.170.152 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.199.172.66
country_id: 1814991
description:
Feb  6 00:27:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.199.172.66 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-27.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.125.14.122
country_id: 3439705
description:
2025-02-06 00:27:46 dovecot_plain authenticator failed for (r200-125-14-122.ae-static.anteldata.net.uy) [200.125.14.122]:58699: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 00:27:54 ait sshd[884263]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.125.14.122
country_id: 3439705
description:
Feb  6 00:27:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.125.14.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.255.106
country_id: 1814991
description:
2025-02-06 00:29:16 dovecot_plain authenticator failed for ([116.113.255.106]) [116.113.255.106]:48941: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.55.177.39
country_id: 1835841
description:
Feb  6 00:28:36 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.55.177.39 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 110.44.115.138
country_id: 1282988
description:
[2025-02-06 00:28:39 +0100] info [webmaild] 110.44.115.138 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 00:29:05 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.255.106
country_id: 1814991
description:
Feb  6 00:29:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.255.106 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.127.233
country_id: 1814991
description:
Feb  6 00:29:01 ait sshd[885126]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.127.233


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.183.167.41
country_id: 1605651
description:
Feb  6 00:29:18 ait sshd[885211]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.183.167.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.202.71.21
country_id: 1835841
description:
Feb  6 00:29:29 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.202.71.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.55.177.39
country_id: 1835841
description:
2025-02-06 00:28:38 dovecot_plain authenticator failed for ([218.55.177.39]) [218.55.177.39]:35938: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.183.167.41
country_id: 1605651
description:
Feb  6 00:29:18 ait sshd[885211]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.183.167.41


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.127.233
country_id: 1814991
description:
Feb  6 00:29:01 ait sshd[885126]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.127.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.131.163.41
country_id: 6252001
description:
Feb  6 00:29:46 ait sshd[885395]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.131.163.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 140.246.52.32
country_id: 1814991
description:
Feb  6 00:30:18 ait sshd[885653]: pam_imunify(sshd:auth): [IM360_RBL] The IP 140.246.52.32 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 140.246.52.32
country_id: 1814991
description:
Feb  6 00:30:18 ait sshd[885653]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.246.52.32  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.221.13.60
country_id: 3469034
description:
[2025-02-06 00:30:17 +0100] info [webmaild] 177.221.13.60 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.202.71.21
country_id: 1835841
description:
2025-02-06 00:29:31 dovecot_plain authenticator failed for ([211.202.71.21]) [211.202.71.21]:47734: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.131.163.41
country_id: 6252001
description:
Feb  6 00:29:46 ait sshd[885395]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.163.41


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.95.108.57
country_id: 3469034
description:
[2025-02-06 00:29:48 +0100] info [webmaild] 187.95.108.57 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
country_id: 1835841
description:
Feb  6 00:31:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.227.217.61
country_id: 3865483
description:
[2025-02-06 00:31:24 +0100] info [webmaild] 45.227.217.61 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.245.102
country_id: 1835841
description:
2025-02-06 00:30:36 dovecot_plain authenticator failed for ([175.203.245.102]) [175.203.245.102]:51328: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.45.216.101
country_id: 6252001
description:
Feb  6 00:30:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.45.216.101 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 206.62.166.202
country_id: 3625428
description:
[2025-02-06 00:30:48 +0100] info [webmaild] 206.62.166.202 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.32.11.3
country_id: 1814991
description:
Feb  6 00:30:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.32.11.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.32.11.3
country_id: 1814991
description:
2025-02-06 00:30:54 dovecot_plain authenticator failed for ([119.32.11.3]) [119.32.11.3]:35328: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.35.109.214
country_id: 1814991
description:
2025-02-06 00:31:11 dovecot_plain authenticator failed for ([125.35.109.214]) [125.35.109.214]:48436: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
country_id: 1269750
description:
Feb  6 00:31:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.203.245.102
country_id: 1835841
description:
Feb  6 00:30:34 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.203.245.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.200.202
country_id: 2921044
description:
2025-02-06 00:31:24 dovecot_plain authenticator failed for ([159.223.250.131]) [161.35.200.202]:37642: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2025-02-06 00:31:02 dovecot_plain authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:51793: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.35.200.202
country_id: 2921044
description:
Feb  6 00:31:22 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.35.200.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.10.221.104
country_id: 1814991
description:
Feb  6 00:31:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.10.221.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.221.104
country_id: 1814991
description:
2025-02-06 00:31:25 dovecot_plain authenticator failed for ([221.10.221.104]) [221.10.221.104]:45647: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.45.216.101
country_id: 6252001
description:
2025-02-06 00:30:48 dovecot_plain authenticator failed for c-73-45-216-101.hsd1.il.comcast.net [73.45.216.101]:51438: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.152
country_id: 1269750
description:
Feb  6 00:31:00 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
country_id: 1835841
description:
2025-02-06 00:31:06 dovecot_plain authenticator failed for ([203.128.181.121]) [203.128.181.121]:50737: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.35.109.214
country_id: 1814991
description:
Feb  6 00:31:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.35.109.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.104.245
country_id: 3469034
description:
Feb  6 00:31:13 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.104.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.104.245
country_id: 3469034
description:
2025-02-06 00:31:15 dovecot_plain authenticator failed for ([179.125.104.245]) [179.125.104.245]:56309: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
country_id: 1269750
description:
2025-02-06 00:31:17 dovecot_plain authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:50160: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.1.210
country_id: 1814991
description:
Feb  6 00:30:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.1.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.1.210
country_id: 1814991
description:
2025-02-06 00:30:37 dovecot_plain authenticator failed for ([60.172.1.210]) [60.172.1.210]:54028: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 140.246.52.32
country_id: 1814991
description:
Feb  6 00:32:25 ait sshd[886437]: pam_imunify(sshd:auth): [IM360_RBL] The IP 140.246.52.32 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 140.246.52.32
country_id: 1814991
description:
Feb  6 00:32:25 ait sshd[886437]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.246.52.32  user=rpc


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.35
country_id: 1835841
description:
Feb  6 00:31:32 ait sshd[886104]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.35 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.35
country_id: 1835841
description:
Feb  6 00:31:32 ait sshd[886104]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.35


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.176.114.20
country_id: 3469034
description:
[2025-02-06 00:32:15 +0100] info [webmaild] 45.176.114.20 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.161.242.146
country_id: 1814991
description:
Feb  6 00:33:08 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.161.242.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.161.242.146
country_id: 1814991
description:
2025-02-06 00:33:10 dovecot_plain authenticator failed for (146.242.161.222.adsl-pool.jlccptt.net.cn) [222.161.242.146]:13642: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.220.168.116
country_id: 2017370
description:
Feb  6 00:33:26 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.220.168.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.13.2
country_id: 1814991
description:
2025-02-06 00:32:58 dovecot_plain authenticator failed for ([183.236.13.2]) [183.236.13.2]:54494: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.85.193.28
country_id: 3469034
description:
[2025-02-06 00:33:19 +0100] info [webmaild] 177.85.193.28 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.13.2
country_id: 1814991
description:
Feb  6 00:32:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.13.2 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.93
country_id: 1880251
description:
47.128.121.93 - - [06/Feb/2025:00:33:03 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10205465 HTTP/2.0" 302 0 elibrary.ait-edu.us "https://elibrary.ait-edu.us/ebook/algebraic-equations-of-arbitrary-degree-little-mathematics-library/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.93


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.69.155.128
country_id: 290291
description:
[2025-02-06 00:32:44 +0100] info [webmaild] 77.69.155.128 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.33.162
country_id: 1814991
description:
2025-02-06 00:33:59 dovecot_plain authenticator failed for ([183.237.33.162]) [183.237.33.162]:62808: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.31.47.232
country_id: 6252001
description:
2025-02-06 00:34:06 dovecot_plain authenticator failed for syn-065-031-047-232.res.spectrum.com [65.31.47.232]:56284: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.252
country_id: 1814991
description:
Feb  6 00:33:31 ait sshd[886963]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.100.105.194
country_id: 2750405
description:
2025-02-06 00:33:46 dovecot_plain authenticator failed for d96469c2.static.ziggozakelijk.nl ([217.100.105.195]) [217.100.105.194]:56723: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.252
country_id: 1814991
description:
Feb  6 00:33:54 ait sshd[886963]: error: maximum authentication attempts exceeded for root from 218.92.0.252 port 51816 ssh2 [preauth]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.236.91.93
country_id: 1814991
description:
Feb  6 00:33:29 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.236.91.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 140.246.52.32
country_id: 1814991
description:
Feb  6 00:33:53 ait sshd[887162]: pam_imunify(sshd:auth): [IM360_RBL] The IP 140.246.52.32 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 84.22.115.60
country_id: 2750405
description:
Feb  6 00:34:01 ait sshd[887255]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.22.115.60  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.236.91.93
country_id: 1814991
description:
2025-02-06 00:33:31 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [42.236.91.93]:39358: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.100.105.194
country_id: 2750405
description:
Feb  6 00:33:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.100.105.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.33.162
country_id: 1814991
description:
Feb  6 00:33:57 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.33.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.178.186.132
country_id: 1210997
description:
[2025-02-06 00:33:53 +0100] info [webmaild] 103.178.186.132 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.193.187.154
country_id: 1269750
description:
Feb  6 00:34:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.193.187.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2025-02-06 00:34:11 dovecot_plain authenticator failed for ([113.193.187.154]) [113.193.187.154]:53106: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.223.203
country_id: 1835841
description:
Feb  6 00:34:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.223.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.223.203
country_id: 1835841
description:
2025-02-06 00:34:25 dovecot_plain authenticator failed for ([210.99.223.203]) [210.99.223.203]:43934: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.220.168.116
country_id: 2017370
description:
2025-02-06 00:33:28 dovecot_plain authenticator failed for ([31.220.168.116]) [31.220.168.116]:48453: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.22.115.60
country_id: 2750405
description:
Feb  6 00:34:01 ait sshd[887255]: pam_imunify(sshd:auth): [IM360_RBL] The IP 84.22.115.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.31.47.232
country_id: 6252001
description:
Feb  6 00:34:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.31.47.232 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.252
country_id: 1814991
description:
Feb  6 00:33:31 ait sshd[886963]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.252  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 140.246.52.32
country_id: 1814991
description:
Feb  6 00:33:53 ait sshd[887162]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.246.52.32


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.68.37.25
country_id: 2661886
description:
Feb  6 00:35:17 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.68.37.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2025-02-06 00:35:19 dovecot_plain authenticator failed for 78-68-37-25-no2560.tbcn.telia.com (mogralings) [78.68.37.25]:39483: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.192.162.98
country_id: 3624060
description:
[2025-02-06 00:35:23 +0100] info [webmaild] 201.192.162.98 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 00:34:32 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.172.95.127
country_id: 587116
description:
[2025-02-06 00:34:54 +0100] info [webmaild] 213.172.95.127 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.106.172.226
country_id: 6252001
description:
2025-02-06 00:36:05 dovecot_login authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:56336: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.131
country_id: 2017370
description:
Feb  6 00:36:20 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.199.209.60
country_id: 1269750
description:
Feb  6 00:35:32 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.199.209.60 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.221.101.111
country_id: 3144096
description:
Feb  6 00:35:51 ait sshd[887948]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.221.101.111  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.75.233
country_id: 1819730
description:
2025-02-06 00:36:21 dovecot_plain authenticator failed for 42-200-75-233.static.imsbiz.com [42.200.75.233]:49606: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.28.77.206
country_id: 1814991
description:
Feb  6 00:36:22 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.28.77.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.205
country_id: 1835841
description:
Feb  6 00:35:45 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.75.233
country_id: 1819730
description:
Feb  6 00:36:19 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.75.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.140.176.170
country_id: 1814991
description:
Feb  6 00:36:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.140.176.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.77.206
country_id: 1814991
description:
2025-02-06 00:36:24 dovecot_plain authenticator failed for (pc0.zz.ha.cn) [218.28.77.206]:47536: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.140.176.170
country_id: 1814991
description:
2025-02-06 00:36:25 dovecot_plain authenticator failed for ([219.140.176.170]) [219.140.176.170]:33411: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.6.38
country_id: 1668284
description:
2025-02-06 00:36:25 dovecot_plain authenticator failed for 111-70-6-38.emome-ip.hinet.net [111.70.6.38]:39642: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.106.172.226
country_id: 6252001
description:
Feb  6 00:36:03 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.106.172.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.135
country_id: 2017370
description:
2025-02-06 00:36:24 dovecot_plain authenticator failed for ([178.178.194.135]) [178.178.194.135]:52394: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.13
country_id: 1819730
description:
Feb  6 00:35:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.13 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.113.3.87
country_id: 1269750
description:
Feb  6 00:36:13 ait sshd[888060]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.113.3.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
country_id: 1819730
description:
2025-02-06 00:35:52 dovecot_login authenticator failed for (m121-202-152-13.smartone.com) [121.202.152.13]:23222: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.113.3.87
country_id: 1269750
description:
Feb  6 00:36:13 ait sshd[888060]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.113.3.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.6.38
country_id: 1668284
description:
Feb  6 00:36:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.131
country_id: 2017370
description:
2025-02-06 00:36:22 dovecot_plain authenticator failed for ([178.178.194.131]) [178.178.194.131]:55942: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.229.51.205
country_id: 1835841
description:
2025-02-06 00:35:47 dovecot_plain authenticator failed for ([58.229.51.205]) [58.229.51.205]:57572: 535 Incorrect authentication data (set_id=eng19b00159y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 23.137.129.118
country_id: 6252001
description:
[2025-02-06 00:35:52 +0100] info [webmaild] 23.137.129.118 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.199.209.60
country_id: 1269750
description:
2025-02-06 00:35:34 dovecot_plain authenticator failed for (ws60-209.199.103.rcil.gov.in) [103.199.209.60]:59416: 535 Incorrect authentication data (set_id=eng19b00159y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.221.101.111
country_id: 3144096
description:
Feb  6 00:35:51 ait sshd[887948]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.221.101.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.135
country_id: 2017370
description:
Feb  6 00:36:22 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.135 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.60.64.250
country_id: 3895114
description:
[2025-02-06 00:36:26 +0100] info [webmaild] 179.60.64.250 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.45.101.159
country_id: 1835841
description:
Feb  6 00:36:36 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.45.101.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2025-02-06 00:36:38 dovecot_plain authenticator failed for ([118.45.101.159]) [118.45.101.159]:48205: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
country_id: 2921044
description:
2025-02-06 00:37:06 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (tatate) [91.56.31.167]:62957: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-02-06 00:37:14 dovecot_plain authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:41454: 535 Incorrect authentication data (set_id=ads09a99049y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.234.104.42
country_id: 1835841
description:
Feb  6 00:37:24 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.234.104.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.170.255.126
country_id: 1814991
description:
Feb  6 00:36:31 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.170.255.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.104.180
country_id: 1814991
description:
2025-02-06 00:36:40 dovecot_plain authenticator failed for ([218.94.104.181]) [218.94.104.180]:44420: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 00:37:06 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.109.253.156
country_id: 6252001
description:
Feb  6 00:36:34 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.109.253.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.109.37
country_id: 1210997
description:
Feb  6 00:36:37 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.245.109.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
country_id: 2921044
description:
Feb  6 00:37:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.248.7
country_id: 1861060
description:
Feb  6 00:37:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.196.214
country_id: 6252001
description:
Feb  6 00:37:21 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.196.214 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.118.113.1
country_id: 2542007
description:
[2025-02-06 00:37:22 +0100] info [webmaild] 196.118.113.1 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
country_id: 6252001
description:
2025-02-06 00:37:23 dovecot_plain authenticator failed for syn-208-105-196-214.biz.spectrum.com (rrcs-208-105-196-214.nys.biz.rr.com) [208.105.196.214]:39689: 535 Incorrect authentication data (set_id=abs20a00063y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2025-02-06 00:37:11 dovecot_plain authenticator failed for ([196.28.226.125]) [196.28.226.125]:47366: 535 Incorrect authentication data (set_id=abs20a00063y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
country_id: 1814991
description:
Feb  6 00:37:19 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.101.36.159
country_id: 2963597
description:
Feb  6 00:36:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.101.36.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-02-06 00:36:32 dovecot_plain authenticator failed for ([89.101.36.159]) [89.101.36.159]:42276: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.170.255.126
country_id: 1814991
description:
2025-02-06 00:36:33 dovecot_plain authenticator failed for ([222.170.255.126]) [222.170.255.126]:51052: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.104.180
country_id: 1814991
description:
Feb  6 00:36:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.104.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.245.109.37
country_id: 1210997
description:
2025-02-06 00:36:39 dovecot_plain authenticator failed for ([103.245.109.37]) [103.245.109.37]:42074: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.125
country_id: 1036973
description:
Feb  6 00:37:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.109.253.156
country_id: 6252001
description:
2025-02-06 00:36:36 dovecot_plain authenticator failed for ([172.109.253.156]) [172.109.253.156]:45492: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
country_id: 3469034
description:
Feb  6 00:36:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
country_id: 3469034
description:
2025-02-06 00:36:46 dovecot_plain authenticator failed for (Bundle-Ether3.2581.static.gvt.net.br) [177.43.106.73]:39225: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
country_id: 1814991
description:
2025-02-06 00:37:21 dovecot_plain authenticator failed for ([61.153.208.38]) [61.153.208.38]:22481: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.234.104.42
country_id: 1835841
description:
2025-02-06 00:37:26 dovecot_plain authenticator failed for ([218.234.104.42]) [218.234.104.42]:42295: 535 Incorrect authentication data (set_id=ads09a99049y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
country_id: 1861060
description:
2025-02-06 00:38:05 dovecot_plain authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:50446: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.59.174
country_id: 1835841
description:
2025-02-06 00:38:11 dovecot_plain authenticator failed for ([222.236.59.174]) [222.236.59.174]:44833: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.184.143.93
country_id: 1814991
description:
Feb  6 00:38:16 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.184.143.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.2.172
country_id: 2017370
description:
2025-02-06 00:38:16 dovecot_plain authenticator failed for ([31.173.2.172]) [31.173.2.172]:47778: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.254.44.30
country_id: 597427
description:
Feb  6 00:37:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.254.44.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.145.163.164
country_id: 1814991
description:
Feb  6 00:37:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.145.163.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.11
country_id: 1819730
description:
2025-02-06 00:37:48 dovecot_plain authenticator failed for (m121-202-205-11.smartone.com) [121.202.205.11]:23075: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.11.25.195
country_id: 6252001
description:
2025-02-06 00:38:03 dovecot_plain authenticator failed for ([66.11.25.195]) [66.11.25.195]:51432: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.106.67.50
country_id: 6252001
description:
Feb  6 00:37:53 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.106.67.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.115.211
country_id: 1880251
description:
2025-02-06 00:37:52 dovecot_plain authenticator failed for (211.115.156.175.unknown.m1.com.sg) [175.156.115.211]:50220: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.255.221
country_id: 1835841
description:
Feb  6 00:38:00 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.255.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.90.72.14
country_id: 1814991
description:
2025-02-06 00:38:11 dovecot_plain authenticator failed for ([125.90.72.14]) [125.90.72.14]:35138: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.122.202
country_id: 294640
description:
Feb  6 00:37:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.122.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.227.203
country_id: 1562822
description:
2025-02-06 00:38:01 dovecot_plain authenticator failed for ([118.70.227.203]) [118.70.227.203]:42593: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.104.122.159
country_id: 6251999
description:
2025-02-06 00:38:09 dovecot_plain authenticator failed for host-216-104-122-159.public.eastlink.ca [216.104.122.159]:60322: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.223.176.171
country_id: 6252001
description:
Feb  6 00:38:17 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.223.176.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.113
country_id: 1269750
description:
Feb  6 00:37:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.19.80.138
country_id: 6252001
description:
Feb  6 00:37:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.19.80.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.12.14
country_id: 2017370
description:
Feb  6 00:37:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.12.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.113
country_id: 1269750
description:
2025-02-06 00:37:48 dovecot_plain authenticator failed for ([103.190.91.113]) [103.190.91.113]:42371: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-02-06 00:38:19 dovecot_plain authenticator failed for ([50.223.176.171]) [50.223.176.171]:57346: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
country_id: 3469034
description:
2025-02-06 00:38:24 dovecot_plain authenticator failed for ([186.200.249.162]) [186.200.249.162]:36634: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.216.5.134
country_id: 1814991
description:
2025-02-06 00:37:50 dovecot_plain authenticator failed for ([114.216.5.134]) [114.216.5.134]:37800: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.117.0.253
country_id: 1835841
description:
Feb  6 00:38:00 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.117.0.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.60.194.189
country_id: 2510769
description:
2025-02-06 00:38:12 dovecot_plain authenticator failed for 81.60.194.189.dyn.user.ono.com [81.60.194.189]:48927: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.232.39.165
country_id: 2510769
description:
Feb  6 00:38:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.232.39.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.2.172
country_id: 2017370
description:
Feb  6 00:38:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.2.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.129.92
country_id: 1814991
description:
Feb  6 00:38:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.129.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.195.104
country_id: 1269750
description:
Feb  6 00:37:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.187.195.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
country_id: 1168579
description:
Feb  6 00:37:54 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.146.121.12
country_id: 1814991
description:
Feb  6 00:37:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.146.121.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.179
country_id: 1819730
description:
Feb  6 00:38:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.152.225.58
country_id: 3175395
description:
2025-02-06 00:37:46 dovecot_plain authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:52689: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-02-06 00:37:49 dovecot_plain authenticator failed for ([103.174.34.49]) [103.174.34.49]:61549: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.218.134.95
country_id: 6252001
description:
2025-02-06 00:37:52 dovecot_plain authenticator failed for 32-218-134-95.bng02.trtn.ct.frontiernet.net [32.218.134.95]:58390: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.239.187.13
country_id: 1819730
description:
2025-02-06 00:38:10 dovecot_plain authenticator failed for ([20.239.187.13]) [20.239.187.13]:42438: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.42.163.252
country_id: 660013
description:
2025-02-06 00:38:00 dovecot_plain authenticator failed for ([185.42.163.252]) [185.42.163.252]:49976: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.238.206
country_id: 2017370
description:
Feb  6 00:38:02 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.238.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.15.67
country_id: 1814991
description:
2025-02-06 00:38:02 dovecot_plain authenticator failed for ([120.224.15.67]) [120.224.15.67]:25726: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.184.58
country_id: 1814991
description:
2025-02-06 00:38:02 dovecot_plain authenticator failed for ([120.237.184.58]) [120.237.184.58]:38286: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.0.3
country_id: 3469034
description:
2025-02-06 00:38:13 dovecot_plain authenticator failed for ([177.174.0.3]) [177.174.0.3]:51565: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.185.225.50
country_id: 1814991
description:
2025-02-06 00:37:50 dovecot_plain authenticator failed for ([220.185.225.50]) [220.185.225.50]:41090: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.152.99.171
country_id: 6252001
description:
Feb  6 00:37:54 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.152.99.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.200.216.246
country_id: 1814991
description:
Feb  6 00:38:00 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.200.216.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.11.25.195
country_id: 6252001
description:
Feb  6 00:38:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.11.25.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.15.177.173
country_id: 1814991
description:
2025-02-06 00:38:19 dovecot_plain authenticator failed for ([121.15.177.173]) [121.15.177.173]:51700: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.254.136.116
country_id: 3017382
description:
Feb  6 00:37:30 ait sshd[888511]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.136.116


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.11
country_id: 1819730
description:
Feb  6 00:37:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.185.225.50
country_id: 1814991
description:
Feb  6 00:37:48 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.185.225.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.114.206
country_id: 1814991
description:
2025-02-06 00:37:55 dovecot_plain authenticator failed for ([39.152.114.206]) [39.152.114.206]:25434: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
country_id: 1835841
description:
2025-02-06 00:38:02 dovecot_plain authenticator failed for ([222.117.0.253]) [222.117.0.253]:39357: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.179
country_id: 1819730
description:
2025-02-06 00:38:16 dovecot_plain authenticator failed for (m121-202-153-179.smartone.com) [121.202.153.179]:28143: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.129.92
country_id: 1814991
description:
2025-02-06 00:38:17 dovecot_plain authenticator failed for ([111.53.129.92]) [111.53.129.92]:34448: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.1.154
country_id: 1819730
description:
Feb  6 00:38:20 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.1.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.90.43
country_id: 1814991
description:
2025-02-06 00:37:50 dovecot_plain authenticator failed for ([39.174.90.48]) [39.174.90.43]:58929: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.206.7.126
country_id: 1814991
description:
Feb  6 00:37:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.206.7.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.121
country_id: 617790
description:
Feb  6 00:38:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.68.208
country_id: 1835841
description:
Feb  6 00:38:03 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.125.68.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
country_id: 3469034
description:
Feb  6 00:38:22 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.235.25.35
country_id: 1527747
description:
Feb  6 00:37:34 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.235.25.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.232.39.165
country_id: 2510769
description:
2025-02-06 00:38:06 dovecot_plain authenticator failed for ([185.232.39.165]) [185.232.39.165]:43329: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.0.3
country_id: 3469034
description:
Feb  6 00:38:11 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.0.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.136.192.106
country_id: 1733045
description:
Feb  6 00:38:16 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.136.192.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.184.143.93
country_id: 1814991
description:
2025-02-06 00:38:18 dovecot_plain authenticator failed for ([39.184.143.93]) [39.184.143.93]:55327: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.93.198.164
country_id: 1814991
description:
Feb  6 00:37:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.93.198.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.196.67
country_id: 2510769
description:
Feb  6 00:37:53 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.126.196.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.190.147.29
country_id: 6252001
description:
2025-02-06 00:38:01 dovecot_plain authenticator failed for static-47-190-147-29.dlls.tx.frontiernet.net [47.190.147.29]:55968: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.60.194.189
country_id: 2510769
description:
Feb  6 00:38:10 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.60.194.189 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.106.178.143
country_id: 3469034
description:
[2025-02-06 00:38:24 +0100] info [webmaild] 179.106.178.143 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.57.154.146
country_id: 1814991
description:
Feb  6 00:38:27 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.57.154.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.70.28
country_id: 1835841
description:
Feb  6 00:37:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.70.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.31.242
country_id: 1814991
description:
2025-02-06 00:37:56 dovecot_plain authenticator failed for ([61.169.31.242]) [61.169.31.242]:19578: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.15.67
country_id: 1814991
description:
Feb  6 00:38:00 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.242.86.203
country_id: 1814991
description:
2025-02-06 00:38:08 dovecot_plain authenticator failed for ([58.242.86.203]) [58.242.86.203]:60363: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.242.86.203
country_id: 1814991
description:
Feb  6 00:38:06 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.242.86.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.192.94
country_id: 3469034
description:
2025-02-06 00:38:07 dovecot_plain authenticator failed for 186-247-192-94.user.veloxzone.com.br ([179.236.122.153]) [186.247.192.94]:53440: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.136.192.106
country_id: 1733045
description:
2025-02-06 00:38:18 dovecot_plain authenticator failed for ([175.136.192.106]) [175.136.192.106]:36314: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.154.149
country_id: 1880251
description:
2025-02-06 00:37:48 dovecot_plain authenticator failed for ([175.156.154.149]) [175.156.154.149]:52460: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.255.221
country_id: 1835841
description:
2025-02-06 00:38:02 dovecot_plain authenticator failed for ([218.146.255.221]) [218.146.255.221]:64418: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.238.206
country_id: 2017370
description:
2025-02-06 00:38:04 dovecot_plain authenticator failed for ([95.221.238.206]) [95.221.238.206]:45840: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.135.188.125
country_id: 1835841
description:
Feb  6 00:37:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.135.188.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.218.134.95
country_id: 6252001
description:
Feb  6 00:37:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.218.134.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.24.93
country_id: 1835841
description:
Feb  6 00:38:02 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.24.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.192.94
country_id: 3469034
description:
Feb  6 00:38:05 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.192.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.0.60.158
country_id: 1835841
description:
Feb  6 00:37:58 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.0.60.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.140.176.170
country_id: 1814991
description:
Feb  6 00:37:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.140.176.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.206.7.126
country_id: 1814991
description:
2025-02-06 00:37:58 dovecot_login authenticator failed for ([221.206.7.126]) [221.206.7.126]:42136: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.121
country_id: 617790
description:
2025-02-06 00:38:03 dovecot_plain authenticator failed for ([185.167.58.121]) [185.167.58.121]:41008: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.91.172.21
country_id: 1269750
description:
Feb  6 00:37:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.91.172.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.230
country_id: 1269750
description:
Feb  6 00:37:48 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.231.163.154
country_id: 1210997
description:
Feb  6 00:37:53 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.231.163.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.26.101.77
country_id: 1814991
description:
2025-02-06 00:37:53 dovecot_plain authenticator failed for ([112.26.101.77]) [112.26.101.77]:43436: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.125
country_id: 1036973
description:
Feb  6 00:38:05 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.119.2
country_id: 1814991
description:
2025-02-06 00:38:08 dovecot_login authenticator failed for ([180.168.119.2]) [180.168.119.2]:37290: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.26.101.77
country_id: 1814991
description:
Feb  6 00:37:51 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.26.101.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.79.249.83
country_id: 6252001
description:
Feb  6 00:37:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.79.249.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.2.203.254
country_id: 1814991
description:
Feb  6 00:38:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.2.203.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.104.122.159
country_id: 6251999
description:
Feb  6 00:38:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.104.122.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.138.101.106
country_id: 1814991
description:
2025-02-06 00:37:45 dovecot_login authenticator failed for ([123.138.101.106]) [123.138.101.106]:48993: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.12.240.14
country_id: 2017370
description:
2025-02-06 00:37:46 dovecot_plain authenticator failed for ([85.12.240.14]) [85.12.240.14]:53028: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.164.202.218
country_id: 1814991
description:
Feb  6 00:37:48 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.164.202.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.90.43
country_id: 1814991
description:
Feb  6 00:37:48 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.90.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.138.101.106
country_id: 1814991
description:
Feb  6 00:37:43 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.138.101.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.62.67.73
country_id: 2510769
description:
2025-02-06 00:37:46 dovecot_plain authenticator failed for ([85.62.67.73]) [85.62.67.73]:57918: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.106.67.50
country_id: 6252001
description:
2025-02-06 00:37:55 dovecot_login authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:37396: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.227.194
country_id: 149590
description:
2025-02-06 00:37:58 dovecot_plain authenticator failed for ([196.200.227.78]) [196.200.227.194]:56944: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.125.68.208
country_id: 1835841
description:
2025-02-06 00:38:05 dovecot_plain authenticator failed for ([175.125.68.208]) [175.125.68.208]:48615: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2025-02-06 00:38:07 dovecot_plain authenticator failed for ([196.28.226.125]) [196.28.226.125]:34776: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.97.236.1
country_id: 3469034
description:
Feb  6 00:37:42 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.97.236.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.154.149
country_id: 1880251
description:
Feb  6 00:37:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.154.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.163.154
country_id: 1210997
description:
2025-02-06 00:37:55 dovecot_plain authenticator failed for ([103.231.163.154]) [103.231.163.154]:50846: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.146.148.173
country_id: 6252001
description:
2025-02-06 00:38:01 dovecot_plain authenticator failed for ([129.146.148.173]) [129.146.148.173]:39732: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.142.184.114
country_id: 1814991
description:
2025-02-06 00:37:48 dovecot_plain authenticator failed for ([163.142.184.114]) [163.142.184.114]:59998: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.70.28
country_id: 1835841
description:
2025-02-06 00:37:49 dovecot_plain authenticator failed for ([110.34.70.28]) [110.34.70.28]:36855: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.230
country_id: 1269750
description:
2025-02-06 00:37:50 dovecot_plain authenticator failed for (nsg-corporate-230.228.187.122.airtel.in) [122.187.228.230]:45177: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.184.58
country_id: 1814991
description:
Feb  6 00:38:00 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.184.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.250.134.35
country_id: 6252001
description:
Feb  6 00:37:45 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.250.134.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.179.161
country_id: 3175395
description:
2025-02-06 00:37:47 dovecot_plain authenticator failed for (161-179-53-194.mairnet.net) [194.53.179.161]:58792: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
country_id: 1269750
description:
Feb  6 00:37:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.63.169
country_id: 6252001
description:
2025-02-06 00:38:01 dovecot_plain authenticator failed for ([47.206.63.169]) [47.206.63.169]:53610: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.119.2
country_id: 1814991
description:
Feb  6 00:38:06 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.119.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.227.203
country_id: 1562822
description:
Feb  6 00:37:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.227.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.146.121.12
country_id: 1814991
description:
2025-02-06 00:37:58 dovecot_plain authenticator failed for ([61.146.121.12]) [61.146.121.12]:47628: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.204.108.172
country_id: 1814991
description:
2025-02-06 00:37:58 dovecot_plain authenticator failed for ([129.204.108.172]) [129.204.108.172]:59528: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
country_id: 1814991
description:
2025-02-06 00:38:05 dovecot_plain authenticator failed for ([218.98.26.226]) [58.216.101.162]:41013: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.254.136.116
country_id: 3017382
description:
Feb  6 00:37:30 ait sshd[888511]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.254.136.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.152.225.58
country_id: 3175395
description:
Feb  6 00:37:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.152.225.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.254.44.30
country_id: 597427
description:
2025-02-06 00:37:46 dovecot_plain authenticator failed for cl-185-254-44-30.b4net.lt [185.254.44.30]:60320: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
country_id: 1835841
description:
Feb  6 00:37:55 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.239.187.13
country_id: 1819730
description:
Feb  6 00:38:08 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.239.187.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.97.236.1
country_id: 3469034
description:
2025-02-06 00:37:44 dovecot_login authenticator failed for (ip-189-97-236-1.user.vivozap.com.br) [189.97.236.1]:36402: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.91.172.21
country_id: 1269750
description:
2025-02-06 00:37:49 dovecot_login authenticator failed for (21-172-91-219.static.youbroadband.in) [219.91.172.21]:34142: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.164.16.38
country_id: 3865483
description:
[2025-02-06 00:37:53 +0100] info [webmaild] 45.164.16.38 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.204.108.172
country_id: 1814991
description:
Feb  6 00:37:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.204.108.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.65.21
country_id: 1814991
description:
2025-02-06 00:38:11 dovecot_plain authenticator failed for ([183.220.65.21]) [183.220.65.21]:40758: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.114.215
country_id: 1168579
description:
Feb  6 00:37:34 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.114.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.235.25.35
country_id: 1527747
description:
2025-02-06 00:37:36 dovecot_login authenticator failed for (77-235-25-35.mega.kg) [77.235.25.35]:49485: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.19.80.138
country_id: 6252001
description:
2025-02-06 00:37:48 dovecot_plain authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:41784: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.12.14
country_id: 2017370
description:
2025-02-06 00:37:49 dovecot_plain authenticator failed for (14.12.168.188.retail.ttk.ru) [188.168.12.14]:60914: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-02-06 00:37:58 dovecot_plain authenticator failed for (31-154-122-202.orange.net.il) [2.55.122.202]:39677: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.112
country_id: 1814991
description:
Feb  6 00:38:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.112
country_id: 1814991
description:
2025-02-06 00:38:09 dovecot_plain authenticator failed for ([183.249.1.112]) [183.249.1.112]:34478: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.51.222.234
country_id: 2264397
description:
2025-02-06 00:38:10 dovecot_plain authenticator failed for a109-51-222-234.cpe.netcabo.pt [109.51.222.234]:46456: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.12.240.14
country_id: 2017370
description:
Feb  6 00:37:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.12.240.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.142.184.114
country_id: 1814991
description:
Feb  6 00:37:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.142.184.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.250.134.35
country_id: 6252001
description:
2025-02-06 00:37:47 dovecot_plain authenticator failed for ([130.250.134.35]) [130.250.134.35]:45728: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.31.242
country_id: 1814991
description:
Feb  6 00:37:54 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.31.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-02-06 00:38:11 dovecot_plain authenticator failed for ([128.185.12.179]) [128.185.12.179]:33548: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.109
country_id: 1819730
description:
Feb  6 00:38:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.15.177.173
country_id: 1814991
description:
Feb  6 00:38:17 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.15.177.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.114.215
country_id: 1168579
description:
2025-02-06 00:37:36 dovecot_login authenticator failed for ([103.123.114.215]) [103.123.114.215]:54188: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.69.142.186
country_id: 2077456
description:
2025-02-06 00:38:01 dovecot_plain authenticator failed for 61-69-142-186.tpgi.com.au [61.69.142.186]:39018: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.243.68.66
country_id: 1861060
description:
Feb  6 00:38:03 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.243.68.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.200.216.246
country_id: 1814991
description:
2025-02-06 00:38:02 dovecot_plain authenticator failed for ([113.200.216.246]) [113.200.216.246]:39034: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.79.249.83
country_id: 6252001
description:
2025-02-06 00:37:58 dovecot_plain authenticator failed for ([50.79.249.83]) [50.79.249.83]:9040: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.163.164
country_id: 1814991
description:
2025-02-06 00:37:49 dovecot_plain authenticator failed for ([61.145.163.164]) [61.145.163.164]:48745: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.95.67.92
country_id: 6252001
description:
Feb  6 00:37:51 ait sshd[888704]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.95.67.92


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.114.206
country_id: 1814991
description:
Feb  6 00:37:53 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.114.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.190.147.29
country_id: 6252001
description:
Feb  6 00:37:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.190.147.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.115.211
country_id: 1880251
description:
Feb  6 00:37:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.115.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.171
country_id: 6252001
description:
2025-02-06 00:37:56 dovecot_plain authenticator failed for syn-184-152-099-171.res.spectrum.com [184.152.99.171]:42460: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.51.222.234
country_id: 2264397
description:
Feb  6 00:38:08 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.51.222.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.90.72.14
country_id: 1814991
description:
Feb  6 00:38:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.90.72.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.164.202.218
country_id: 1814991
description:
2025-02-06 00:37:50 dovecot_plain authenticator failed for ([61.164.202.219]) [61.164.202.218]:21562: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.135.188.125
country_id: 1835841
description:
2025-02-06 00:37:51 dovecot_plain authenticator failed for ([121.135.188.125]) [121.135.188.125]:53192: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2025-02-06 00:37:57 dovecot_plain authenticator failed for ([222.120.176.6]) [222.120.176.6]:52024: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.140.176.170
country_id: 1814991
description:
2025-02-06 00:38:01 dovecot_plain authenticator failed for ([219.140.176.170]) [219.140.176.170]:36351: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
country_id: 1814991
description:
Feb  6 00:38:03 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.2.203.254
country_id: 1814991
description:
2025-02-06 00:38:09 dovecot_plain authenticator failed for (hebei.2.60.in-addr.arpa) [60.2.203.254]:47957: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.62.67.73
country_id: 2510769
description:
Feb  6 00:37:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.62.67.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.179.161
country_id: 3175395
description:
Feb  6 00:37:45 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.179.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.196.67
country_id: 2510769
description:
2025-02-06 00:37:55 dovecot_plain authenticator failed for (cli-5b7ec443.ast.adamo.es) [91.126.196.67]:46578: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.42.163.252
country_id: 660013
description:
Feb  6 00:37:58 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.42.163.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.146.148.173
country_id: 6252001
description:
Feb  6 00:37:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.146.148.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.69.142.186
country_id: 2077456
description:
Feb  6 00:37:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.69.142.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.236.59.174
country_id: 1835841
description:
Feb  6 00:38:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.236.59.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.1.154
country_id: 1819730
description:
2025-02-06 00:38:22 dovecot_plain authenticator failed for 110-4-1-154.static.pccw-hkt.com [110.4.1.154]:61211: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.216.5.134
country_id: 1814991
description:
Feb  6 00:37:48 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.216.5.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.195.104
country_id: 1269750
description:
2025-02-06 00:37:49 dovecot_plain authenticator failed for ([103.187.195.104]) [103.187.195.104]:33431: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.95.67.92
country_id: 6252001
description:
Feb  6 00:37:51 ait sshd[888704]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.95.67.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.206.63.169
country_id: 6252001
description:
Feb  6 00:37:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.206.63.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
country_id: 2328926
description:
2025-02-06 00:37:52 dovecot_plain authenticator failed for ([102.90.34.90]) [102.90.34.90]:42482: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.200.227.194
country_id: 149590
description:
Feb  6 00:37:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.200.227.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.0.60.158
country_id: 1835841
description:
2025-02-06 00:38:00 dovecot_plain authenticator failed for ([59.0.60.158]) [59.0.60.158]:37936: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.12.179
country_id: 1269750
description:
Feb  6 00:38:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.12.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.79.195
country_id: 337996
description:
Feb  6 00:37:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.79.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.253.226
country_id: 1269750
description:
Feb  6 00:37:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.253.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.93.198.164
country_id: 1814991
description:
2025-02-06 00:37:49 dovecot_login authenticator failed for ([183.93.198.164]) [183.93.198.164]:45846: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2025-02-06 00:37:49 dovecot_plain authenticator failed for ([213.55.79.199]) [213.55.79.195]:34162: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.109
country_id: 1819730
description:
2025-02-06 00:38:20 dovecot_plain authenticator failed for (m121-202-201-109.smartone.com) [121.202.201.109]:52436: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
country_id: 1168579
description:
2025-02-06 00:37:56 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:44090: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.24.93
country_id: 1835841
description:
2025-02-06 00:38:04 dovecot_plain authenticator failed for ([218.149.24.93]) [218.149.24.93]:38816: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.65.21
country_id: 1814991
description:
Feb  6 00:38:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.65.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.157.169.242
country_id: 1269750
description:
Feb  6 00:37:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.157.169.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.157.169.242
country_id: 1269750
description:
2025-02-06 00:37:37 dovecot_login authenticator failed for (abts-north-dynamic-161.133.176.122.airtelbroadband.in) [103.157.169.242]:55424: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2025-02-06 00:37:49 dovecot_plain authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:47326: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.90.34.90
country_id: 2328926
description:
Feb  6 00:37:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.90.34.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
country_id: 1269750
description:
Feb  6 00:38:45 ait sshd[889090]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.168.58.245
country_id: 1562822
description:
Feb  6 00:38:49 ait sshd[889225]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.168.58.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.109.27.194
country_id: 2017370
description:
Feb  6 00:38:34 ait sshd[889051]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.109.27.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.57.205.7
country_id: 1814991
description:
2025-02-06 00:39:19 dovecot_plain authenticator failed for ([117.57.205.7]) [117.57.205.7]:39230: 535 Incorrect authentication data (set_id=dzidonu@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.231.159
country_id: 2921044
description:
Feb  6 00:39:25 ait sshd[889427]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.205.231.159 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.109.27.194
country_id: 2017370
description:
Feb  6 00:38:34 ait sshd[889051]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.109.27.194


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.168.58.245
country_id: 1562822
description:
Feb  6 00:38:49 ait sshd[889225]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.168.58.245


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.229.85.164
country_id: 1880251
domain: elibrary.aitsmartschool.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/aitsmart02/public_html/wp-admin/images/admin.php


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 13.229.85.164
country_id: 1880251
domain: elibrary.aitsmartschool.com
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:00-38.13.229.85.164||RSV:6.65||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.75.90.139
country_id: 3703430
description:
[2025-02-06 00:38:58 +0100] info [webmaild] 186.75.90.139 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.57.154.146
country_id: 1814991
description:
2025-02-06 00:38:29 dovecot_plain authenticator failed for ([58.57.154.146]) [58.57.154.146]:45006: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
country_id: 1269750
description:
Feb  6 00:38:45 ait sshd[889090]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.57.205.7
country_id: 1814991
description:
Feb  6 00:39:17 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.57.205.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.231.159
country_id: 2921044
description:
Feb  6 00:39:25 ait sshd[889427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.231.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.253
country_id: 99237
description:
2025-02-06 00:40:15 dovecot_plain authenticator failed for (unninatick) [65.20.129.253]:46734: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.88.186.142
country_id: 3469034
description:
Feb  6 00:39:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.88.186.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.88.186.142
country_id: 3469034
description:
2025-02-06 00:39:37 dovecot_plain authenticator failed for ([201.88.186.142]) [201.88.186.142]:40150: 535 Incorrect authentication data (set_id=dzidonu)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.208.127.65
country_id: 3469034
description:
[2025-02-06 00:40:04 +0100] info [webmaild] 143.208.127.65 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.253
country_id: 99237
description:
Feb  6 00:40:13 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.151.45.136
country_id: 1814991
description:
2025-02-06 00:41:23 dovecot_plain authenticator failed for ([182.151.45.136]) [182.151.45.136]:42156: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.246.214
country_id: 1269750
description:
2025-02-06 00:41:24 dovecot_plain authenticator failed for (nsg-corporate-214.246.187.122.airtel.in) [122.187.246.214]:50479: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.180.188
country_id: 3865483
description:
[2025-02-06 00:40:34 +0100] info [webmaild] 170.239.180.188 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.173.205.157
country_id: 831053
description:
[2025-02-06 00:41:04 +0100] info [webmaild] 185.173.205.157 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.151.45.136
country_id: 1814991
description:
Feb  6 00:41:21 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.151.45.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.246.214
country_id: 1269750
description:
Feb  6 00:41:22 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.246.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.244.39
country_id: 1269750
description:
2025-02-06 00:42:09 dovecot_plain authenticator failed for ([103.69.244.39]) [103.69.244.39]:52922: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.29.235.66
country_id: 1605651
description:
Feb  6 00:41:31 ait sshd[890109]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.29.235.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
country_id: 2017370
description:
Feb  6 00:41:37 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.100
country_id: 1819730
description:
Feb  6 00:41:41 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.183.180.108
country_id: 1814991
description:
Feb  6 00:41:43 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.183.180.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.86.6
country_id: 2017370
description:
Feb  6 00:41:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.86.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.86.6
country_id: 2017370
description:
2025-02-06 00:41:52 dovecot_plain authenticator failed for ([188.168.86.6]) [188.168.86.6]:51414: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.100.105.194
country_id: 2750405
description:
Feb  6 00:41:54 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.100.105.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.244.39
country_id: 1269750
description:
Feb  6 00:42:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 00:42:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.149.57
country_id: 3469034
description:
2025-02-06 00:41:54 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.149.57]:60043: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
country_id: 1168579
description:
Feb  6 00:41:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.29.235.66
country_id: 1605651
description:
Feb  6 00:41:31 ait sshd[890109]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.29.235.66


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.183.180.108
country_id: 1814991
description:
2025-02-06 00:41:45 dovecot_plain authenticator failed for ([118.183.180.108]) [118.183.180.108]:2038: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.93.87.71
country_id: 1694008
description:
Feb  6 00:41:51 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.93.87.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.159.145.190
country_id: 2400553
description:
Feb  6 00:41:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.159.145.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.100
country_id: 1819730
description:
2025-02-06 00:41:43 dovecot_plain authenticator failed for (m121-202-154-100.smartone.com) [121.202.154.100]:51736: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.149.57
country_id: 3469034
description:
Feb  6 00:41:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.149.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
country_id: 1168579
description:
2025-02-06 00:41:58 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:50393: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-42.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.215.236.96
country_id: 2921044
description:
Feb  6 00:42:20 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.215.236.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.249.167.45
country_id: 6252001
description:
2025-02-06 00:41:38 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:37754: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.159.145.190
country_id: 2400553
description:
2025-02-06 00:41:54 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:46964: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.100.105.194
country_id: 2750405
description:
2025-02-06 00:41:56 dovecot_plain authenticator failed for d96469c2.static.ziggozakelijk.nl ([217.100.105.195]) [217.100.105.194]:36331: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.249.167.45
country_id: 6252001
description:
Feb  6 00:41:36 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.249.167.45 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.252.212.241
country_id: 2017370
description:
[2025-02-06 00:41:38 +0100] info [webmaild] 109.252.212.241 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
country_id: 2017370
description:
2025-02-06 00:41:39 dovecot_plain authenticator failed for (13-78-123-185.host.cirex.ru) [185.123.78.13]:2822: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.236.96
country_id: 2921044
description:
2025-02-06 00:42:22 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:58940: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.93.87.71
country_id: 1694008
description:
2025-02-06 00:41:53 dovecot_plain authenticator failed for ([119.93.87.71]) [119.93.87.71]:3142: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.8.174
country_id: 1814991
description:
Feb  6 00:42:22 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.8.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.8.174
country_id: 1814991
description:
2025-02-06 00:42:24 dovecot_plain authenticator failed for ([60.166.8.174]) [60.166.8.174]:48889: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.42.173.64
country_id: 1880251
description:
Feb  6 00:42:32 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.42.173.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.20.22.58
country_id: 6252001
description:
2025-02-06 00:43:06 dovecot_login authenticator failed for (8-20-22-58.hwccustomers.com) [8.20.22.58]:63413: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.92.248
country_id: 1269750
description:
Feb  6 00:43:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.92.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.92.248
country_id: 1269750
description:
2025-02-06 00:43:17 dovecot_login authenticator failed for (106.51.92.248.actcorp.in) [106.51.92.248]:36330: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.174.244.65
country_id: 3469034
description:
[2025-02-06 00:43:08 +0100] info [webmaild] 181.174.244.65 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.96.145.202
country_id: 1814991
description:
Feb  6 00:43:21 ait sshd[890684]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.96.145.202 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.96.145.202
country_id: 1814991
description:
Feb  6 00:43:21 ait sshd[890684]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.96.145.202


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.42.173.64
country_id: 1880251
description:
2025-02-06 00:42:34 dovecot_plain authenticator failed for ([115.42.173.64]) [115.42.173.64]:44590: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.160.123.6
country_id: 732800
description:
Feb  6 00:42:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.160.123.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.160.123.6
country_id: 732800
description:
2025-02-06 00:42:51 dovecot_plain authenticator failed for (likarge) [109.160.123.6]:45910: 535 Incorrect authentication data (set_id=abs65b11556y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.20.22.58
country_id: 6252001
description:
Feb  6 00:43:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.20.22.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.125.174.202
country_id: 1880251
description:
2025-02-06 00:43:56 dovecot_plain authenticator failed for ([27.125.174.202]) [27.125.174.202]:54177: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.216.7.163
country_id: 1668284
description:
Feb  6 00:44:27 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.216.7.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.59.228.24
country_id: 3017382
description:
Feb  6 00:44:26 ait sshd[891071]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.59.228.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.182.204.135
country_id: 3469034
description:
[2025-02-06 00:43:38 +0100] info [webmaild] 45.182.204.135 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 00:43:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.125.174.202
country_id: 1880251
description:
Feb  6 00:43:54 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.125.174.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.51.222.234
country_id: 2264397
description:
Feb  6 00:44:13 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.51.222.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.51.222.234
country_id: 2264397
description:
2025-02-06 00:44:15 dovecot_plain authenticator failed for a109-51-222-234.cpe.netcabo.pt [109.51.222.234]:59119: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.180.240.96
country_id: 1282988
description:
Feb  6 00:43:42 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.180.240.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.228.195.251
country_id: 1814991
description:
Feb  6 00:43:45 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.228.195.251 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.59.228.24
country_id: 3017382
description:
Feb  6 00:44:26 ait sshd[891071]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.228.24


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.113.10
country_id: 1814991
description:
Feb  6 00:43:40 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.42.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.179.158
country_id: 2017370
description:
Feb  6 00:44:17 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.179.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.24
country_id: 617790
description:
Feb  6 00:43:51 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.24
country_id: 617790
description:
2025-02-06 00:43:53 dovecot_plain authenticator failed for ([185.167.56.24]) [185.167.56.24]:36490: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.207.117
country_id: 294640
description:
Feb  6 00:43:55 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.207.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2025-02-06 00:43:42 dovecot_plain authenticator failed for ([182.42.113.10]) [182.42.113.10]:56342: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.228.195.251
country_id: 1814991
description:
2025-02-06 00:43:47 dovecot_plain authenticator failed for ([116.228.195.251]) [116.228.195.251]:14155: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 206.62.182.16
country_id: 3625428
description:
[2025-02-06 00:43:57 +0100] info [webmaild] 206.62.182.16 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.207.117
country_id: 294640
description:
2025-02-06 00:43:57 dovecot_plain authenticator failed for bzq-85-130-207-117.static-ip.bezeqint.net [85.130.207.117]:47746: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.241.179.229
country_id: 2802361
description:
Feb  6 00:44:11 ait sshd[891059]: pam_imunify(sshd:auth): [IM360_RBL] The IP 81.241.179.229 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 81.241.179.229
country_id: 2802361
description:
Feb  6 00:44:11 ait sshd[891059]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.241.179.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.180.240.96
country_id: 1282988
description:
2025-02-06 00:43:44 dovecot_plain authenticator failed for ([103.180.240.96]) [103.180.240.96]:55746: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.179.158
country_id: 2017370
description:
2025-02-06 00:44:19 dovecot_plain authenticator failed for broadband-77-37-179-158.ip.moscow.rt.ru [77.37.179.158]:53420: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.228.24
country_id: 3017382
description:
Feb  6 00:44:29 ait sshd[891071]: Failed password for invalid user goudirect from 146.59.228.24 port 42974 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.200.13.29
country_id: 298795
description:
[2025-02-06 00:44:31 +0100] info [webmaild] 31.200.13.29 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.216.7.163
country_id: 1668284
description:
2025-02-06 00:44:29 dovecot_plain authenticator failed for 61-216-7-163.hinet-ip.hinet.net ([61.216.7.164]) [61.216.7.163]:43112: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.99.210
country_id: 1814991
description:
Feb  6 00:44:31 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.99.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.99.210
country_id: 1814991
description:
2025-02-06 00:44:33 dovecot_plain authenticator failed for ([222.160.99.210]) [222.160.99.210]:43157: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.23.210.188
country_id: 2017370
description:
Feb  6 00:44:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.23.210.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.23.210.188
country_id: 2017370
description:
2025-02-06 00:44:49 dovecot_plain authenticator failed for (fanal) [89.23.210.188]:51299: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.2.110
country_id: 3469034
description:
2025-02-06 00:45:53 dovecot_plain authenticator failed for ([187.12.2.110]) [187.12.2.110]:52985: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.158.42
country_id: 3469034
description:
2025-02-06 00:46:05 dovecot_plain authenticator failed for ([186.200.158.42]) [186.200.158.42]:55356: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.38.85.125
country_id: 6252001
description:
2025-02-06 00:45:54 dovecot_login authenticator failed for (static.199.38.85.125.macminivault.com) [199.38.85.125]:63510: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.158.42
country_id: 3469034
description:
Feb  6 00:46:03 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.158.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.118.123
country_id: 1814991
description:
2025-02-06 00:46:09 dovecot_login authenticator failed for ([60.174.118.123]) [60.174.118.123]:58378: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.38.85.125
country_id: 6252001
description:
Feb  6 00:45:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.38.85.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.2.110
country_id: 3469034
description:
Feb  6 00:45:51 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.2.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.83.221.218
country_id: 3469034
description:
[2025-02-06 00:45:57 +0100] info [webmaild] 177.83.221.218 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.105.136.83
country_id: 3469034
description:
[2025-02-06 00:46:14 +0100] info [webmaild] 177.105.136.83 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.181.69.133
country_id: 1210997
description:
[2025-02-06 00:46:29 +0100] info [webmaild] 103.181.69.133 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 00:46:42 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.6.100
country_id: 1880251
description:
2025-02-06 00:47:17 dovecot_login authenticator failed for (100.6.129.180.unknown.m1.com.sg) [180.129.6.100]:43731: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.103.180.55
country_id: 3508796
description:
[2025-02-06 00:47:05 +0100] info [webmaild] 190.103.180.55 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.129.6.100
country_id: 1880251
description:
Feb  6 00:47:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.129.6.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.147.98.39
country_id: 2077456
description:
Feb  6 00:47:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.147.98.39 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 00:48:06 ait sshd[892211]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.102.66.226
country_id: 6251999
description:
2025-02-06 00:48:23 dovecot_login authenticator failed for ([207.102.66.226]) [207.102.66.226]:50442: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 00:48:06 ait sshd[892211]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.106.54.3
country_id: 99237
description:
[2025-02-06 00:48:23 +0100] info [webmaild] 91.106.54.3 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.43.144.70
country_id: 2635167
description:
Feb  6 00:47:38 ait sshd[892042]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.43.144.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.95.223.139
country_id: 1643084
description:
2025-02-06 00:48:13 dovecot_login authenticator failed for ([36.95.223.139]) [36.95.223.139]:55474: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.43.144.70
country_id: 2635167
description:
Feb  6 00:47:38 ait sshd[892042]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.43.144.70


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.98.39
country_id: 2077456
description:
2025-02-06 00:47:37 dovecot_login authenticator failed for ([203.147.98.39]) [203.147.98.39]:36073: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
country_id: 2453866
description:
2025-02-06 00:49:28 dovecot_plain authenticator failed for ([154.118.162.194]) [154.118.162.194]:50741: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.196.212.167
country_id: 3469034
description:
[2025-02-06 00:48:53 +0100] info [webmaild] 168.196.212.167 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.229.202.234
country_id: 3508796
description:
[2025-02-06 00:49:05 +0100] info [webmaild] 201.229.202.234 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
country_id: 1269750
description:
2025-02-06 00:49:18 dovecot_plain authenticator failed for (nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:35302: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.6.90.217
country_id: 3469034
description:
[2025-02-06 00:49:41 +0100] info [webmaild] 200.6.90.217 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
country_id: 1835841
description:
2025-02-06 00:49:49 dovecot_login authenticator failed for ([14.38.28.126]) [14.88.228.202]:43800: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.131
country_id: 2017370
description:
2025-02-06 00:50:02 dovecot_plain authenticator failed for ([178.178.194.131]) [178.178.194.131]:38736: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.87.187.71
country_id: 2017370
description:
Feb  6 00:50:05 ait sshd[893036]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.87.187.71


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 00:50:21 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.92.74.36
country_id: 6252001
description:
2025-02-06 00:49:35 dovecot_login authenticator failed for ([164.92.74.36]) [164.92.74.36]:59292: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.34.158.19
country_id: 3144096
description:
2025-02-06 00:49:42 dovecot_plain authenticator failed for ti0004q160-7861.bb.online.no [95.34.158.19]:47728: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2025-02-06 00:49:53 dovecot_plain authenticator failed for ([116.113.254.26]) [116.113.254.26]:52870: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.87.187.71
country_id: 2017370
description:
Feb  6 00:50:05 ait sshd[893036]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.87.187.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.159.174.136
country_id: 1814991
description:
2025-02-06 00:50:09 dovecot_plain authenticator failed for ([117.159.174.136]) [117.159.174.136]:40408: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.14.135
country_id: 1668284
description:
2025-02-06 00:51:17 dovecot_login authenticator failed for 111-70-14-135.emome-ip.hinet.net [111.70.14.135]:47114: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.92.39
country_id: 1512440
description:
[2025-02-06 00:51:21 +0100] info [webmaild] 213.230.92.39 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.63
country_id: 1819730
description:
2025-02-06 00:50:40 dovecot_plain authenticator failed for (m121-202-154-63.smartone.com) [121.202.154.63]:45965: 535 Incorrect authentication data (set_id=eng20b00167y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.91.173.203
country_id: 953987
description:
2025-02-06 00:50:50 dovecot_plain authenticator failed for (197-91-173-203.dyn.mweb.co.za) [197.91.173.203]:52078: 535 Incorrect authentication data (set_id=eng20b00167y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.62.151.3
country_id: 99237
description:
[2025-02-06 00:50:51 +0100] info [webmaild] 5.62.151.3 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.112.6.186
country_id: 1814991
description:
2025-02-06 00:51:06 dovecot_login authenticator failed for ([116.112.6.186]) [116.112.6.186]:56081: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.60.157
country_id: 3469034
description:
[2025-02-06 00:51:44 +0100] info [webmaild] 45.70.60.157 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.60.94
country_id: 1880251
description:
47.128.60.94 - - [06/Feb/2025:00:51:53 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=25534714 HTTP/1.1" 302 0 ijari.us "http://ijari.us/images/Osei_AJARI_Vol_1_No._2.pdf" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.60.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-02-06 00:52:01 dovecot_plain authenticator failed for (unropor) [178.250.191.189]:51172: 535 Incorrect authentication data (set_id=eng38b22452y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2025-02-06 00:52:08 dovecot_plain authenticator failed for 78-68-37-25-no2560.tbcn.telia.com (cented) [78.68.37.25]:44510: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.182.78.103
country_id: 3658394
description:
[2025-02-06 00:52:18 +0100] info [webmaild] 201.182.78.103 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.40.155
country_id: 1814991
description:
2025-02-06 00:53:16 dovecot_plain authenticator failed for ([60.174.40.155]) [60.174.40.155]:47925: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.163.57.10
country_id: 1643084
description:
2025-02-06 00:53:22 dovecot_plain authenticator failed for (ip-103-133.222-205.cloudteknologinusantara.co.id) [125.163.57.10]:55450: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2025-02-06 00:53:23 dovecot_plain authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:37732: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.53.85.222
country_id: 3469034
description:
2025-02-06 00:53:28 dovecot_plain authenticator failed for itau-g2-0-2-150618-iacc01.rce.embratel.net.br [189.53.85.222]:58713: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.36.24.33
country_id: 3508796
description:
2025-02-06 00:53:08 dovecot_login authenticator failed for ([138.36.24.33]) [138.36.24.33]:37032: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.234.245.7
country_id: 2017370
description:
2025-02-06 00:53:10 dovecot_plain authenticator failed for (net245.234.188-7.ertelecom.ru) [188.234.245.7]:54786: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-02-06 00:53:13 dovecot_plain authenticator failed for ([201.183.225.156]) [201.183.225.156]:43000: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
country_id: 6252001
description:
2025-02-06 00:53:20 dovecot_plain authenticator failed for ([96.79.174.131]) [96.79.174.131]:39038: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2025-02-06 00:53:22 dovecot_plain authenticator failed for ([209.173.10.75]) [209.173.10.75]:38020: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.37.166
country_id: 1269750
description:
2025-02-06 00:53:26 dovecot_plain authenticator failed for ([223.30.243.113]) [49.37.37.166]:48784: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-02-06 00:53:27 dovecot_plain authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:34052: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.78.119.104
country_id: 1835841
description:
Feb  6 00:53:04 ait sshd[893876]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.78.119.104


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.24.138.130
country_id: 6252001
description:
2025-02-06 00:53:13 dovecot_plain authenticator failed for syn-024-024-138-130.res.spectrum.com [24.24.138.130]:61904: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.152
country_id: 294640
description:
2025-02-06 00:53:13 dovecot_plain authenticator failed for (2-55-88-152.orange.net.il) [2.55.88.152]:53935: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.66.190.67
country_id: 1269750
description:
2025-02-06 00:53:02 dovecot_login authenticator failed for ([116.66.190.67]) [116.66.190.67]:57582: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.59.214.64
country_id: 6251999
description:
2025-02-06 00:53:12 dovecot_plain authenticator failed for s142-59-214-64.ab.hsia.telus.net [142.59.214.64]:57174: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.151.150
country_id: 3469034
description:
2025-02-06 00:53:16 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.151.150]:46923: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.104.199.27
country_id: 1814991
description:
2025-02-06 00:53:26 dovecot_plain authenticator failed for ([120.24.83.156]) [223.104.199.27]:26473: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.216.7.163
country_id: 1668284
description:
Feb  6 00:52:37 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.216.7.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.104.245
country_id: 3469034
description:
2025-02-06 00:52:45 dovecot_plain authenticator failed for ([179.125.104.245]) [179.125.104.245]:47039: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.98.39
country_id: 2077456
description:
2025-02-06 00:53:00 dovecot_plain authenticator failed for ([203.147.98.39]) [203.147.98.39]:43148: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.246.89.195
country_id: 1814991
description:
2025-02-06 00:52:56 dovecot_login authenticator failed for ([183.246.89.195]) [183.246.89.195]:57666: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.202.148.110
country_id: 290557
description:
2025-02-06 00:53:13 dovecot_plain authenticator failed for ([94.202.148.110]) [94.202.148.110]:47734: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 00:52:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.104
country_id: 1668284
description:
2025-02-06 00:52:30 dovecot_plain authenticator failed for 111-70-49-104.emome-ip.hinet.net [111.70.49.104]:46679: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.174.103.74
country_id: 6252001
description:
2025-02-06 00:52:36 dovecot_plain authenticator failed for 74-103-174-206.gci.net [206.174.103.74]:63596: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
country_id: 1269750
description:
2025-02-06 00:53:26 dovecot_plain authenticator failed for (nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:42265: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.59.90.121
country_id: 2661886
description:
2025-02-06 00:53:11 dovecot_plain authenticator failed for h-46-59-90-121.a463.priv.bahnhof.se [46.59.90.121]:35714: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.244.83.178
country_id: 2661886
description:
2025-02-06 00:53:24 dovecot_plain authenticator failed for h80-244-83-178.cust.bredband2.com [80.244.83.178]:51594: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.123
country_id: 1269750
description:
Feb  6 00:53:24 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.147.98.39
country_id: 2077456
description:
Feb  6 00:52:58 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.147.98.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.132.232
country_id: 6252001
description:
2025-02-06 00:53:10 dovecot_login authenticator failed for ([75.110.132.232]) [75.110.132.232]:61954: 535 Incorrect authentication data (set_id=submit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.60.194.189
country_id: 2510769
description:
2025-02-06 00:53:14 dovecot_plain authenticator failed for 81.60.194.189.dyn.user.ono.com [81.60.194.189]:45528: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.78.119.104
country_id: 1835841
description:
Feb  6 00:53:04 ait sshd[893876]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.78.119.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.80.222
country_id: 1814991
description:
2025-02-06 00:53:14 dovecot_plain authenticator failed for ([1.31.80.222]) [1.31.80.222]:47582: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.40.155
country_id: 1814991
description:
Feb  6 00:53:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.40.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.222.190.70
country_id: 1522867
description:
2025-02-06 00:53:18 dovecot_plain authenticator failed for (client.fttb.2day.kz) [176.222.190.70]:43566: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.216.7.163
country_id: 1668284
description:
2025-02-06 00:52:39 dovecot_plain authenticator failed for 61-216-7-163.hinet-ip.hinet.net (61-216-7-164.hinet-ip.hinet.net) [61.216.7.163]:60025: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-02-06 00:53:00 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:25837: 535 Incorrect authentication data (set_id=submit@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.169.151
country_id: 99237
description:
2025-02-06 00:53:22 dovecot_login authenticator failed for ([65.20.169.151]) [65.20.169.151]:38355: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.20.22.58
country_id: 6252001
description:
2025-02-06 00:53:24 dovecot_plain authenticator failed for (8-20-22-58.hwccustomers.com) [8.20.22.58]:49838: 535 Incorrect authentication data (set_id=eng22a00061y)


