# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.89
country_id: 660013
description:
2025-02-07 00:11:25 dovecot_login authenticator failed for (ADMIN) [188.126.89.89]:56096: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
country_id: 2658434
description:
2025-02-07 00:11:26 dovecot_plain authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:40264: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
country_id: 1835841
description:
2025-02-07 00:11:31 dovecot_plain authenticator failed for ([222.117.0.253]) [222.117.0.253]:36934: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.240.204.168
country_id: 2077456
description:
Feb  7 00:12:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.240.204.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.77.25.108
country_id: 6252001
description:
Feb  7 00:12:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.77.25.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.240.204.168
country_id: 2077456
description:
2025-02-07 00:12:17 dovecot_plain authenticator failed for 60-240-204-168.static.tpgi.com.au [60.240.204.168]:50330: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.220.33
country_id: 1269750
description:
Feb  7 00:12:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.220.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.83
country_id: 1819730
description:
2025-02-07 00:11:54 dovecot_plain authenticator failed for 083.42.246.220.static.netvigator.com [220.246.42.83]:56721: 535 Incorrect authentication data (set_id=aabdulrahaman@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.99.237.249
country_id: 1835841
description:
Feb  7 00:12:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.99.237.249 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:00-12.35.92.116.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.116
country_id: 1814991
description:
2025-02-07 00:12:34 dovecot_plain authenticator failed for (116.20.167.124.adsl-pool.sx.cn) [124.167.20.116]:44167: 535 Incorrect authentication data (set_id=vobynuma)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.83
country_id: 1819730
description:
Feb  7 00:11:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.77.25.108
country_id: 6252001
description:
2025-02-07 00:12:05 dovecot_plain authenticator failed for ([76.77.25.108]) [76.77.25.108]:36235: 535 Incorrect authentication data (set_id=vobynuma@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.237.249
country_id: 1835841
description:
2025-02-07 00:12:05 dovecot_plain authenticator failed for ([222.99.237.249]) [222.99.237.249]:59113: 535 Incorrect authentication data (set_id=aabdulrahaman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
country_id: 1269750
description:
2025-02-07 00:12:30 dovecot_plain authenticator failed for ([106.51.120.94]) [106.51.220.33]:29105: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.116
country_id: 1814991
description:
Feb  7 00:12:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.171.137.226
country_id: 1814991
description:
Feb  7 00:13:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.171.137.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.119.20.149
country_id: 1835841
description:
2025-02-07 00:13:05 dovecot_plain authenticator failed for ([175.119.20.149]) [175.119.20.149]:46425: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
country_id: 1814991
description:
2025-02-07 00:13:26 dovecot_login authenticator failed for ([222.92.61.242]) [222.92.61.242]:34746: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.248.26.21
country_id: 6252001
description:
Feb  7 00:13:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.248.26.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
country_id: 1814991
description:
Feb  7 00:13:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.171.137.226
country_id: 1814991
description:
2025-02-07 00:13:30 dovecot_plain authenticator failed for ([60.171.137.226]) [60.171.137.226]:53803: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.248.26.21
country_id: 6252001
description:
2025-02-07 00:13:11 dovecot_login authenticator failed for syn-067-248-026-021.res.spectrum.com [67.248.26.21]:58070: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.52.109
country_id: 732800
description:
Feb  7 00:13:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.84.62.149
country_id: 3996063
description:
2025-02-07 00:13:39 dovecot_plain authenticator failed for ([187.218.57.50]) [138.84.62.149]:16718: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.119.20.149
country_id: 1835841
description:
Feb  7 00:13:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.119.20.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
country_id: 732800
description:
2025-02-07 00:13:16 dovecot_plain authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:42034: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.84.62.149
country_id: 3996063
description:
Feb  7 00:13:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.84.62.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.212.238
country_id: 1814991
description:
Feb  7 00:14:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.212.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.212.238
country_id: 1814991
description:
2025-02-07 00:14:34 dovecot_plain authenticator failed for ([58.18.212.238]) [58.18.212.238]:59942: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.16.161.35
country_id: 953987
description:
Feb  7 00:15:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.16.161.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.16.161.35
country_id: 953987
description:
2025-02-07 00:15:25 dovecot_login authenticator failed for ([105.16.161.35]) [105.16.161.35]:37525: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.108.88.121
country_id: 1814991
description:
Feb  7 00:15:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.108.88.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.108.88.121
country_id: 1814991
description:
2025-02-07 00:15:35 dovecot_login authenticator failed for ([113.108.88.121]) [113.108.88.121]:54028: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.54.22.11
country_id: 1835841
description:
Feb  7 00:15:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.54.22.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
country_id: 1835841
description:
2025-02-07 00:15:08 dovecot_plain authenticator failed for ([14.54.22.11]) [14.54.22.11]:6383: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.173.18.71
country_id: 1814991
description:
Feb  7 00:17:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.173.18.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.169.151
country_id: 99237
description:
2025-02-07 00:17:04 dovecot_plain authenticator failed for ([65.20.169.151]) [65.20.169.151]:49359: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.216.37.11
country_id: 1814991
description:
Feb  7 00:17:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.216.37.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.216.37.11
country_id: 1814991
description:
2025-02-07 00:17:16 dovecot_plain authenticator failed for ([60.216.37.11]) [60.216.37.11]:52168: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.201
country_id: 1819730
description:
2025-02-07 00:17:39 dovecot_plain authenticator failed for (m121-202-198-201.smartone.com) [121.202.198.201]:47943: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.132
country_id: 1880251
description:
47.128.122.132 - - [07/Feb/2025:00:17:41 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11706036 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/course-tag/management/page/3/?filtering=1&instructor=2" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.132


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.173.18.71
country_id: 1814991
description:
2025-02-07 00:17:50 dovecot_plain authenticator failed for ([117.173.18.71]) [117.173.18.71]:45074: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.169.151
country_id: 99237
description:
Feb  7 00:17:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.169.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.198.201
country_id: 1819730
description:
Feb  7 00:17:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.198.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
country_id: 2017370
description:
2025-02-07 00:18:27 dovecot_plain authenticator failed for (rundic) [81.211.77.58]:26573: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.208.136.225
country_id: 2661886
description:
Feb  7 00:18:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.208.136.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.29.100.218
country_id: 1814991
description:
2025-02-07 00:18:48 dovecot_login authenticator failed for ([60.29.100.218]) [60.29.100.218]:51106: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2025-02-07 00:18:49 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:60452: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.122.179.118
country_id: 1835841
description:
Feb  7 00:18:23 ait sshd[1489821]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.122.179.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.99.15.104
country_id: 1269750
description:
2025-02-07 00:18:39 dovecot_login authenticator failed for ([103.99.15.104]) [103.99.15.104]:60740: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.122.179.118
country_id: 1835841
description:
Feb  7 00:18:23 ait sshd[1489821]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.122.179.118  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.99.15.104
country_id: 1269750
description:
Feb  7 00:18:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.99.15.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.93.177.228
country_id: 1269750
description:
Feb  7 00:18:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.93.177.228 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.28.73.204
country_id: 3923057
description:
[2025-02-07 00:18:08 +0100] info [webmaild] 189.28.73.204 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
country_id: 2017370
description:
Feb  7 00:18:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.136.225
country_id: 2661886
description:
2025-02-07 00:18:35 dovecot_login authenticator failed for 31-208-136-225.cust.bredband2.com [31.208.136.225]:56605: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.29.100.218
country_id: 1814991
description:
Feb  7 00:18:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.29.100.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
country_id: 2750405
description:
Feb  7 00:18:53 ait sshd[1489918]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.68.50
country_id: 1814991
description:
Feb  7 00:19:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.68.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
country_id: 2750405
description:
Feb  7 00:18:53 ait sshd[1489918]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.68.50
country_id: 1814991
description:
2025-02-07 00:19:07 dovecot_plain authenticator failed for ([61.185.68.50]) [61.185.68.50]:40685: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.2
country_id: 617790
description:
Feb  7 00:19:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2025-02-07 00:19:20 dovecot_plain authenticator failed for ([222.120.176.6]) [222.120.176.6]:56158: 535 Incorrect authentication data (set_id=yeboah)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 77.83.1.40
country_id: 2635167
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-19.77.83.1.40


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.2
country_id: 617790
description:
2025-02-07 00:19:15 dovecot_plain authenticator failed for ([185.167.56.2]) [185.167.56.2]:47832: 535 Incorrect authentication data (set_id=edonkor)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 77.83.1.113
country_id: 2635167
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-19.77.83.1.113


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.95.23.226
country_id: 1835841
description:
Feb  7 00:19:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.95.23.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
country_id: 1835841
description:
Feb  7 00:19:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.95.23.226
country_id: 1835841
description:
2025-02-07 00:19:44 dovecot_login authenticator failed for ([115.95.23.226]) [115.95.23.226]:59845: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.63.19
country_id: 1880251
description:
47.128.63.19 - - [07/Feb/2025:00:18:56 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=26640493 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/3/?duration=short%2Clong&filter_course-language=120&filtering=1&instructor=2&level=beginner%2Cintermediate" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.63.19


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.121.199.203
country_id: 6252001
description:
Feb  7 00:19:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.121.199.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
country_id: 6252001
description:
2025-02-07 00:19:06 dovecot_plain authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:44490: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.250.155.76
country_id: 294640
description:
2025-02-07 00:20:32 dovecot_plain authenticator failed for ([80.250.155.76]) [80.250.155.76]:60680: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.118.162.194
country_id: 2453866
description:
Feb  7 00:20:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.118.162.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.147.25.111
country_id: 1835841
description:
2025-02-07 00:20:41 dovecot_plain authenticator failed for ([121.147.25.111]) [121.147.25.111]:32982: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.52.116
country_id: 1814991
description:
2025-02-07 00:19:55 dovecot_login authenticator failed for ([111.53.52.116]) [111.53.52.116]:33942: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
country_id: 2750405
description:
Feb  7 00:20:01 ait sshd[1490423]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.142.41.167
country_id: 732800
description:
2025-02-07 00:20:08 dovecot_login authenticator failed for ([78.142.41.167]) [78.142.41.167]:40716: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
country_id: 2453866
description:
2025-02-07 00:20:27 dovecot_plain authenticator failed for ([154.118.162.194]) [154.118.162.194]:2067: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.142.41.167
country_id: 732800
description:
Feb  7 00:20:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.142.41.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.205
country_id: 1269750
description:
Feb  7 00:20:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.250.155.76
country_id: 294640
description:
Feb  7 00:20:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.250.155.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.52.116
country_id: 1814991
description:
Feb  7 00:19:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.52.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.62
country_id: 1814991
description:
Feb  7 00:19:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.62
country_id: 1814991
description:
2025-02-07 00:19:58 dovecot_login authenticator failed for ([111.61.176.62]) [111.61.176.62]:15080: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
country_id: 2750405
description:
Feb  7 00:20:01 ait sshd[1490423]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.205
country_id: 1269750
description:
2025-02-07 00:20:19 dovecot_plain authenticator failed for (nsg-corporate-205.230.187.122.airtel.in) [122.187.230.205]:56351: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.147.25.111
country_id: 1835841
description:
Feb  7 00:20:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.147.25.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.196.6
country_id: 1819730
description:
Feb  7 00:20:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.196.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.57.205.7
country_id: 1814991
description:
Feb  7 00:21:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.57.205.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.57.205.7
country_id: 1814991
description:
2025-02-07 00:21:10 dovecot_plain authenticator failed for ([117.57.205.7]) [117.57.205.7]:50090: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.160.114.72
country_id: 1210997
description:
2025-02-07 00:21:26 dovecot_plain authenticator failed for ([182.160.114.72]) [182.160.114.72]:59678: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.134.109.253
country_id: 1814991
description:
2025-02-07 00:21:16 dovecot_plain authenticator failed for ([124.134.109.253]) [124.134.109.253]:32884: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.175.194.139
country_id: 6252001
description:
2025-02-07 00:20:54 dovecot_plain authenticator failed for syn-072-175-194-139.res.spectrum.com [72.175.194.139]:22796: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.203.251.186
country_id: 1835841
description:
2025-02-07 00:20:56 dovecot_plain authenticator failed for ([119.203.251.186]) [119.203.251.186]:34146: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.178.103.119
country_id: 6252001
description:
2025-02-07 00:20:59 dovecot_plain authenticator failed for syn-076-178-103-119.res.spectrum.com [76.178.103.119]:28300: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.125.174.202
country_id: 1880251
description:
2025-02-07 00:21:06 dovecot_plain authenticator failed for ([27.125.174.202]) [27.125.174.202]:59761: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.148.218.235
country_id: 2017370
description:
2025-02-07 00:21:06 dovecot_plain authenticator failed for ([185.148.218.235]) [185.148.218.235]:55002: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.59.235.170
country_id: 1814991
description:
2025-02-07 00:20:56 dovecot_plain authenticator failed for ([222.175.187.214]) [218.59.235.170]:43102: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.160.114.72
country_id: 1210997
description:
Feb  7 00:21:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.160.114.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.135.103.7
country_id: 294640
description:
2025-02-07 00:20:54 dovecot_plain authenticator failed for ([91.135.103.7]) [91.135.103.7]:56499: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.126.247
country_id: 1835841
description:
2025-02-07 00:21:03 dovecot_plain authenticator failed for ([112.172.126.247]) [112.172.126.247]:40651: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.188
country_id: 1814991
description:
2025-02-07 00:21:06 dovecot_login authenticator failed for ([111.61.176.188]) [111.61.176.188]:56280: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.189.21.157
country_id: 298795
description:
2025-02-07 00:20:52 dovecot_plain authenticator failed for (mail110220.dc.sistemdc.commailtr.com) [78.189.21.157]:54351: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.76.191.29
country_id: 1819730
description:
Feb  7 00:21:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.76.191.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2025-02-07 00:21:20 dovecot_plain authenticator failed for 029.191.76.219.static.netvigator.com [219.76.191.29]:51498: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.209.18
country_id: 1814991
description:
Feb  7 00:20:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.209.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.210.134.9
country_id: 1814991
description:
Feb  7 00:20:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.210.134.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.71.173.250
country_id: 1269750
description:
2025-02-07 00:20:55 dovecot_plain authenticator failed for ([14.97.7.138]) [182.71.173.250]:46424: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
country_id: 3469034
description:
2025-02-07 00:20:56 dovecot_plain authenticator failed for (corporativo.static.gvt.net.br) [189.115.93.183]:33143: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.134.109.253
country_id: 1814991
description:
Feb  7 00:21:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.134.109.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.86.134.216
country_id: 6252001
description:
2025-02-07 00:21:23 dovecot_plain authenticator failed for syn-097-086-134-216.res.spectrum.com [97.86.134.216]:4872: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.196.6
country_id: 1819730
description:
2025-02-07 00:20:56 dovecot_plain authenticator failed for ([121.202.196.6]) [121.202.196.6]:43333: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
country_id: 294640
description:
Feb  7 00:21:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
country_id: 1269750
description:
Feb  7 00:21:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.240.204.168
country_id: 2077456
description:
Feb  7 00:21:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.240.204.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.151.11
country_id: 1733045
description:
Feb  7 00:21:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.151.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.35.18
country_id: 1814991
description:
2025-02-07 00:21:20 dovecot_login authenticator failed for ([60.174.35.18]) [60.174.35.18]:57742: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.93.183
country_id: 3469034
description:
Feb  7 00:20:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.93.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.209.18
country_id: 1814991
description:
2025-02-07 00:20:56 dovecot_plain authenticator failed for ([220.189.209.18]) [220.189.209.18]:51663: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
country_id: 1168579
description:
Feb  7 00:21:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.145.163.164
country_id: 1814991
description:
Feb  7 00:21:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.145.163.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.236.59.174
country_id: 1835841
description:
Feb  7 00:21:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.236.59.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.136.192.106
country_id: 1733045
description:
Feb  7 00:21:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.136.192.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.59.174
country_id: 1835841
description:
2025-02-07 00:21:20 dovecot_plain authenticator failed for ([222.236.59.174]) [222.236.59.174]:45387: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.86.134.216
country_id: 6252001
description:
Feb  7 00:21:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.86.134.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.198.129.123
country_id: 1819730
description:
Feb  7 00:20:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.198.129.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.148.218.235
country_id: 2017370
description:
Feb  7 00:21:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.148.218.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
country_id: 294640
description:
2025-02-07 00:21:04 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:48948: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.155.191.166
country_id: 1814991
description:
2025-02-07 00:21:08 dovecot_plain authenticator failed for ([39.155.191.166]) [39.155.191.166]:27826: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.11
country_id: 1733045
description:
2025-02-07 00:21:12 dovecot_plain authenticator failed for ([49.124.151.11]) [49.124.151.11]:37640: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.37.177.99
country_id: 6252001
description:
Feb  7 00:21:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.37.177.99 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:00-21.35.92.116.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
country_id: 2658434
description:
2025-02-07 00:21:39 dovecot_plain authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:59743: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.229
country_id: 337996
description:
Feb  7 00:21:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.35.18
country_id: 1814991
description:
Feb  7 00:21:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.35.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.203.251.186
country_id: 1835841
description:
Feb  7 00:20:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.203.251.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.28.51
country_id: 1814991
description:
2025-02-07 00:20:55 dovecot_plain authenticator failed for ([222.128.28.51]) [222.128.28.51]:6672: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.210.134.9
country_id: 1814991
description:
2025-02-07 00:20:57 dovecot_plain authenticator failed for ([221.210.134.9]) [221.210.134.9]:35217: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.53.82
country_id: 1814991
description:
2025-02-07 00:20:58 dovecot_plain authenticator failed for ([60.172.53.82]) [60.172.53.82]:34503: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.253.10.61
country_id: 1835841
description:
Feb  7 00:21:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.253.10.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-02-07 00:21:08 dovecot_plain authenticator failed for ([103.174.34.49]) [103.174.34.49]:64881: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.59.235.170
country_id: 1814991
description:
Feb  7 00:20:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.59.235.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.125.174.202
country_id: 1880251
description:
Feb  7 00:21:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.125.174.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.188.203.9
country_id: 1835841
description:
2025-02-07 00:21:11 dovecot_plain authenticator failed for ([121.188.203.9]) [121.188.203.9]:58829: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.163.164
country_id: 1814991
description:
2025-02-07 00:21:12 dovecot_plain authenticator failed for ([61.145.163.164]) [61.145.163.164]:54841: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.2.62
country_id: 1814991
description:
2025-02-07 00:21:16 dovecot_plain authenticator failed for ([222.180.2.62]) [222.180.2.62]:37167: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.71.173.250
country_id: 1269750
description:
Feb  7 00:20:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.71.173.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.129.123
country_id: 1819730
description:
2025-02-07 00:21:00 dovecot_plain authenticator failed for 123.129.198.203.static.netvigator.com [203.198.129.123]:51218: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
country_id: 1168579
description:
2025-02-07 00:21:05 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:35005: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.4.81.206
country_id: 2658434
description:
Feb  7 00:21:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.4.81.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.2.62
country_id: 1814991
description:
Feb  7 00:21:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.2.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.135.103.7
country_id: 294640
description:
Feb  7 00:20:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.135.103.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.178.103.119
country_id: 6252001
description:
Feb  7 00:20:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.178.103.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.188
country_id: 1814991
description:
Feb  7 00:21:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.240.204.168
country_id: 2077456
description:
2025-02-07 00:21:12 dovecot_plain authenticator failed for 60-240-204-168.static.tpgi.com.au [60.240.204.168]:41393: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.136.192.106
country_id: 1733045
description:
2025-02-07 00:21:22 dovecot_plain authenticator failed for ([175.136.192.106]) [175.136.192.106]:56114: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.188.203.9
country_id: 1835841
description:
Feb  7 00:21:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.188.203.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.189.21.157
country_id: 298795
description:
Feb  7 00:20:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.189.21.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.175.194.139
country_id: 6252001
description:
Feb  7 00:20:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.175.194.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.53.82
country_id: 1814991
description:
Feb  7 00:20:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.53.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.126.247
country_id: 1835841
description:
Feb  7 00:21:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.126.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.155.191.166
country_id: 1814991
description:
Feb  7 00:21:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.155.191.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.253.10.61
country_id: 1835841
description:
2025-02-07 00:21:09 dovecot_plain authenticator failed for ([211.253.10.61]) [211.253.10.61]:60531: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.28.51
country_id: 1814991
description:
Feb  7 00:20:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.28.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-02-07 00:21:16 dovecot_plain authenticator failed for ([196.189.124.229]) [196.189.124.229]:37650: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.37.177.99
country_id: 6252001
description:
2025-02-07 00:21:26 dovecot_plain authenticator failed for syn-047-037-177-099.res.spectrum.com [47.37.177.99]:51833: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.220.196
country_id: 2017370
description:
Feb  7 00:22:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.220.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.153.94
country_id: 1814991
description:
Feb  7 00:22:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.153.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.101.36.159
country_id: 2963597
description:
Feb  7 00:22:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.101.36.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-02-07 00:22:31 dovecot_plain authenticator failed for ([89.101.36.159]) [89.101.36.159]:60520: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-02-07 00:22:34 dovecot_plain authenticator failed for ([192.34.128.202]) [192.34.128.202]:60738: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.220.168.116
country_id: 2017370
description:
Feb  7 00:22:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.220.168.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.45.68
country_id: 1835841
description:
Feb  7 00:21:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.45.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.220.168.116
country_id: 2017370
description:
2025-02-07 00:22:38 dovecot_login authenticator failed for (31-220-168-116.rdtc.ru) [31.220.168.116]:60853: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.29.185.162
country_id: 1643084
description:
Feb  7 00:22:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.29.185.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.153.94
country_id: 1814991
description:
2025-02-07 00:22:21 dovecot_plain authenticator failed for ([150.242.239.128]) [222.68.153.94]:53930: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.250.7.67
country_id: 149590
description:
Feb  7 00:22:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.250.7.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.45.68
country_id: 1835841
description:
2025-02-07 00:21:55 dovecot_plain authenticator failed for ([218.146.45.68]) [218.146.45.68]:43764: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.248.31.142
country_id: 1835841
description:
2025-02-07 00:22:25 dovecot_login authenticator failed for ([211.248.31.142]) [211.248.31.142]:37526: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.98.117
country_id: 1814991
description:
Feb  7 00:22:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.98.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.98.117
country_id: 1814991
description:
2025-02-07 00:22:33 dovecot_plain authenticator failed for ([27.223.98.117]) [27.223.98.117]:32775: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.63.42.76
country_id: 1814991
description:
Feb  7 00:22:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.63.42.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.63.42.76
country_id: 1814991
description:
2025-02-07 00:22:40 dovecot_login authenticator failed for ([111.63.42.76]) [111.63.42.76]:10374: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-02-07 00:22:07 dovecot_plain authenticator failed for ([103.29.185.162]) [103.29.185.162]:51982: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.248.31.142
country_id: 1835841
description:
Feb  7 00:22:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.248.31.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.250.7.67
country_id: 149590
description:
2025-02-07 00:22:24 dovecot_plain authenticator failed for ([197.250.7.67]) [197.250.7.67]:38504: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.128.202
country_id: 6252001
description:
Feb  7 00:22:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.128.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.220.196
country_id: 2017370
description:
2025-02-07 00:22:15 dovecot_plain authenticator failed for ([95.221.220.196]) [95.221.220.196]:60536: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.118.162.194
country_id: 2453866
description:
Feb  7 00:23:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.118.162.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.4.81.206
country_id: 2658434
description:
Feb  7 00:23:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.4.81.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
country_id: 2658434
description:
2025-02-07 00:23:03 dovecot_plain authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:34276: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.97.236.1
country_id: 3469034
description:
Feb  7 00:23:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.97.236.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.133.156.133
country_id: 294640
description:
Feb  7 00:23:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.133.156.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.133
country_id: 294640
description:
2025-02-07 00:23:18 dovecot_login authenticator failed for ([195.133.156.133]) [195.133.156.133]:46521: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.103.2
country_id: 1835841
description:
Feb  7 00:23:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.103.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.103.2
country_id: 1835841
description:
2025-02-07 00:23:23 dovecot_plain authenticator failed for ([121.189.103.2]) [121.189.103.2]:54514: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
country_id: 2453866
description:
2025-02-07 00:23:26 dovecot_login authenticator failed for ([154.118.162.194]) [154.118.162.194]:12415: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.122.179.118
country_id: 1835841
description:
Feb  7 00:23:29 ait sshd[1492683]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.122.179.118 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.122.179.118
country_id: 1835841
description:
Feb  7 00:23:29 ait sshd[1492683]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.122.179.118  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.26.153.102
country_id: 1819730
description:
Feb  7 00:22:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.26.153.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.102
country_id: 1819730
description:
2025-02-07 00:22:59 dovecot_plain authenticator failed for ([118.26.153.102]) [118.26.153.102]:23298: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.97.236.1
country_id: 3469034
description:
2025-02-07 00:23:17 dovecot_plain authenticator failed for (ip-189-97-236-1.user.vivozap.com.br) [189.97.236.1]:54586: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.214.153.51
country_id: 6251999
description:
Feb  7 00:24:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.214.153.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.102
country_id: 1814991
description:
2025-02-07 00:24:30 dovecot_plain authenticator failed for ([111.48.214.102]) [111.48.214.102]:32156: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.153.51
country_id: 6251999
description:
2025-02-07 00:24:11 dovecot_login authenticator failed for (ADMIN) [181.214.153.51]:49916: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-24.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.151.148
country_id: 3469034
description:
2025-02-07 00:24:26 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.151.148]:58180: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.102
country_id: 1814991
description:
Feb  7 00:24:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.40.10
country_id: 1814991
description:
Feb  7 00:24:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.40.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.58
country_id: 1814991
description:
2025-02-07 00:24:43 dovecot_plain authenticator failed for ([117.175.160.58]) [117.175.160.58]:46318: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.151.148
country_id: 3469034
description:
Feb  7 00:24:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.151.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.40.10
country_id: 1814991
description:
2025-02-07 00:24:41 dovecot_plain authenticator failed for ([112.6.73.140]) [221.2.40.10]:54844: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.58
country_id: 1814991
description:
Feb  7 00:24:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.58 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.5.171.47
country_id: 3469034
description:
[2025-02-07 00:24:55 +0100] info [webmaild] 45.5.171.47 - info@elma-hk.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.124.66
country_id: 1835841
description:
2025-02-07 00:25:14 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:57563: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.101.16.250
country_id: 272103
description:
Feb  7 00:25:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.101.16.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-02-07 00:25:22 dovecot_plain authenticator failed for ([185.101.16.250]) [185.101.16.250]:54129: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.175.26.2
country_id: 6252001
description:
Feb  7 00:25:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.175.26.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.221.104
country_id: 1814991
description:
2025-02-07 00:25:33 dovecot_plain authenticator failed for ([221.10.221.104]) [221.10.221.104]:33798: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.124.66
country_id: 1835841
description:
Feb  7 00:25:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.124.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.10.221.104
country_id: 1814991
description:
Feb  7 00:25:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.10.221.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.143.206
country_id: 1814991
description:
Feb  7 00:25:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.143.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.143.206
country_id: 1814991
description:
2025-02-07 00:25:43 dovecot_plain authenticator failed for ([112.194.143.206]) [112.194.143.206]:54530: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.198.54
country_id: 1814991
description:
2025-02-07 00:26:07 dovecot_plain authenticator failed for ([157.122.198.54]) [157.122.198.54]:58577: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.127.188
country_id: 1835841
description:
Feb  7 00:26:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.127.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.29
country_id: 6251999
description:
2025-02-07 00:26:25 dovecot_plain authenticator failed for ([207.219.222.29]) [207.219.222.29]:42778: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.168.71.109
country_id: 1835841
description:
Feb  7 00:26:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.168.71.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.194.34
country_id: 1880251
description:
2025-02-07 00:26:37 dovecot_plain authenticator failed for (34.194.75.138.unknown.m1.com.sg) [138.75.194.34]:50396: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.25.73.199
country_id: 2921044
description:
2025-02-07 00:26:38 dovecot_plain authenticator failed for ipb21949c7.dynamic.kabel-deutschland.de [178.25.73.199]:58436: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 00:26:40 ait sshd[1493971]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2025-02-07 00:26:05 dovecot_plain authenticator failed for ([213.230.127.217]) [213.230.127.217]:33364: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.218
country_id: 337996
description:
Feb  7 00:26:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.236.12
country_id: 1814991
description:
Feb  7 00:26:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.236.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.127.217
country_id: 1512440
description:
Feb  7 00:26:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.127.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.117.91.67
country_id: 1835841
description:
2025-02-07 00:26:14 dovecot_plain authenticator failed for ([220.117.91.67]) [220.117.91.67]:35880: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.124
country_id: 1036973
description:
Feb  7 00:26:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-02-07 00:26:17 dovecot_plain authenticator failed for ([196.28.226.124]) [196.28.226.124]:59943: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.127.188
country_id: 1835841
description:
2025-02-07 00:26:24 dovecot_plain authenticator failed for ([114.108.127.188]) [114.108.127.188]:47536: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.236.12
country_id: 1814991
description:
2025-02-07 00:26:33 dovecot_plain authenticator failed for ([39.165.236.12]) [39.165.236.12]:60966: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.110.29
country_id: 2661886
description:
2025-02-07 00:26:38 dovecot_plain authenticator failed for 81-237-110-29-no2300.tbcn.telia.com [81.237.110.29]:51876: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 00:26:40 ait sshd[1493971]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
country_id: 6252001
description:
2025-02-07 00:26:14 dovecot_plain authenticator failed for syn-208-105-196-214.biz.spectrum.com (rrcs-208-105-196-214.nys.biz.rr.com) [208.105.196.214]:54866: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 86.111.150.205
country_id: 99237
description:
[2025-02-07 00:26:46 +0100] info [webmaild] 86.111.150.205 - info@ijari.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.253.125.205
country_id: 1814991
description:
Feb  7 00:26:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.253.125.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.253.125.205
country_id: 1814991
description:
2025-02-07 00:26:09 dovecot_plain authenticator failed for ([183.253.125.205]) [183.253.125.205]:52643: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.21.28.237
country_id: 3175395
description:
Feb  7 00:26:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.21.28.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.194.34
country_id: 1880251
description:
Feb  7 00:26:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.194.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 00:26:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.21.28.237
country_id: 3175395
description:
2025-02-07 00:26:19 dovecot_plain authenticator failed for host-79-21-28-237.retail.telecomitalia.it [79.21.28.237]:39984: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.29
country_id: 6251999
description:
Feb  7 00:26:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.71.109
country_id: 1835841
description:
2025-02-07 00:26:28 dovecot_plain authenticator failed for ([112.168.71.109]) [112.168.71.109]:57206: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.187
country_id: 6252001
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads24b00174y||WPU:ads24b00174y||RSV:6.65||T:APACHE||MV:00-26.170.205.31.187


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.237.110.29
country_id: 2661886
description:
Feb  7 00:26:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.237.110.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.122.198.54
country_id: 1814991
description:
Feb  7 00:26:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.122.198.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.25.73.199
country_id: 2921044
description:
Feb  7 00:26:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.25.73.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.117.91.67
country_id: 1835841
description:
Feb  7 00:26:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.117.91.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.196.214
country_id: 6252001
description:
Feb  7 00:26:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.196.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2025-02-07 00:26:45 dovecot_plain authenticator failed for ([196.189.124.218]) [196.189.124.218]:59576: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
country_id: 1210997
description:
Feb  7 00:27:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
country_id: 1210997
description:
2025-02-07 00:27:04 dovecot_plain authenticator failed for ([103.103.35.130]) [103.103.35.130]:47032: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 00:27:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.94.75.146
country_id: 1149361
description:
Feb  7 00:27:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.94.75.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.210.188.130
country_id: 1814991
description:
2025-02-07 00:28:15 dovecot_plain authenticator failed for ([58.210.188.130]) [58.210.188.130]:57035: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.157.78
country_id: 6252001
description:
2025-02-07 00:28:47 dovecot_plain authenticator failed for c-73-0-157-78.hsd1.fl.comcast.net [73.0.157.78]:57778: 535 Incorrect authentication data (set_id=abs3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.210.188.130
country_id: 1814991
description:
Feb  7 00:28:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.210.188.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.123.33
country_id: 1814991
description:
Feb  7 00:28:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.123.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.123.33
country_id: 1814991
description:
2025-02-07 00:28:37 dovecot_plain authenticator failed for ([117.176.123.33]) [117.176.123.33]:44200: 535 Incorrect authentication data (set_id=abs3@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.146
country_id: 1149361
description:
2025-02-07 00:27:58 dovecot_plain authenticator failed for ([180.94.75.146]) [180.94.75.146]:54060: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.122.106
country_id: 357994
description:
2025-02-07 00:28:03 dovecot_login authenticator failed for (ADMIN) [188.214.122.106]:34928: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.0.157.78
country_id: 6252001
description:
Feb  7 00:28:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.0.157.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.26.56.66
country_id: 2510769
description:
2025-02-07 00:28:48 dovecot_plain authenticator failed for 66.red-80-26-56.staticip.rima-tde.net (localhost) [80.26.56.66]:41084: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.62.67.73
country_id: 2510769
description:
Feb  7 00:29:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.62.67.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.84.89
country_id: 3469034
description:
Feb  7 00:29:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.84.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.91.84.89
country_id: 3469034
description:
2025-02-07 00:29:10 dovecot_login authenticator failed for ([187.92.76.49]) [201.91.84.89]:57284: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.185.96.125
country_id: 294640
description:
Feb  7 00:29:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.185.96.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.125
country_id: 294640
description:
2025-02-07 00:29:16 dovecot_login authenticator failed for ([130.185.96.125]) [130.185.96.125]:58504: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 101.201.108.203
country_id: 1814991
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:00-29.101.201.108.203


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
country_id: 3996063
description:
2025-02-07 00:29:31 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:50691: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.107.247.202
country_id: 248816
description:
[2025-02-07 00:29:40 +0100] info [webmaild] 109.107.247.202 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.62.67.73
country_id: 2510769
description:
2025-02-07 00:29:06 dovecot_login authenticator failed for (73.pool85-62-67.dynamic.orange.es) [85.62.67.73]:35958: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 44.211.191.117
country_id: 6252001
description:
Feb  7 00:29:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 44.211.191.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.100.254
country_id: 2921044
description:
2025-02-07 00:29:08 dovecot_plain authenticator failed for tor-exit-3.zbau.f3netze.de (localhost) [185.220.100.254]:64651: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 44.211.191.117
country_id: 6252001
description:
2025-02-07 00:29:23 dovecot_login authenticator failed for ec2-44-211-191-117.compute-1.amazonaws.com [44.211.191.117]:44764: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.33.171.65
country_id: 3996063
description:
Feb  7 00:29:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.33.171.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.79.249.83
country_id: 6252001
description:
Feb  7 00:29:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.79.249.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.0.142.58
country_id: 1562822
description:
2025-02-07 00:29:49 dovecot_plain authenticator failed for (localhost) [117.0.142.58]:58171: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.100.254
country_id: 2921044
description:
Feb  7 00:29:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.100.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.79.249.83
country_id: 6252001
description:
2025-02-07 00:29:35 dovecot_login authenticator failed for ([50.79.249.83]) [50.79.249.83]:55344: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.38.85.125
country_id: 6252001
description:
Feb  7 00:30:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.38.85.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.227.194
country_id: 149590
description:
2025-02-07 00:30:41 dovecot_login authenticator failed for ([196.200.227.78]) [196.200.227.194]:40920: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
country_id: 1269750
description:
2025-02-07 00:30:42 dovecot_plain authenticator failed for (nsg-static-171.125.76.182-airtel.com) [182.76.87.90]:48256: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.255.45
country_id: 1210997
description:
2025-02-07 00:30:48 dovecot_login authenticator failed for (27-123-255-45-mcnbd.com) [27.123.255.45]:34034: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.172.131
country_id: 298795
description:
Feb  7 00:30:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.172.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.200.227.194
country_id: 149590
description:
Feb  7 00:30:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.200.227.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
country_id: 1269750
description:
Feb  7 00:30:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.38.85.125
country_id: 6252001
description:
2025-02-07 00:30:41 dovecot_login authenticator failed for (static.199.38.85.125.macminivault.com) [199.38.85.125]:54014: 535 Incorrect authentication data (set_id=dm)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:00-30.35.92.116.235


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.255.45
country_id: 1210997
description:
Feb  7 00:30:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.255.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.32.53.248
country_id: 3686110
description:
2025-02-07 00:30:14 dovecot_plain authenticator failed for (localhost) [179.32.53.248]:49175: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.172.131
country_id: 298795
description:
2025-02-07 00:30:31 dovecot_login authenticator failed for ([5.11.172.131]) [5.11.172.131]:38290: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.31.73
country_id: 6252001
description:
Feb  7 00:31:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.31.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.69.178.104
country_id: 3017382
description:
Feb  7 00:31:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.69.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.93.156.147
country_id: 798544
description:
Feb  7 00:30:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.93.156.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.93.156.147
country_id: 798544
description:
2025-02-07 00:30:59 dovecot_login authenticator failed for ip4-193-93-156-147.blue-net.com.pl ([193.93.156.149]) [193.93.156.147]:51424: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.11.126
country_id: 1814991
description:
2025-02-07 00:31:00 dovecot_login authenticator failed for ([220.182.11.126]) [220.182.11.126]:43172: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.192.94
country_id: 3469034
description:
Feb  7 00:31:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.192.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.195.179
country_id: 1835841
description:
2025-02-07 00:31:33 dovecot_plain authenticator failed for ([183.109.195.179]) [183.109.195.179]:50752: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.130
country_id: 1814991
description:
Feb  7 00:31:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.231.84.13
country_id: 1814991
description:
Feb  7 00:31:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.231.84.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.231.84.13
country_id: 1814991
description:
2025-02-07 00:31:50 dovecot_login authenticator failed for ([218.1.239.146]) [116.231.84.13]:6912: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.0.142.58
country_id: 1562822
description:
2025-02-07 00:31:05 dovecot_plain authenticator failed for (localhost) [117.0.142.58]:50915: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.89.72
country_id: 1814991
description:
Feb  7 00:31:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.89.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.195.179
country_id: 1835841
description:
Feb  7 00:31:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.195.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.161.16.240
country_id: 1835841
description:
Feb  7 00:31:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.161.16.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
country_id: 3017382
description:
2025-02-07 00:31:47 dovecot_plain authenticator failed for 104.178.69.85.rev.sfr.net [85.69.178.104]:50692: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.161.16.240
country_id: 1835841
description:
2025-02-07 00:31:23 dovecot_login authenticator failed for ([221.161.16.240]) [221.161.16.240]:34482: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.192.94
country_id: 3469034
description:
2025-02-07 00:31:35 dovecot_login authenticator failed for 186-247-192-94.user.veloxzone.com.br ([179.236.122.153]) [186.247.192.94]:42098: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.11.126
country_id: 1814991
description:
Feb  7 00:30:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.11.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.31.73
country_id: 6252001
description:
2025-02-07 00:31:06 dovecot_plain authenticator failed for ([65.76.31.73]) [65.76.31.73]:48816: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.89.72
country_id: 1814991
description:
2025-02-07 00:31:21 dovecot_plain authenticator failed for ([112.132.89.72]) [112.132.89.72]:59360: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.213
country_id: 1814991
description:
Feb  7 00:32:00 ait sshd[1496167]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.213 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.213
country_id: 1814991
description:
Feb  7 00:32:00 ait sshd[1496167]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.213  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.192.254
country_id: 3469034
description:
2025-02-07 00:32:28 dovecot_plain authenticator failed for ([200.223.193.9]) [200.223.192.254]:35372: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.181.210.98
country_id: 1814991
description:
Feb  7 00:31:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.181.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
country_id: 1814991
description:
Feb  7 00:32:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.113.122.243
country_id: 1835841
description:
2025-02-07 00:32:39 dovecot_login authenticator failed for ([210.113.122.243]) [210.113.122.243]:57202: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.181.74
country_id: 1210997
description:
2025-02-07 00:32:01 dovecot_login authenticator failed for ([103.65.227.72]) [114.130.181.74]:57508: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
country_id: 1814991
description:
2025-02-07 00:32:03 dovecot_login authenticator failed for ([122.225.203.106]) [122.225.203.106]:16458: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.181.210.98
country_id: 1814991
description:
2025-02-07 00:32:00 dovecot_login authenticator failed for ([221.181.210.98]) [221.181.210.98]:39157: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.225.203.106
country_id: 1814991
description:
Feb  7 00:32:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.225.203.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.13
country_id: 1819730
description:
Feb  7 00:32:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.7.10
country_id: 1814991
description:
2025-02-07 00:32:33 dovecot_login authenticator failed for ([120.194.7.10]) [120.194.7.10]:43669: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.181.74
country_id: 1210997
description:
Feb  7 00:31:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.181.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.196.230
country_id: 1814991
description:
2025-02-07 00:32:01 dovecot_plain authenticator failed for ([118.122.196.230]) [118.122.196.230]:36766: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.239.187.13
country_id: 1819730
description:
2025-02-07 00:32:37 dovecot_login authenticator failed for ([20.239.187.13]) [20.239.187.13]:36094: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
country_id: 1819730
description:
2025-02-07 00:32:14 dovecot_plain authenticator failed for ([121.202.152.13]) [121.202.152.13]:63793: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.7.10
country_id: 1814991
description:
Feb  7 00:32:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.7.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.113.122.243
country_id: 1835841
description:
Feb  7 00:32:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.113.122.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.99.168
country_id: 1880251
description:
2025-02-07 00:32:38 dovecot_plain authenticator failed for ([49.245.99.168]) [49.245.99.168]:44363: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.49.179.157
country_id: 6252001
description:
Feb  7 00:32:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.49.179.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.48.104.200
country_id: 1814991
description:
Feb  7 00:32:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.48.104.200 has been locked due to Imunify RBL


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.213
country_id: 1814991
description:
Feb  7 00:32:21 ait sshd[1496167]: error: maximum authentication attempts exceeded for root from 218.92.0.213 port 26928 ssh2 [preauth]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.223.192.254
country_id: 3469034
description:
Feb  7 00:32:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.223.192.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.239.187.13
country_id: 1819730
description:
Feb  7 00:32:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.239.187.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.99.168
country_id: 1880251
description:
Feb  7 00:32:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.99.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.130
country_id: 1814991
description:
Feb  7 00:31:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.196.230
country_id: 1814991
description:
Feb  7 00:31:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.196.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.49.179.157
country_id: 6252001
description:
2025-02-07 00:32:02 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:47922: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.48.104.200
country_id: 1814991
description:
2025-02-07 00:32:22 dovecot_login authenticator failed for ([112.48.104.200]) [112.48.104.200]:51038: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
country_id: 1814991
description:
Feb  7 00:33:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.190.150.4
country_id: 1269750
description:
Feb  7 00:33:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.190.150.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.239.241.198
country_id: 1814991
description:
2025-02-07 00:33:44 dovecot_login authenticator failed for ([115.239.241.198]) [115.239.241.198]:47574: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
country_id: 1835841
description:
Feb  7 00:33:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2025-02-07 00:33:50 dovecot_plain authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:33845: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.138.196.194
country_id: 3469034
description:
Feb  7 00:33:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.138.196.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.29.121.110
country_id: 3017382
description:
Feb  7 00:32:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.29.121.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.226.81
country_id: 1835841
description:
2025-02-07 00:33:33 dovecot_login authenticator failed for ([121.189.226.81]) [121.189.226.81]:38628: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.251.197.46
country_id: 1814991
description:
2025-02-07 00:33:39 dovecot_login authenticator failed for ([101.251.197.46]) [101.251.197.46]:41430: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.138.196.194
country_id: 3469034
description:
2025-02-07 00:33:40 dovecot_plain authenticator failed for ([200.138.196.194]) [200.138.196.194]:49474: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.251.197.46
country_id: 1814991
description:
Feb  7 00:33:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.251.197.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.144.16.16
country_id: 1814991
description:
Feb  7 00:33:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.144.16.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.29.121.110
country_id: 3017382
description:
2025-02-07 00:33:00 dovecot_plain authenticator failed for ([46.29.121.110]) [46.29.121.110]:33004: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.196.221.74
country_id: 2077456
description:
2025-02-07 00:33:10 dovecot_plain authenticator failed for ([159.196.221.74]) [159.196.221.74]:4939: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.190.150.4
country_id: 1269750
description:
2025-02-07 00:33:26 dovecot_login authenticator failed for ([203.190.150.4]) [203.190.150.4]:48236: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.226.81
country_id: 1835841
description:
Feb  7 00:33:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.226.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.237.119.118
country_id: 6252001
description:
Feb  7 00:33:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.237.119.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.206.23
country_id: 1814991
description:
Feb  7 00:33:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.206.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.206.23
country_id: 1814991
description:
2025-02-07 00:33:50 dovecot_login authenticator failed for ([111.39.206.23]) [111.39.206.23]:46175: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.218.101
country_id: 1269750
description:
2025-02-07 00:32:56 dovecot_plain authenticator failed for ([182.79.218.101]) [182.79.218.101]:56679: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.196.221.74
country_id: 2077456
description:
Feb  7 00:33:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.196.221.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.239.241.198
country_id: 1814991
description:
Feb  7 00:33:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.239.241.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2025-02-07 00:33:47 dovecot_login authenticator failed for ([203.252.10.3]) [203.252.10.3]:27010: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.194.181.238
country_id: 1835841
description:
Feb  7 00:33:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.194.181.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.194.181.238
country_id: 1835841
description:
2025-02-07 00:33:49 dovecot_login authenticator failed for ([175.194.181.238]) [175.194.181.238]:51376: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.39.158
country_id: 2017370
description:
Feb  7 00:33:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.39.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.122
country_id: 2077456
description:
Feb  7 00:33:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.122
country_id: 2077456
description:
2025-02-07 00:33:59 dovecot_plain authenticator failed for ([103.79.175.122]) [103.79.175.122]:48899: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.144.16.16
country_id: 1814991
description:
2025-02-07 00:33:51 dovecot_plain authenticator failed for ([219.144.16.16]) [219.144.16.16]:52069: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
country_id: 1814991
description:
2025-02-07 00:33:52 dovecot_login authenticator failed for ([27.223.100.90]) [27.223.100.90]:58680: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.238.206
country_id: 2017370
description:
Feb  7 00:33:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.238.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.176
country_id: 1269750
description:
Feb  7 00:34:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.123
country_id: 1036973
description:
2025-02-07 00:34:38 dovecot_plain authenticator failed for ([196.28.226.123]) [196.28.226.123]:44196: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.34
country_id: 99237
description:
Feb  7 00:34:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.238.206
country_id: 2017370
description:
2025-02-07 00:33:58 dovecot_login authenticator failed for ([95.221.238.206]) [95.221.238.206]:56188: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.39.158
country_id: 2017370
description:
2025-02-07 00:33:58 dovecot_login authenticator failed for 95-31-39-158.broadband.corbina.ru [95.31.39.158]:51546: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.80.209
country_id: 294640
description:
Feb  7 00:34:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.80.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.123
country_id: 1036973
description:
Feb  7 00:34:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.34
country_id: 99237
description:
2025-02-07 00:34:46 dovecot_login authenticator failed for ([65.20.204.34]) [65.20.204.34]:49785: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.176
country_id: 1269750
description:
2025-02-07 00:34:03 dovecot_login authenticator failed for (nsg-corporate-176.229.187.122.airtel.in) [122.187.229.176]:48415: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.80.209
country_id: 294640
description:
2025-02-07 00:34:14 dovecot_login authenticator failed for (2-55-80-209.orange.net.il) [2.55.80.209]:42908: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
country_id: 3932488
description:
2025-02-07 00:35:06 dovecot_login authenticator failed for ([200.37.179.83]) [200.37.179.83]:53015: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.166.207.76
country_id: 6252001
description:
Feb  7 00:35:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.166.207.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.207.76
country_id: 6252001
description:
2025-02-07 00:35:09 dovecot_login authenticator failed for wsip-70-166-207-76.ph.ph.cox.net (wsip-70-166-207-65.ph.ph.cox.net) [70.166.207.76]:55455: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.118.83.237
country_id: 6252001
description:
Feb  7 00:34:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.118.83.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.250
country_id: 1819730
description:
Feb  7 00:34:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.179.104
country_id: 6252001
description:
2025-02-07 00:35:26 dovecot_login authenticator failed for (23-94-179-104-host.colocrossing.com) [23.94.179.104]:46348: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.139.150.2
country_id: 6252001
description:
Feb  7 00:35:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.139.150.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.85.12.142
country_id: 1835841
description:
2025-02-07 00:35:21 dovecot_plain authenticator failed for ([61.85.12.142]) [61.85.12.142]:43914: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.20.26.201
country_id: 1668284
description:
Feb  7 00:35:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.20.26.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.118.83.237
country_id: 6252001
description:
2025-02-07 00:34:56 dovecot_login authenticator failed for syn-172-118-083-237.res.spectrum.com [172.118.83.237]:59338: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.205.14.196
country_id: 226074
description:
Feb  7 00:35:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.205.14.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.20.26.201
country_id: 1668284
description:
2025-02-07 00:35:25 dovecot_login authenticator failed for 211-20-26-201.hinet-ip.hinet.net [211.20.26.201]:45348: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.10.127.167
country_id: 1814991
description:
2025-02-07 00:34:55 dovecot_login authenticator failed for ([116.10.127.167]) [116.10.127.167]:51163: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.212.173.17
country_id: 1835841
description:
2025-02-07 00:34:57 dovecot_login authenticator failed for ([175.212.173.17]) [175.212.173.17]:44509: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.139.150.2
country_id: 6252001
description:
2025-02-07 00:35:02 dovecot_plain authenticator failed for 2.sub-166-139-150.myvzw.com [166.139.150.2]:48448: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.228.105.192
country_id: 1835841
description:
Feb  7 00:35:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.228.105.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.228.105.192
country_id: 1835841
description:
2025-02-07 00:35:45 dovecot_plain authenticator failed for ([58.228.105.192]) [58.228.105.192]:43935: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.212.173.17
country_id: 1835841
description:
Feb  7 00:34:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.212.173.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.250
country_id: 1819730
description:
2025-02-07 00:34:58 dovecot_login authenticator failed for ([121.202.154.250]) [121.202.154.250]:19355: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.205.14.196
country_id: 226074
description:
2025-02-07 00:35:15 dovecot_login authenticator failed for ([129.205.14.196]) [129.205.14.196]:48344: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.179.104
country_id: 6252001
description:
Feb  7 00:35:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.179.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.241.214.127
country_id: 1814991
description:
Feb  7 00:34:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.241.214.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.10.127.167
country_id: 1814991
description:
Feb  7 00:34:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.10.127.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 00:35:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.85.12.142
country_id: 1835841
description:
Feb  7 00:35:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.85.12.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.214.127
country_id: 1814991
description:
2025-02-07 00:34:52 dovecot_plain authenticator failed for ([223.241.214.127]) [223.241.214.127]:53709: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.37.179.83
country_id: 3932488
description:
Feb  7 00:35:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.37.179.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.73.16.145
country_id: 1562822
description:
2025-02-07 00:35:59 dovecot_plain authenticator failed for (adsl.viettel.vn) [115.73.16.145]:33432: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.107.55.163
country_id: 1814991
description:
2025-02-07 00:36:11 dovecot_login authenticator failed for ([113.107.55.163]) [113.107.55.163]:54501: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.152.225.154
country_id: 6251999
description:
Feb  7 00:36:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.152.225.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.9.74
country_id: 3469034
description:
Feb  7 00:36:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.9.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.48.197
country_id: 1269750
description:
Feb  7 00:36:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.48.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.93.183
country_id: 3469034
description:
Feb  7 00:36:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.93.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
country_id: 1819730
description:
2025-02-07 00:35:55 dovecot_login authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:11830: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.247.88
country_id: 1814991
description:
2025-02-07 00:36:08 dovecot_login authenticator failed for ([183.220.247.88]) [183.220.247.88]:42020: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.155.27.128
country_id: 2802361
description:
Feb  7 00:36:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.155.27.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.158.248.248
country_id: 2921044
description:
Feb  7 00:36:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.158.248.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2025-02-07 00:36:31 dovecot_login authenticator failed for ([179.181.133.153]) [179.181.133.153]:37922: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.172.48.197
country_id: 1269750
description:
2025-02-07 00:36:45 dovecot_login authenticator failed for ([103.172.48.197]) [103.172.48.197]:44714: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
country_id: 1819730
description:
Feb  7 00:35:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.247.88
country_id: 1814991
description:
Feb  7 00:36:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.247.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.200.51
country_id: 294640
description:
Feb  7 00:36:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.200.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.26.153.102
country_id: 1819730
description:
Feb  7 00:36:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.26.153.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.54.22.11
country_id: 1835841
description:
Feb  7 00:36:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.54.22.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
country_id: 1835841
description:
2025-02-07 00:36:34 dovecot_login authenticator failed for ([14.54.22.11]) [14.54.22.11]:32582: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2025-02-07 00:36:16 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:36798: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.158.248.248
country_id: 2921044
description:
2025-02-07 00:36:16 dovecot_login authenticator failed for ([193.158.248.248]) [193.158.248.248]:39616: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.200.51
country_id: 294640
description:
2025-02-07 00:36:22 dovecot_login authenticator failed for mail.infologic.co.il [85.130.200.51]:38488: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.13.138.138
country_id: 1814991
description:
Feb  7 00:36:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.13.138.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.13.138.138
country_id: 1814991
description:
2025-02-07 00:36:37 dovecot_login authenticator failed for (hn.kd.smx.adsl) [221.13.138.138]:53627: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
country_id: 3469034
description:
2025-02-07 00:36:49 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [189.115.93.183]:35568: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.107.55.163
country_id: 1814991
description:
Feb  7 00:36:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.107.55.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2025-02-07 00:36:13 dovecot_login authenticator failed for 128.27.155.104.bc.googleusercontent.com [104.155.27.128]:56830: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.85.137
country_id: 3469034
description:
Feb  7 00:36:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.85.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.181.133.153
country_id: 3469034
description:
Feb  7 00:36:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.181.133.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.86
country_id: 1835841
description:
Feb  7 00:36:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.86
country_id: 1835841
description:
2025-02-07 00:36:34 dovecot_login authenticator failed for ([58.230.236.86]) [58.230.236.86]:50734: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.73.16.145
country_id: 1562822
description:
Feb  7 00:35:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.73.16.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.102
country_id: 1819730
description:
2025-02-07 00:36:31 dovecot_login authenticator failed for ([118.26.153.102]) [118.26.153.102]:61206: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.9.74
country_id: 3469034
description:
2025-02-07 00:36:20 dovecot_login authenticator failed for (200151121049.user.veloxzone.com.br) [200.151.9.74]:39987: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.85.137
country_id: 3469034
description:
2025-02-07 00:36:22 dovecot_login authenticator failed for (177-174-85-129.user.vivozap.com.br) [177.174.85.137]:33105: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.124.241.142
country_id: 1835841
description:
2025-02-07 00:36:55 dovecot_plain authenticator failed for ([116.124.241.142]) [116.124.241.142]:53316: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
country_id: 2510769
description:
2025-02-07 00:36:57 dovecot_login authenticator failed for ([77.211.31.222]) [77.211.31.222]:52214: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.13.237.76
country_id: 1814991
description:
Feb  7 00:37:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.13.237.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.124.241.142
country_id: 1835841
description:
Feb  7 00:36:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.124.241.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.150
country_id: 1814991
description:
2025-02-07 00:37:35 dovecot_login authenticator failed for ([1.28.192.150]) [1.28.192.150]:46613: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.16.37.105
country_id: 1861060
description:
2025-02-07 00:37:01 dovecot_login authenticator failed for p95106-obmd01.osaka.ocn.ne.jp [211.16.37.105]:36727: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.230.100.252
country_id: 2287781
description:
Feb  7 00:37:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.230.100.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.130.20
country_id: 2077456
description:
2025-02-07 00:37:50 dovecot_login authenticator failed for ([202.62.130.20]) [202.62.130.20]:43102: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.211.31.222
country_id: 2510769
description:
Feb  7 00:36:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.211.31.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.230.100.252
country_id: 2287781
description:
2025-02-07 00:37:07 dovecot_plain authenticator failed for ([38.230.100.252]) [38.230.100.252]:17574: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.13.237.76
country_id: 1814991
description:
2025-02-07 00:37:31 dovecot_login authenticator failed for (hn.kd.ny.adsl) [123.13.237.76]:55868: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.150
country_id: 1814991
description:
Feb  7 00:37:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.62.130.20
country_id: 2077456
description:
Feb  7 00:37:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.62.130.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.16.37.105
country_id: 1861060
description:
Feb  7 00:36:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.16.37.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.217.105
country_id: 1861060
description:
Feb  7 00:38:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.217.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.217.105
country_id: 1861060
description:
2025-02-07 00:38:49 dovecot_plain authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:41846: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.146.121.14
country_id: 1814991
description:
Feb  7 00:39:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.146.121.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.146.121.14
country_id: 1814991
description:
2025-02-07 00:39:28 dovecot_plain authenticator failed for ([61.146.121.14]) [61.146.121.14]:46641: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.174.103.74
country_id: 6252001
description:
Feb  7 00:39:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.174.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.174.103.74
country_id: 6252001
description:
2025-02-07 00:39:39 dovecot_plain authenticator failed for 74-103-174-206.gci.net [206.174.103.74]:65216: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.187
country_id: 6252001
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads19b00218y||WPU:ads19b00218y||RSV:6.65||T:APACHE||MV:00-39.170.205.31.187


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.114.180.50
country_id: 1814991
description:
Feb  7 00:39:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.114.180.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.180.50
country_id: 1814991
description:
2025-02-07 00:39:03 dovecot_plain authenticator failed for ([124.114.180.50]) [124.114.180.50]:42538: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-38.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.0.186.121
country_id: 1814991
description:
2025-02-07 00:40:06 dovecot_plain authenticator failed for ([153.0.186.121]) [153.0.186.121]:39916: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.93.130
country_id: 1835841
description:
Feb  7 00:39:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.93.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.93.130
country_id: 1835841
description:
2025-02-07 00:39:53 dovecot_plain authenticator failed for ([211.109.93.130]) [211.109.93.130]:43476: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:00-40.35.92.116.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.129.114
country_id: 1835841
description:
2025-02-07 00:40:35 dovecot_login authenticator failed for ([14.48.129.114]) [14.48.129.114]:47386: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.230.100.252
country_id: 2287781
description:
2025-02-07 00:40:49 dovecot_plain authenticator failed for ([38.230.100.252]) [38.230.100.252]:25904: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.129.114
country_id: 1835841
description:
Feb  7 00:40:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.129.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.0.186.121
country_id: 1814991
description:
Feb  7 00:40:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.0.186.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.134.3.252
country_id: 6252001
description:
Feb  7 00:40:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.134.3.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.3.252
country_id: 6252001
description:
2025-02-07 00:40:22 dovecot_login authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:37468: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.230.100.252
country_id: 2287781
description:
Feb  7 00:40:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.230.100.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 00:41:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.67.143.142
country_id: 2328926
description:
Feb  7 00:41:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.67.143.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.67.143.142
country_id: 2328926
description:
2025-02-07 00:41:07 dovecot_plain authenticator failed for (netcomafrica.com) [41.67.143.142]:43906: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.87.10.83
country_id: 953987
description:
2025-02-07 00:42:32 dovecot_plain authenticator failed for ([197.87.10.83]) [197.87.10.83]:38176: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.217.70.151
country_id: 1814991
description:
2025-02-07 00:42:48 dovecot_plain authenticator failed for ([171.217.70.151]) [171.217.70.151]:38702: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.54.14
country_id: 3469034
description:
Feb  7 00:42:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.87.152.161
country_id: 2017370
description:
2025-02-07 00:42:41 dovecot_plain authenticator failed for (194.87.152.161-FTTB.planeta.tc) [194.87.152.161]:50722: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2025-02-07 00:42:42 dovecot_plain authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:57998: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.148.218.235
country_id: 2017370
description:
Feb  7 00:42:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.148.218.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.30
country_id: 1814991
description:
2025-02-07 00:42:50 dovecot_plain authenticator failed for ([60.167.19.30]) [60.167.19.30]:44050: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2025-02-07 00:42:32 dovecot_plain authenticator failed for ([196.28.226.66]) [196.28.226.66]:59988: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.54.14
country_id: 3469034
description:
2025-02-07 00:42:32 dovecot_plain authenticator failed for ([200.149.54.14]) [200.149.54.14]:47183: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.160.38.13
country_id: 2661886
description:
Feb  7 00:42:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.160.38.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.58
country_id: 2017370
description:
2025-02-07 00:42:35 dovecot_plain authenticator failed for ([178.178.222.58]) [178.178.222.58]:44662: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.233.85.194
country_id: 1814991
description:
2025-02-07 00:42:37 dovecot_plain authenticator failed for ([183.233.85.194]) [183.233.85.194]:37404: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.177.56
country_id: 6252001
description:
Feb  7 00:42:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.208.177.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.40.122.250
country_id: 2629691
description:
Feb  7 00:42:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.40.122.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.224.58.243
country_id: 1835841
description:
2025-02-07 00:42:00 dovecot_plain authenticator failed for ([1.224.58.243]) [1.224.58.243]:37222: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
country_id: 1562822
description:
2025-02-07 00:42:03 dovecot_plain authenticator failed for ([27.71.27.81]) [27.71.27.81]:17040: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.58.94
country_id: 1814991
description:
2025-02-07 00:42:46 dovecot_plain authenticator failed for ([183.238.58.94]) [183.238.58.94]:60730: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.30
country_id: 1814991
description:
Feb  7 00:42:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.47.48.178
country_id: 1814991
description:
Feb  7 00:42:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.47.48.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.253
country_id: 1668284
description:
2025-02-07 00:42:34 dovecot_plain authenticator failed for 111-70-23-253.emome-ip.hinet.net [111.70.23.253]:56489: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.58.94
country_id: 1814991
description:
Feb  7 00:42:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.58.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.87.10.83
country_id: 953987
description:
Feb  7 00:42:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.87.10.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.215.195.65
country_id: 6252001
description:
2025-02-07 00:42:30 dovecot_plain authenticator failed for (162-215-195-65.unifiedlayer.com) [162.215.195.65]:58344: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2025-02-07 00:42:34 dovecot_plain authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:48540: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.102.76.10
country_id: 3932488
description:
2025-02-07 00:42:37 dovecot_plain authenticator failed for ([148.102.73.4]) [148.102.76.10]:54730: 535 Incorrect authentication data (set_id=eng19b00160y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2025-02-07 00:42:41 dovecot_plain authenticator failed for ([74.208.177.56]) [74.208.177.56]:53124: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.185.159.132
country_id: 3865483
description:
Feb  7 00:42:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.185.159.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
country_id: 6252001
description:
2025-02-07 00:42:46 dovecot_plain authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:62891: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2025-02-07 00:42:38 dovecot_plain authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:26677: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.7.52.183
country_id: 1814991
description:
2025-02-07 00:42:39 dovecot_plain authenticator failed for ([110.7.52.183]) [110.7.52.183]:57754: 535 Incorrect authentication data (set_id=office@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.233.85.194
country_id: 1814991
description:
Feb  7 00:42:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.233.85.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.148.0.202
country_id: 6252001
description:
Feb  7 00:42:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.148.0.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
country_id: 130758
description:
Feb  7 00:42:15 ait sshd[1500319]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.137.159
country_id: 1269750
description:
Feb  7 00:42:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.137.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.118.234
country_id: 1880251
description:
Feb  7 00:42:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.199.118.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.28.61
country_id: 1814991
description:
Feb  7 00:42:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.66.190.67
country_id: 1269750
description:
Feb  7 00:42:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.66.190.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.102.76.10
country_id: 3932488
description:
Feb  7 00:42:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.102.76.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.109.33.120
country_id: 690791
description:
2025-02-07 00:42:13 dovecot_plain authenticator failed for rplus.dp.ua [77.109.33.120]:45842: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.222.137.41
country_id: 6251999
description:
Feb  7 00:42:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.222.137.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.66
country_id: 1036973
description:
Feb  7 00:42:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
country_id: 1835841
description:
Feb  7 00:42:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.47.48.178
country_id: 1814991
description:
2025-02-07 00:42:33 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:47588: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.217.70.151
country_id: 1814991
description:
Feb  7 00:42:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.217.70.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.109.33.120
country_id: 690791
description:
Feb  7 00:42:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.109.33.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.28.61
country_id: 1814991
description:
2025-02-07 00:42:15 dovecot_plain authenticator failed for ([60.173.88.145]) [111.39.28.61]:52726: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.166.179.34
country_id: 1880251
description:
Feb  7 00:42:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.166.179.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.195.65
country_id: 6252001
description:
Feb  7 00:42:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.215.195.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.87.152.161
country_id: 2017370
description:
Feb  7 00:42:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.87.152.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.196.130
country_id: 1814991
description:
Feb  7 00:42:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.196.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.179.34
country_id: 1880251
description:
2025-02-07 00:42:47 dovecot_plain authenticator failed for ([188.166.179.34]) [188.166.179.34]:44296: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.147.25.111
country_id: 1835841
description:
2025-02-07 00:42:50 dovecot_plain authenticator failed for ([121.147.25.111]) [121.147.25.111]:60056: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.14.232
country_id: 1512440
description:
Feb  7 00:42:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.14.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.253
country_id: 1668284
description:
Feb  7 00:42:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
country_id: 1835841
description:
2025-02-07 00:42:34 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:43468: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.160.38.13
country_id: 2661886
description:
2025-02-07 00:42:35 dovecot_plain authenticator failed for 89-160-38-13.cust.bredband2.com [89.160.38.13]:38332: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.222.137.41
country_id: 6251999
description:
2025-02-07 00:42:31 dovecot_plain authenticator failed for vps-09fc8581.vps.ovh.ca [51.222.137.41]:48558: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.66.190.67
country_id: 1269750
description:
2025-02-07 00:42:31 dovecot_plain authenticator failed for ([116.66.190.67]) [116.66.190.67]:36374: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.58
country_id: 2017370
description:
Feb  7 00:42:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.185.159.132
country_id: 3865483
description:
2025-02-07 00:42:45 dovecot_plain authenticator failed for (132.159.185.190.cable.dyn.ridsa.com.ar) [190.185.159.132]:44069: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.148.218.235
country_id: 2017370
description:
2025-02-07 00:42:46 dovecot_plain authenticator failed for ([185.148.218.235]) [185.148.218.235]:58766: 535 Incorrect authentication data (set_id=eng19b00160y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.81
country_id: 1562822
description:
Feb  7 00:42:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.27.81 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
country_id: 130758
description:
Feb  7 00:42:15 ait sshd[1500319]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.147.25.111
country_id: 1835841
description:
Feb  7 00:42:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.147.25.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.224.58.243
country_id: 1835841
description:
Feb  7 00:41:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.224.58.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.137.159
country_id: 1269750
description:
2025-02-07 00:42:34 dovecot_plain authenticator failed for (abts-tn-static-159.137.165.122.airtelbroadband.in) [122.165.137.159]:42724: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
country_id: 1562822
description:
2025-02-07 00:42:34 dovecot_plain authenticator failed for ([171.244.40.236]) [171.244.40.236]:15981: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.152.225.154
country_id: 6251999
description:
Feb  7 00:42:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.152.225.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
country_id: 1814991
description:
Feb  7 00:42:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.196.130
country_id: 1814991
description:
2025-02-07 00:42:46 dovecot_plain authenticator failed for ([39.152.196.130]) [39.152.196.130]:37028: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.14.232
country_id: 1512440
description:
2025-02-07 00:42:31 dovecot_plain authenticator failed for ([195.158.14.232]) [195.158.14.232]:56688: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
country_id: 1562822
description:
Feb  7 00:42:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.75.223.17
country_id: 1814991
description:
Feb  7 00:42:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.75.223.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 00:43:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.25.233.22
country_id: 1814991
description:
Feb  7 00:42:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.25.233.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.73
country_id: 1819730
description:
2025-02-07 00:42:55 dovecot_plain authenticator failed for (m121-202-155-73.smartone.com) [121.202.155.73]:8934: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
country_id: 3469034
description:
2025-02-07 00:42:57 dovecot_plain authenticator failed for (187-8-163-70.customer.tdatabrasil.net.br) [187.8.163.70]:52457: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
country_id: 2077456
description:
2025-02-07 00:43:12 dovecot_plain authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:43948: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.102.39.138
country_id: 3077311
description:
Feb  7 00:43:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.102.39.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.164.202.218
country_id: 1814991
description:
Feb  7 00:43:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.164.202.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.73
country_id: 1819730
description:
Feb  7 00:42:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
country_id: 3469034
description:
Feb  7 00:42:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.164.202.218
country_id: 1814991
description:
2025-02-07 00:43:27 dovecot_login authenticator failed for ([61.164.202.219]) [61.164.202.218]:46161: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.154.43
country_id: 1861060
description:
2025-02-07 00:43:38 dovecot_plain authenticator failed for p83044-obmd01.osaka.ocn.ne.jp [180.7.154.43]:60472: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.83.71.207
country_id: 3175395
description:
2025-02-07 00:43:04 dovecot_plain authenticator failed for ([151.83.71.207]) [151.83.71.207]:51492: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.154.43
country_id: 1861060
description:
Feb  7 00:43:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.154.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.253
country_id: 1819730
description:
Feb  7 00:42:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.126
country_id: 1149361
description:
2025-02-07 00:42:59 dovecot_plain authenticator failed for ([149.54.15.126]) [149.54.15.126]:53210: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.124.120
country_id: 1835841
description:
Feb  7 00:43:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.124.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.83.71.207
country_id: 3175395
description:
Feb  7 00:43:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.83.71.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.138
country_id: 3077311
description:
2025-02-07 00:43:26 dovecot_login authenticator failed for (ADMIN) [212.102.39.138]:32782: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.251.253.62
country_id: 1835841
description:
Feb  7 00:42:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.251.253.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.75.223.17
country_id: 1814991
description:
2025-02-07 00:42:53 dovecot_plain authenticator failed for ([111.75.223.19]) [111.75.223.17]:50386: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.15.126
country_id: 1149361
description:
Feb  7 00:42:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.15.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2025-02-07 00:43:04 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:48206: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.251.253.62
country_id: 1835841
description:
2025-02-07 00:42:54 dovecot_plain authenticator failed for ([219.251.253.62]) [219.251.253.62]:51085: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.253
country_id: 1819730
description:
2025-02-07 00:42:55 dovecot_plain authenticator failed for (m121-202-152-253.smartone.com) [121.202.152.253]:8746: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.25.233.22
country_id: 1814991
description:
2025-02-07 00:42:55 dovecot_plain authenticator failed for ([218.25.233.2]) [218.25.233.22]:44201: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.186.220.42
country_id: 1835841
description:
Feb  7 00:44:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.186.220.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.186.220.42
country_id: 1835841
description:
2025-02-07 00:44:04 dovecot_plain authenticator failed for ([211.186.220.42]) [211.186.220.42]:56661: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.213.111
country_id: 99237
description:
2025-02-07 00:44:19 dovecot_plain authenticator failed for ([65.20.213.111]) [65.20.213.111]:47104: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.242.149.240
country_id: 6252001
description:
Feb  7 00:44:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.242.149.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.242.149.240
country_id: 6252001
description:
2025-02-07 00:44:32 dovecot_plain authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:55124: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 00:44:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.192.20.166
country_id: 3175395
description:
Feb  7 00:43:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.192.20.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.30.108.247
country_id: 1168579
description:
Feb  7 00:43:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.30.108.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.30.108.247
country_id: 1168579
description:
2025-02-07 00:43:53 dovecot_plain authenticator failed for static-host119-30-108-247.link.net.pk [119.30.108.247]:52387: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2025-02-07 00:44:13 dovecot_plain authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:60855: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.57.104.252
country_id: 1522867
description:
2025-02-07 00:44:17 dovecot_plain authenticator failed for 95.57.104.252.dynamic.telecom.kz [95.57.104.252]:42012: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.134.209.86
country_id: 1814991
description:
2025-02-07 00:44:47 dovecot_plain authenticator failed for ([183.134.209.86]) [183.134.209.86]:45479: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
country_id: 1835841
description:
2025-02-07 00:43:57 dovecot_plain authenticator failed for ([1.227.228.136]) [1.227.228.136]:51286: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.34
country_id: 617790
description:
2025-02-07 00:43:59 dovecot_plain authenticator failed for ([185.167.56.34]) [185.167.56.34]:45466: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.40.122.250
country_id: 2629691
description:
Feb  7 00:44:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.40.122.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.41.103
country_id: 1814991
description:
Feb  7 00:44:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.41.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.41.103
country_id: 1814991
description:
2025-02-07 00:44:42 dovecot_plain authenticator failed for ([60.172.41.103]) [60.172.41.103]:43640: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.134.209.86
country_id: 1814991
description:
Feb  7 00:44:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.134.209.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.20.166
country_id: 3175395
description:
2025-02-07 00:43:52 dovecot_plain authenticator failed for ([2.192.20.166]) [2.192.20.166]:42246: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
country_id: 1835841
description:
Feb  7 00:43:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.34
country_id: 617790
description:
Feb  7 00:43:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.57.104.252
country_id: 1522867
description:
Feb  7 00:44:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.57.104.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.213.111
country_id: 99237
description:
Feb  7 00:44:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.213.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.21.141.54
country_id: 1269750
description:
Feb  7 00:45:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.21.141.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.21.141.54
country_id: 1269750
description:
2025-02-07 00:45:14 dovecot_plain authenticator failed for ([125.21.141.54]) [125.21.141.54]:54289: 535 Incorrect authentication data (set_id=ads21a00069y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 94.159.106.26
country_id: 2921044
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-45.94.159.106.26


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
country_id: 1210997
description:
Feb  7 00:45:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
country_id: 1210997
description:
2025-02-07 00:45:31 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:37580: 535 Incorrect authentication data (set_id=ads21a00069y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.109.37
country_id: 1210997
description:
Feb  7 00:44:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.245.109.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.245.109.37
country_id: 1210997
description:
2025-02-07 00:44:54 dovecot_plain authenticator failed for ([103.245.109.37]) [103.245.109.37]:50694: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.235.94
country_id: 1835841
description:
Feb  7 00:46:03 ait sshd[1501884]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.235.94 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
country_id: 1835841
description:
Feb  7 00:46:03 ait sshd[1501884]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.137.159
country_id: 1269750
description:
Feb  7 00:47:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.137.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.39.41.171
country_id: 1835841
description:
2025-02-07 00:47:43 dovecot_plain authenticator failed for ([14.39.41.171]) [14.39.41.171]:60141: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.132.226
country_id: 6290252
description:
Feb  7 00:47:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.132.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.39.41.171
country_id: 1835841
description:
Feb  7 00:47:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.39.41.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
country_id: 1694008
description:
Feb  7 00:47:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
country_id: 1694008
description:
2025-02-07 00:47:44 dovecot_plain authenticator failed for (70.246.50.116.ids.service.static.eastern-tele.com) [58.69.17.18]:33224: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.173.82.198
country_id: 1814991
description:
2025-02-07 00:47:46 dovecot_plain authenticator failed for ([222.173.82.198]) [222.173.82.198]:22210: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.177.247.242
country_id: 1269750
description:
2025-02-07 00:47:01 dovecot_plain authenticator failed for (host-247342.fivenetwork.com) [202.177.247.242]:38186: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.137.159
country_id: 1269750
description:
2025-02-07 00:47:31 dovecot_plain authenticator failed for (abts-tn-static-159.137.165.122.airtelbroadband.in) [122.165.137.159]:57650: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-02-07 00:47:42 dovecot_plain authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:39116: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.173.82.198
country_id: 1814991
description:
Feb  7 00:47:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.173.82.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.220.16.46
country_id: 1835841
description:
Feb  7 00:47:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.220.16.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.220.16.46
country_id: 1835841
description:
2025-02-07 00:47:48 dovecot_plain authenticator failed for ([119.220.16.46]) [119.220.16.46]:59159: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.234.132.226
country_id: 6290252
description:
2025-02-07 00:47:37 dovecot_plain authenticator failed for (static-TB-132-226.kbcnet.rs) [91.234.132.226]:56638: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.89.159.59
country_id: 3865483
description:
Feb  7 00:47:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.89.159.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.177.247.242
country_id: 1269750
description:
Feb  7 00:46:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.177.247.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.150.123.106
country_id: 1814991
description:
Feb  7 00:47:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.150.123.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.125.67.109
country_id: 1835841
description:
Feb  7 00:48:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.125.67.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.140.95.250
country_id: 1814991
description:
Feb  7 00:48:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.140.95.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.140.95.250
country_id: 1814991
description:
2025-02-07 00:48:10 dovecot_plain authenticator failed for ([113.140.95.250]) [113.140.95.250]:54852: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.123.106
country_id: 1814991
description:
2025-02-07 00:47:59 dovecot_plain authenticator failed for ([61.150.123.106]) [61.150.123.106]:55368: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2025-02-07 00:48:03 dovecot_plain authenticator failed for 029.191.76.219.static.netvigator.com [219.76.191.29]:64194: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.185.89.241
country_id: 1814991
description:
2025-02-07 00:48:24 dovecot_plain authenticator failed for ([39.185.89.241]) [39.185.89.241]:47527: 535 Incorrect authentication data (set_id=jkudzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.154.90.47
country_id: 1835841
description:
Feb  7 00:47:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.154.90.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.76.191.29
country_id: 1819730
description:
Feb  7 00:48:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.76.191.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.20.146
country_id: 2017370
description:
Feb  7 00:48:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.20.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.20.146
country_id: 2017370
description:
2025-02-07 00:48:05 dovecot_plain authenticator failed for ([31.173.20.146]) [31.173.20.146]:57096: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.125.67.109
country_id: 1835841
description:
2025-02-07 00:48:09 dovecot_plain authenticator failed for ([39.125.67.109]) [39.125.67.109]:50516: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.126.214
country_id: 1835841
description:
Feb  7 00:48:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.126.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.126.214
country_id: 1835841
description:
2025-02-07 00:48:23 dovecot_plain authenticator failed for ([175.205.126.214]) [175.205.126.214]:50224: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.141.211.58
country_id: 3469034
description:
Feb  7 00:47:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.141.211.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-02-07 00:47:55 dovecot_plain authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:39582: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.47
country_id: 1835841
description:
2025-02-07 00:47:56 dovecot_plain authenticator failed for ([121.154.90.47]) [121.154.90.47]:35972: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.22.99.2
country_id: 1814991
description:
Feb  7 00:48:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.22.99.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.22.99.2
country_id: 1814991
description:
2025-02-07 00:48:05 dovecot_plain authenticator failed for ([121.22.99.2]) [121.22.99.2]:55080: 535 Incorrect authentication data (set_id=jkudzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.185.89.241
country_id: 1814991
description:
Feb  7 00:48:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.185.89.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.13
country_id: 1819730
description:
2025-02-07 00:49:02 dovecot_login authenticator failed for 013.143.48.116.static.netvigator.com [116.48.143.13]:62427: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:00-49.35.92.116.235


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.84.18
country_id: 895949
description:
Feb  7 00:49:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.84.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.84.18
country_id: 895949
description:
2025-02-07 00:49:27 dovecot_login authenticator failed for ([41.216.84.18]) [41.216.84.18]:59632: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.210.27.53
country_id: 1814991
description:
Feb  7 00:49:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.210.27.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.210.27.53
country_id: 1814991
description:
2025-02-07 00:49:36 dovecot_plain authenticator failed for ([223.210.27.53]) [223.210.27.53]:59178: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.143.13
country_id: 1819730
description:
Feb  7 00:49:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.143.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.72
country_id: 298795
description:
Feb  7 00:49:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-02-07 00:50:18 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:40544: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.241.161
country_id: 1835841
description:
2025-02-07 00:50:32 dovecot_login authenticator failed for ([115.23.241.161]) [115.23.241.161]:55660: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.210.250
country_id: 3469034
description:
Feb  7 00:50:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.210.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.210.250
country_id: 3469034
description:
2025-02-07 00:50:39 dovecot_login authenticator failed for ([187.12.210.250]) [187.12.210.250]:42836: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
country_id: 3175395
description:
Feb  7 00:50:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.241.161
country_id: 1835841
description:
Feb  7 00:50:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.241.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.113.101
country_id: 1835841
description:
Feb  7 00:50:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.113.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.72
country_id: 298795
description:
2025-02-07 00:49:55 dovecot_plain authenticator failed for ([95.0.252.72]) [95.0.252.72]:47486: 535 Incorrect authentication data (set_id=awadzie)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 31.24.159.135
country_id: 2510769
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-50.31.24.159.135


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.175.110.3
country_id: 1814991
description:
Feb  7 00:50:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.175.110.3 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.189.0.73
country_id: 3469034
description:
[2025-02-07 00:49:53 +0100] info [webmaild] 191.189.0.73 - info@aitopen.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.175.110.3
country_id: 1814991
description:
2025-02-07 00:50:30 dovecot_plain authenticator failed for ([222.175.110.3]) [222.175.110.3]:40978: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.113.101
country_id: 1835841
description:
2025-02-07 00:50:43 dovecot_plain authenticator failed for ([211.48.113.101]) [211.48.113.101]:52746: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.72.12
country_id: 1814991
description:
2025-02-07 00:50:57 dovecot_login authenticator failed for ([120.236.72.12]) [120.236.72.12]:38185: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.26.64
country_id: 1562822
description:
Feb  7 00:51:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.26.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.26.64
country_id: 1562822
description:
2025-02-07 00:51:07 dovecot_login authenticator failed for ([27.71.26.64]) [27.71.26.64]:30323: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.14.123.250
country_id: 1880251
description:
Feb  7 00:51:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.14.123.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.14.123.250
country_id: 1880251
description:
2025-02-07 00:51:24 dovecot_login authenticator failed for bb116-14-123-250.singnet.com.sg [116.14.123.250]:54734: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.72.12
country_id: 1814991
description:
Feb  7 00:50:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.72.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.224.198
country_id: 99237
description:
Feb  7 00:52:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.224.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.224.198
country_id: 99237
description:
2025-02-07 00:52:37 dovecot_plain authenticator failed for (gumunprops) [65.20.224.198]:37966: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.74.136.134
country_id: 6252001
description:
Feb  7 00:52:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.74.136.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2025-02-07 00:52:41 dovecot_login authenticator failed for syn-050-074-136-134.biz.spectrum.com [50.74.136.134]:53564: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 00:52:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.4.102
country_id: 3469034
description:
Feb  7 00:53:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.4.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.208.197
country_id: 1814991
description:
Feb  7 00:53:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.208.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.87.251
country_id: 1814991
description:
2025-02-07 00:53:48 dovecot_plain authenticator failed for ([183.234.87.251]) [183.234.87.251]:56442: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.172.61.145
country_id: 1814991
description:
2025-02-07 00:53:50 dovecot_login authenticator failed for ([39.172.61.145]) [39.172.61.145]:57500: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.172.61.145
country_id: 1814991
description:
Feb  7 00:53:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.172.61.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.6.212.150
country_id: 1814991
description:
Feb  7 00:52:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.6.212.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.6.212.150
country_id: 1814991
description:
2025-02-07 00:52:54 dovecot_login authenticator failed for (hebei.6.60.in-addr.arpa) [60.6.212.150]:30864: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.110.111.38
country_id: 3469034
description:
[2025-02-07 00:53:12 +0100] info [webmaild] 189.110.111.38 - info@university-publishing.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.4.102
country_id: 3469034
description:
2025-02-07 00:53:29 dovecot_plain authenticator failed for ([200.149.4.102]) [200.149.4.102]:51270: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.208.197
country_id: 1814991
description:
2025-02-07 00:53:37 dovecot_login authenticator failed for ([111.48.208.197]) [111.48.208.197]:35532: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.87.251
country_id: 1814991
description:
Feb  7 00:53:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.87.251 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-53.80.76.51.123


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  7 00:54:04 ait sshd[1504764]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 00:54:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  7 00:54:04 ait sshd[1504764]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.235.94
country_id: 1835841
description:
Feb  7 00:54:32 ait sshd[1504847]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.235.94 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
country_id: 1835841
description:
Feb  7 00:54:32 ait sshd[1504847]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
country_id: 3175395
description:
Feb  7 00:55:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.142.135
country_id: 1562822
description:
Feb  7 00:54:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.142.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.158.42
country_id: 3469034
description:
Feb  7 00:55:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.158.42 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.200.92.122
country_id: 1210997
description:
[2025-02-07 00:55:12 +0100] info [webmaild] 103.200.92.122 - info@iric.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.142.135
country_id: 1562822
description:
2025-02-07 00:54:59 dovecot_login authenticator failed for ([171.244.142.135]) [171.244.142.135]:62938: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.158.42
country_id: 3469034
description:
2025-02-07 00:55:09 dovecot_login authenticator failed for (186-201-3-45.customer.tdatabrasil.net.br) [186.200.158.42]:57526: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-02-07 00:55:50 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:51234: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.233.21.109
country_id: 272103
description:
Feb  7 00:56:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.233.21.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2025-02-07 00:56:34 dovecot_plain authenticator failed for ([109.233.21.109]) [109.233.21.109]:38728: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.93.172.213
country_id: 1562822
description:
Feb  7 00:56:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.93.172.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.93.172.213
country_id: 1562822
description:
2025-02-07 00:56:44 dovecot_login authenticator failed for (static.vinacis.com) [180.93.172.213]:45554: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
country_id: 294640
description:
Feb  7 00:56:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
country_id: 294640
description:
2025-02-07 00:56:47 dovecot_plain authenticator failed for ([147.235.97.158]) [147.235.97.158]:61121: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.95.123.220
country_id: 6252001
description:
Feb  7 00:56:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.95.123.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.95.123.220
country_id: 6252001
description:
2025-02-07 00:56:02 dovecot_plain authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:34201: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.192
country_id: 2017370
description:
2025-02-07 00:57:39 dovecot_plain authenticator failed for ([178.178.194.192]) [178.178.194.192]:35432: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.187.146.68
country_id: 6252001
description:
2025-02-07 00:57:41 dovecot_login authenticator failed for ([38.187.146.68]) [38.187.146.68]:50425: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.75.189
country_id: 1814991
description:
2025-02-07 00:57:21 dovecot_login authenticator failed for ([183.236.75.189]) [183.236.75.189]:42124: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
country_id: 1269750
description:
2025-02-07 00:57:27 dovecot_plain authenticator failed for (nsg-static-171.125.76.182-airtel.com) [182.76.87.90]:36130: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.187.146.68
country_id: 6252001
description:
Feb  7 00:57:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.187.146.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.75.189
country_id: 1814991
description:
Feb  7 00:57:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.75.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.176
country_id: 1269750
description:
Feb  7 00:57:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.3.133.47
country_id: 1814991
description:
2025-02-07 00:57:07 dovecot_login authenticator failed for ([183.3.133.47]) [183.3.133.47]:38483: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
country_id: 1269750
description:
Feb  7 00:57:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.192
country_id: 2017370
description:
Feb  7 00:57:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.154.43
country_id: 1861060
description:
2025-02-07 00:57:40 dovecot_login authenticator failed for p83044-obmd01.osaka.ocn.ne.jp [180.7.154.43]:50939: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.3.133.47
country_id: 1814991
description:
Feb  7 00:57:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.3.133.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.114.254
country_id: 1814991
description:
Feb  7 00:57:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.114.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.114.254
country_id: 1814991
description:
2025-02-07 00:57:34 dovecot_plain authenticator failed for ([60.173.114.254]) [60.173.114.254]:43050: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.154.43
country_id: 1861060
description:
Feb  7 00:57:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.154.43 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 47.128.17.134
country_id: 1880251
description:
47.128.17.134 - - [07/Feb/2025:00:57:41 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17775583 HTTP/2.0" 404 150 lms.aitsmartschool.com "-" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.17.134


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.176
country_id: 1269750
description:
2025-02-07 00:57:28 dovecot_login authenticator failed for (nsg-corporate-176.229.187.122.airtel.in) [122.187.229.176]:33306: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:00-58.35.92.116.235


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.35
country_id: 1819730
description:
Feb  7 00:58:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.104.199.27
country_id: 1814991
description:
Feb  7 00:58:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.104.199.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-07 00:58:44 dovecot_login authenticator failed for 110-175-220-250.static.tpgi.com.au (60-242-84-9.static.tpgi.com.au) [110.175.220.250]:45133: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 00:57:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.134
country_id: 1819730
description:
Feb  7 00:57:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  7 00:58:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.218.133.106
country_id: 1269750
description:
2025-02-07 00:57:54 dovecot_login authenticator failed for ([103.218.133.106]) [103.218.133.106]:49059: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.154.94.85
country_id: 1819730
description:
Feb  7 00:57:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.154.94.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.154.94.85
country_id: 1819730
description:
2025-02-07 00:57:56 dovecot_plain authenticator failed for ([43.154.94.85]) [43.154.94.85]:48864: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.248.159.20
country_id: 1814991
description:
Feb  7 00:58:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.248.159.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.104.199.27
country_id: 1814991
description:
2025-02-07 00:58:22 dovecot_login authenticator failed for ([120.24.83.156]) [223.104.199.27]:49492: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.182.162
country_id: 1835841
description:
2025-02-07 00:58:32 dovecot_login authenticator failed for ([61.83.232.94]) [221.163.182.162]:40492: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.218.133.106
country_id: 1269750
description:
Feb  7 00:57:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.218.133.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.134
country_id: 1819730
description:
2025-02-07 00:58:01 dovecot_login authenticator failed for (m121-202-152-134.smartone.com) [121.202.152.134]:7300: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.163.182.162
country_id: 1835841
description:
Feb  7 00:58:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.163.182.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.155.170.146
country_id: 1814991
description:
Feb  7 00:58:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.155.170.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.248.159.20
country_id: 1814991
description:
2025-02-07 00:58:20 dovecot_login authenticator failed for ([58.248.159.20]) [58.248.159.20]:36193: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.35
country_id: 1819730
description:
2025-02-07 00:58:22 dovecot_plain authenticator failed for (m121-202-152-35.smartone.com) [121.202.152.35]:5805: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.149.57
country_id: 3469034
description:
2025-02-07 00:58:09 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.149.57]:42814: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.155.170.146
country_id: 1814991
description:
2025-02-07 00:58:10 dovecot_login authenticator failed for ([39.155.170.146]) [39.155.170.146]:42624: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.149.57
country_id: 3469034
description:
Feb  7 00:58:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.149.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.170.154
country_id: 1835841
description:
Feb  7 00:59:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.170.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.170.154
country_id: 1835841
description:
2025-02-07 00:59:24 dovecot_login authenticator failed for ([211.44.170.154]) [211.44.170.154]:54884: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.47.3.221
country_id: 1835841
description:
2025-02-07 00:59:26 dovecot_plain authenticator failed for ([14.47.3.221]) [14.47.3.221]:35414: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.55
country_id: 2017370
description:
Feb  7 00:59:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.54.14
country_id: 3469034
description:
2025-02-07 00:59:05 dovecot_login authenticator failed for ([200.149.54.14]) [200.149.54.14]:41877: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.55
country_id: 2017370
description:
2025-02-07 00:59:43 dovecot_login authenticator failed for ([178.178.222.55]) [178.178.222.55]:54290: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.14.33
country_id: 1835841
description:
2025-02-07 00:59:09 dovecot_login authenticator failed for ([59.2.14.33]) [59.2.14.33]:37660: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.175.8.140
country_id: 1835841
description:
Feb  7 00:59:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.175.8.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.237.119.118
country_id: 6252001
description:
Feb  7 00:59:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.237.119.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.150.182
country_id: 1168579
description:
2025-02-07 00:59:23 dovecot_login authenticator failed for ([182.176.150.182]) [182.176.150.182]:57293: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2025-02-07 00:59:37 dovecot_login authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:54899: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 00:58:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.54.14
country_id: 3469034
description:
Feb  7 00:59:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.14.33
country_id: 1835841
description:
Feb  7 00:59:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.14.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.175.8.140
country_id: 1835841
description:
2025-02-07 00:59:14 dovecot_plain authenticator failed for ([121.175.8.140]) [121.175.8.140]:40002: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.176.150.182
country_id: 1168579
description:
Feb  7 00:59:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.176.150.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.47.3.221
country_id: 1835841
description:
Feb  7 00:59:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.47.3.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.242.149.240
country_id: 6252001
description:
Feb  7 01:00:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.242.149.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.132.167.110
country_id: 1814991
description:
Feb  7 00:59:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.132.167.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.132.167.110
country_id: 1814991
description:
2025-02-07 00:59:55 dovecot_login authenticator failed for ([222.132.167.110]) [222.132.167.110]:45187: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.190.129.68
country_id: 1835841
description:
2025-02-07 01:00:58 dovecot_login authenticator failed for ([121.190.129.68]) [121.190.129.68]:45014: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.230.169.65
country_id: 3932488
description:
[2025-02-07 01:01:23 +0100] info [webmaild] 201.230.169.65 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.116.132
country_id: 1880251
description:
47.128.116.132 - - [07/Feb/2025:01:01:41 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18116221 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=121%2C198%2C95%2C79&filtering=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.116.132


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.20
country_id: 3175395
description:
2025-02-07 01:00:52 dovecot_login authenticator failed for (ADMIN) [156.146.41.20]:61126: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.67.38.27
country_id: 798544
description:
Feb  7 01:01:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.67.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.242.149.240
country_id: 6252001
description:
2025-02-07 01:00:51 dovecot_plain authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:42834: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.190.129.68
country_id: 1835841
description:
Feb  7 01:00:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.190.129.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
country_id: 798544
description:
2025-02-07 01:01:06 dovecot_plain authenticator failed for 89-67-38-27.dynamic.chello.pl [89.67.38.27]:57861: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  7 01:01:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-07 01:01:17 dovecot_login authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-177.static.tpgi.com.au) [110.175.220.250]:34582: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 01:02:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.12.179
country_id: 1269750
description:
Feb  7 01:02:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.12.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-02-07 01:02:22 dovecot_plain authenticator failed for ([128.185.12.179]) [128.185.12.179]:48832: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
country_id: 1835841
description:
Feb  7 01:02:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
country_id: 1835841
description:
2025-02-07 01:02:36 dovecot_plain authenticator failed for ([1.227.228.136]) [1.227.228.136]:52454: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.6.100
country_id: 1880251
description:
2025-02-07 01:03:42 dovecot_plain authenticator failed for (100.6.129.180.unknown.m1.com.sg) [180.129.6.100]:60755: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.53.126.112
country_id: 1835841
description:
2025-02-07 01:03:49 dovecot_plain authenticator failed for ([14.53.126.112]) [14.53.126.112]:59474: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.54.22.11
country_id: 1835841
description:
Feb  7 01:03:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.54.22.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
country_id: 3895114
description:
Feb  7 01:03:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2025-02-07 01:03:50 dovecot_plain authenticator failed for ([182.239.78.124]) [182.239.78.124]:47464: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.226.104
country_id: 1880251
description:
Feb  7 01:02:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.226.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.129.6.100
country_id: 1880251
description:
Feb  7 01:03:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.129.6.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.239.78.124
country_id: 1819730
description:
Feb  7 01:03:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.239.78.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
country_id: 1835841
description:
2025-02-07 01:03:19 dovecot_plain authenticator failed for ([14.54.22.11]) [14.54.22.11]:16246: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
country_id: 3895114
description:
2025-02-07 01:03:43 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:33028: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.53.126.112
country_id: 1835841
description:
Feb  7 01:03:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.53.126.112 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.190.77.219
country_id: 3469034
description:
[2025-02-07 01:02:58 +0100] info [webmaild] 177.190.77.219 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.226.104
country_id: 1880251
description:
2025-02-07 01:03:00 dovecot_plain authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:59816: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.248.7
country_id: 1861060
description:
Feb  7 01:04:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.99.168
country_id: 1880251
description:
Feb  7 01:03:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.99.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.215.195.65
country_id: 6252001
description:
2025-02-07 01:04:19 dovecot_plain authenticator failed for (162-215-195-65.unifiedlayer.com) [162.215.195.65]:51156: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
country_id: 99237
description:
Feb  7 01:04:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.190.39.142
country_id: 878675
description:
Feb  7 01:03:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.190.39.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.57.205.7
country_id: 1814991
description:
Feb  7 01:04:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.57.205.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.246
country_id: 1814991
description:
Feb  7 01:04:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.35.200.202
country_id: 2921044
description:
Feb  7 01:03:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.35.200.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.41.137
country_id: 337996
description:
Feb  7 01:04:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.41.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.207.117
country_id: 294640
description:
2025-02-07 01:04:46 dovecot_plain authenticator failed for bzq-85-130-207-117.static.bezeqint.net [85.130.207.117]:41548: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.241.247.150
country_id: 3469034
description:
Feb  7 01:04:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.241.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.212.68
country_id: 1814991
description:
2025-02-07 01:04:04 dovecot_plain authenticator failed for ([111.39.212.68]) [111.39.212.68]:58951: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
country_id: 2017370
description:
Feb  7 01:04:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
country_id: 2017370
description:
2025-02-07 01:04:27 dovecot_plain authenticator failed for (oluatongey) [77.51.214.170]:44690: 535 Incorrect authentication data (set_id=chavez_4068@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.174.233.64
country_id: 2661886
description:
Feb  7 01:04:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.174.233.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-02-07 01:04:48 dovecot_plain authenticator failed for ([65.20.205.197]) [65.20.205.197]:38889: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.212.68
country_id: 1814991
description:
Feb  7 01:04:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.212.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-02-07 01:04:14 dovecot_plain authenticator failed for ([196.203.231.220]) [196.203.231.220]:42036: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2025-02-07 01:04:48 dovecot_plain authenticator failed for ([196.190.43.139]) [196.190.41.137]:27607: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.47.66
country_id: 2328926
description:
2025-02-07 01:04:48 dovecot_plain authenticator failed for ([197.211.47.66]) [197.211.47.66]:37890: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-02-07 01:04:50 dovecot_plain authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:43248: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.254
country_id: 1668284
description:
2025-02-07 01:03:57 dovecot_plain authenticator failed for 111-70-23-254.emome-ip.hinet.net [111.70.23.254]:39753: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
country_id: 2017370
description:
2025-02-07 01:04:42 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:57236: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.207.117
country_id: 294640
description:
Feb  7 01:04:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.207.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.211.47.66
country_id: 2328926
description:
Feb  7 01:04:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.211.47.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.254
country_id: 1668284
description:
Feb  7 01:03:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.170.225.80
country_id: 1269750
description:
2025-02-07 01:04:50 dovecot_plain authenticator failed for ([103.170.225.80]) [103.170.225.80]:40082: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.170.225.80
country_id: 1269750
description:
Feb  7 01:04:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.170.225.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.69.142.186
country_id: 2077456
description:
2025-02-07 01:04:50 dovecot_plain authenticator failed for 61-69-142-186.tpgi.com.au [61.69.142.186]:57315: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 44.211.191.117
country_id: 6252001
description:
Feb  7 01:04:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 44.211.191.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.11.160.60
country_id: 1814991
description:
Feb  7 01:04:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.11.160.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.253.50
country_id: 1814991
description:
Feb  7 01:04:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.253.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.20.22.58
country_id: 6252001
description:
2025-02-07 01:04:49 dovecot_plain authenticator failed for (8-20-22-58.hwccustomers.com) [8.20.22.58]:49401: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.99.168
country_id: 1880251
description:
2025-02-07 01:03:54 dovecot_plain authenticator failed for ([49.245.99.168]) [49.245.99.168]:44307: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.212.153.73
country_id: 1880251
description:
Feb  7 01:04:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.212.153.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.12.68.242
country_id: 1814991
description:
Feb  7 01:04:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.12.68.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.217.105
country_id: 1861060
description:
2025-02-07 01:04:00 dovecot_plain authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:38272: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.128.19.228
country_id: 3017382
description:
Feb  7 01:04:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.128.19.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.24.194.207
country_id: 1835841
description:
Feb  7 01:04:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.24.194.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
country_id: 1835841
description:
Feb  7 01:04:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.200.202
country_id: 2921044
description:
2025-02-07 01:04:00 dovecot_plain authenticator failed for ([161.35.200.202]) [161.35.200.202]:33124: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
country_id: 2017370
description:
Feb  7 01:04:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.20.22.58
country_id: 6252001
description:
Feb  7 01:04:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.20.22.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.11.160.60
country_id: 1814991
description:
2025-02-07 01:04:50 dovecot_plain authenticator failed for ([121.11.160.60]) [121.11.160.60]:54705: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 44.211.191.117
country_id: 6252001
description:
2025-02-07 01:04:49 dovecot_plain authenticator failed for ec2-44-211-191-117.compute-1.amazonaws.com [44.211.191.117]:45502: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.174.233.64
country_id: 2661886
description:
2025-02-07 01:04:47 dovecot_plain authenticator failed for h-158-174-233-64.a192.priv.bahnhof.se [158.174.233.64]:57851: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.195.65
country_id: 6252001
description:
Feb  7 01:04:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.215.195.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.88.97.237
country_id: 2921044
description:
2025-02-07 01:04:31 dovecot_login authenticator failed for (ADMIN) [45.88.97.237]:57972: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.190.39.142
country_id: 878675
description:
2025-02-07 01:03:55 dovecot_plain authenticator failed for ([196.201.20.98]) [41.190.39.142]:33986: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.71.106
country_id: 1269750
description:
2025-02-07 01:04:48 dovecot_plain authenticator failed for (abts-kk-static-106.71.166.122.airtelbroadband.in) [122.166.71.106]:49778: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.71.106
country_id: 1269750
description:
Feb  7 01:04:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.71.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.217.105
country_id: 1861060
description:
Feb  7 01:03:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.217.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.69.142.186
country_id: 2077456
description:
Feb  7 01:04:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.69.142.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.132.43.94
country_id: 1814991
description:
Feb  7 01:04:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.132.43.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.112.71.128
country_id: 6252001
description:
2025-02-07 01:04:59 dovecot_plain authenticator failed for syn-070-112-071-128.res.spectrum.com [70.112.71.128]:60435: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
country_id: 3469034
description:
2025-02-07 01:05:05 dovecot_plain authenticator failed for (189-108-147-210.customer.tdatabrasil.net.br) [189.108.147.210]:56004: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.115.211
country_id: 1880251
description:
Feb  7 01:05:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.115.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.16.161.35
country_id: 953987
description:
Feb  7 01:05:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.16.161.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.237.42.54
country_id: 2017370
description:
Feb  7 01:05:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.237.42.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.154.94.85
country_id: 1819730
description:
Feb  7 01:04:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.154.94.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.183.225.156
country_id: 3658394
description:
Feb  7 01:04:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.183.225.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.237.42.54
country_id: 2017370
description:
2025-02-07 01:05:11 dovecot_plain authenticator failed for ([83.237.42.54]) [83.237.42.54]:40180: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.88.154.47
country_id: 1880251
description:
2025-02-07 01:04:58 dovecot_plain authenticator failed for (47.154.88.116.starhub.net.sg) [116.88.154.47]:49954: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.69.156
country_id: 2017370
description:
Feb  7 01:05:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.69.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.119.20.149
country_id: 1835841
description:
2025-02-07 01:05:07 dovecot_plain authenticator failed for ([175.119.20.149]) [175.119.20.149]:43863: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-02-07 01:05:07 dovecot_plain authenticator failed for ([196.191.212.235]) [213.55.85.202]:23366: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
country_id: 1210997
description:
2025-02-07 01:05:27 dovecot_plain authenticator failed for ([103.103.35.130]) [103.103.35.130]:44440: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.236.78
country_id: 1814991
description:
Feb  7 01:04:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.236.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
country_id: 2017370
description:
Feb  7 01:04:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.115.191.84
country_id: 1835841
description:
Feb  7 01:05:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.115.191.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.9.138
country_id: 1269750
description:
2025-02-07 01:05:34 dovecot_plain authenticator failed for ([103.83.9.138]) [103.83.9.138]:34260: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.241.247.150
country_id: 3469034
description:
2025-02-07 01:04:51 dovecot_plain authenticator failed for ([191.241.247.150]) [191.241.247.150]:62482: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.178
country_id: 1814991
description:
2025-02-07 01:05:18 dovecot_plain authenticator failed for ([116.113.253.178]) [116.113.253.178]:54045: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.248.223
country_id: 732800
description:
Feb  7 01:05:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.248.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-02-07 01:05:16 dovecot_plain authenticator failed for 95-87-248-223.ip.btc-net.bg (95-87-248-223.net1.bg) [95.87.248.223]:53502: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.115.76.186
country_id: 6252001
description:
2025-02-07 01:04:56 dovecot_plain authenticator failed for ool-45734cba.dyn.optonline.net [69.115.76.186]:59748: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.31.219
country_id: 1643084
description:
2025-02-07 01:05:07 dovecot_plain authenticator failed for ([103.115.31.219]) [103.115.31.219]:37208: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2025-02-07 01:05:14 dovecot_plain authenticator failed for ([94.131.211.168]) [94.131.211.168]:50430: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.128.19.228
country_id: 3017382
description:
2025-02-07 01:04:51 dovecot_plain authenticator failed for ([57.128.19.228]) [57.128.19.228]:40032: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.24.194.207
country_id: 1835841
description:
2025-02-07 01:04:52 dovecot_plain authenticator failed for ([59.24.194.207]) [59.24.194.207]:44791: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.189.61.162
country_id: 1814991
description:
Feb  7 01:05:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.189.61.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.212.38.130
country_id: 1814991
description:
Feb  7 01:04:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.212.38.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.132.43.94
country_id: 1814991
description:
2025-02-07 01:05:01 dovecot_plain authenticator failed for ([116.132.43.94]) [116.132.43.94]:39680: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.102.76.10
country_id: 3932488
description:
Feb  7 01:05:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.102.76.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
country_id: 3469034
description:
2025-02-07 01:05:04 dovecot_plain authenticator failed for 177-72-87-7.static.as262543.net.br (7.lifedns.com.br) [177.72.87.7]:60026: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.151
country_id: 2017370
description:
2025-02-07 01:05:20 dovecot_plain authenticator failed for ([178.178.194.151]) [178.178.194.151]:40020: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.18.3
country_id: 1835841
description:
2025-02-07 01:04:54 dovecot_plain authenticator failed for ([175.198.18.3]) [175.198.18.3]:65041: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.53
country_id: 99237
description:
2025-02-07 01:04:58 dovecot_plain authenticator failed for ([65.20.251.53]) [65.20.251.53]:52143: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.155.116
country_id: 3469034
description:
2025-02-07 01:05:00 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.155.116]:37144: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.22.182.230
country_id: 2921044
description:
2025-02-07 01:05:19 dovecot_plain authenticator failed for ip4d16b6e6.dynamic.kabel-deutschland.de [77.22.182.230]:50053: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.213.107
country_id: 1814991
description:
Feb  7 01:04:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.213.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.12.68.242
country_id: 1814991
description:
2025-02-07 01:04:51 dovecot_plain authenticator failed for ([210.12.68.242]) [210.12.68.242]:43752: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.27.158.165
country_id: 3175395
description:
2025-02-07 01:05:15 dovecot_plain authenticator failed for host-87-27-158-165.business.telecomitalia.it [87.27.158.165]:59964: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.253.178
country_id: 1814991
description:
Feb  7 01:05:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.253.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.69.156
country_id: 2017370
description:
2025-02-07 01:05:08 dovecot_plain authenticator failed for ([109.195.69.156]) [109.195.69.156]:27120: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.52.202.92
country_id: 1814991
description:
2025-02-07 01:05:10 dovecot_plain authenticator failed for ([123.52.202.92]) [123.52.202.92]:37270: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.250.128.5
country_id: 6252001
description:
Feb  7 01:05:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.250.128.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.128.162.146
country_id: 1814991
description:
2025-02-07 01:05:04 dovecot_plain authenticator failed for ([27.128.162.146]) [27.128.162.146]:49108: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.179.144.38
country_id: 3469034
description:
2025-02-07 01:05:11 dovecot_plain authenticator failed for ([45.179.144.38]) [45.179.144.38]:51150: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.139.39.150
country_id: 1814991
description:
Feb  7 01:05:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.139.39.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
country_id: 1835841
description:
2025-02-07 01:04:52 dovecot_plain authenticator failed for ([222.114.200.160]) [222.114.200.160]:41479: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.87.122.207
country_id: 1880251
description:
2025-02-07 01:05:00 dovecot_plain authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:36284: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.84.34.85
country_id: 1210997
description:
Feb  7 01:05:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.84.34.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.154.94.85
country_id: 1819730
description:
2025-02-07 01:04:58 dovecot_plain authenticator failed for ([43.154.94.85]) [43.154.94.85]:33866: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.220.235
country_id: 1814991
description:
Feb  7 01:05:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.220.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.29.176.41
country_id: 2510769
description:
2025-02-07 01:04:53 dovecot_plain authenticator failed for 41.red-80-29-176.dynamicip.rima-tde.net [80.29.176.41]:53596: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.200.227.194
country_id: 149590
description:
Feb  7 01:04:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.200.227.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.232.138
country_id: 6252001
description:
Feb  7 01:05:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.232.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.16.161.35
country_id: 953987
description:
2025-02-07 01:05:08 dovecot_plain authenticator failed for ([105.16.161.35]) [105.16.161.35]:37166: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.72.156
country_id: 2017370
description:
2025-02-07 01:05:12 dovecot_plain authenticator failed for ([95.165.72.156]) [95.165.72.156]:53354: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.75.225.206
country_id: 1814991
description:
2025-02-07 01:05:17 dovecot_plain authenticator failed for ([222.75.225.206]) [222.75.225.206]:49019: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.113.91
country_id: 1835841
description:
Feb  7 01:04:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.113.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.117.32.22
country_id: 2017370
description:
Feb  7 01:04:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.117.32.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.189.61.162
country_id: 1814991
description:
2025-02-07 01:05:07 dovecot_plain authenticator failed for ([61.189.61.162]) [61.189.61.162]:56144: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.188.40.123
country_id: 2017370
description:
Feb  7 01:05:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.188.40.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.55
country_id: 2017370
description:
2025-02-07 01:05:10 dovecot_plain authenticator failed for ([178.178.222.55]) [178.178.222.55]:56618: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.161
country_id: 1819730
description:
Feb  7 01:04:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.115.211
country_id: 1880251
description:
2025-02-07 01:05:07 dovecot_plain authenticator failed for (211.115.156.175.unknown.m1.com.sg) [175.156.115.211]:37472: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.132.137.230
country_id: 2017370
description:
Feb  7 01:05:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.132.137.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.72.156
country_id: 2017370
description:
Feb  7 01:05:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.72.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.151
country_id: 2017370
description:
Feb  7 01:05:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.83.9.138
country_id: 1269750
description:
Feb  7 01:05:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.83.9.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.213.107
country_id: 1814991
description:
2025-02-07 01:04:54 dovecot_plain authenticator failed for ([183.237.213.107]) [183.237.213.107]:34738: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.53
country_id: 99237
description:
Feb  7 01:04:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.144.140
country_id: 1814991
description:
2025-02-07 01:05:19 dovecot_plain authenticator failed for ([112.15.144.140]) [112.15.144.140]:55222: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.161.16.240
country_id: 1835841
description:
2025-02-07 01:05:01 dovecot_plain authenticator failed for ([221.161.16.240]) [221.161.16.240]:32837: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.52.202.92
country_id: 1814991
description:
Feb  7 01:05:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.52.202.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.57.205.7
country_id: 1814991
description:
2025-02-07 01:04:51 dovecot_plain authenticator failed for ([117.57.205.7]) [117.57.205.7]:51920: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-02-07 01:04:59 dovecot_plain authenticator failed for ([201.183.225.156]) [201.183.225.156]:38041: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.27.158.165
country_id: 3175395
description:
Feb  7 01:05:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.27.158.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.22.182.230
country_id: 2921044
description:
Feb  7 01:05:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.22.182.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.139.39.150
country_id: 1814991
description:
2025-02-07 01:05:18 dovecot_plain authenticator failed for ([182.139.39.150]) [182.139.39.150]:44724: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.27
country_id: 1814991
description:
2025-02-07 01:05:18 dovecot_plain authenticator failed for ([182.135.66.27]) [182.135.66.27]:44058: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.102.76.10
country_id: 3932488
description:
2025-02-07 01:05:04 dovecot_plain authenticator failed for ([148.102.73.4]) [148.102.76.10]:52292: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.31.219
country_id: 1643084
description:
Feb  7 01:05:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.31.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2025-02-07 01:04:53 dovecot_plain authenticator failed for ([175.206.113.91]) [175.206.113.91]:39874: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.115.191.84
country_id: 1835841
description:
2025-02-07 01:05:13 dovecot_plain authenticator failed for ([211.115.191.84]) [211.115.191.84]:48850: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.27
country_id: 1814991
description:
Feb  7 01:05:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.253.50
country_id: 1814991
description:
2025-02-07 01:04:51 dovecot_plain authenticator failed for ([112.91.253.50]) [112.91.253.50]:38798: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.153.73
country_id: 1880251
description:
2025-02-07 01:04:51 dovecot_plain authenticator failed for (80-184-100-101.myrepublic.com.sg) [218.212.153.73]:59794: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.233.96.106
country_id: 1814991
description:
Feb  7 01:04:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.233.96.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.117.32.22
country_id: 2017370
description:
2025-02-07 01:05:01 dovecot_plain authenticator failed for ([87.117.32.22]) [87.117.32.22]:52818: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.29.176.41
country_id: 2510769
description:
Feb  7 01:04:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.29.176.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.88.154.47
country_id: 1880251
description:
Feb  7 01:04:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.88.154.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-02-07 01:04:56 dovecot_plain authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:48404: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.89.232.138
country_id: 6252001
description:
2025-02-07 01:05:06 dovecot_plain authenticator failed for ([159.89.232.138]) [159.89.232.138]:15830: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.55
country_id: 2017370
description:
Feb  7 01:05:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.58
country_id: 2017370
description:
Feb  7 01:04:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2025-02-07 01:04:51 dovecot_plain authenticator failed for ([116.114.84.246]) [116.114.84.246]:51640: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.75.225.206
country_id: 1814991
description:
Feb  7 01:05:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.75.225.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.246.141
country_id: 290557
description:
2025-02-07 01:05:22 dovecot_plain authenticator failed for ([94.204.246.141]) [94.204.246.141]:35033: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.236.78
country_id: 1814991
description:
2025-02-07 01:04:54 dovecot_plain authenticator failed for ([27.45.236.78]) [27.45.236.78]:44257: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2025-02-07 01:05:12 dovecot_plain authenticator failed for (ppp075.bol-online.com) [202.84.34.85]:44300: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.161.16.240
country_id: 1835841
description:
Feb  7 01:04:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.161.16.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
country_id: 3469034
description:
Feb  7 01:05:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.119.20.149
country_id: 1835841
description:
Feb  7 01:05:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.119.20.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.144.140
country_id: 1814991
description:
Feb  7 01:05:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.144.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.198.18.3
country_id: 1835841
description:
Feb  7 01:04:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.198.18.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.102.148.242
country_id: 6252001
description:
Feb  7 01:04:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.102.148.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.161
country_id: 1819730
description:
2025-02-07 01:05:00 dovecot_plain authenticator failed for ([121.202.154.161]) [121.202.154.161]:52785: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.132.137.230
country_id: 2017370
description:
2025-02-07 01:05:07 dovecot_plain authenticator failed for ([78.132.137.230]) [78.132.137.230]:49106: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.188.40.123
country_id: 2017370
description:
2025-02-07 01:05:10 dovecot_plain authenticator failed for ([90.188.40.123]) [90.188.40.123]:40474: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.87.122.207
country_id: 1880251
description:
Feb  7 01:04:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.87.122.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.227.194
country_id: 149590
description:
2025-02-07 01:05:00 dovecot_plain authenticator failed for ([196.200.227.194]) [196.200.227.194]:54428: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.128.5
country_id: 6252001
description:
2025-02-07 01:05:05 dovecot_plain authenticator failed for ([170.250.128.5]) [170.250.128.5]:34744: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.155.116
country_id: 3469034
description:
Feb  7 01:04:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.155.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.115.76.186
country_id: 6252001
description:
Feb  7 01:04:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.115.76.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.38.130
country_id: 1814991
description:
2025-02-07 01:04:53 dovecot_plain authenticator failed for (130.38.212.118.adsl-pool.jx.chinaunicom.com) [118.212.38.130]:51116: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.112.71.128
country_id: 6252001
description:
Feb  7 01:04:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.112.71.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.233.96.106
country_id: 1814991
description:
2025-02-07 01:05:00 dovecot_plain authenticator failed for ([183.233.96.106]) [183.233.96.106]:48924: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.246.141
country_id: 290557
description:
Feb  7 01:05:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.246.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.58
country_id: 2017370
description:
2025-02-07 01:04:53 dovecot_plain authenticator failed for ([178.178.222.58]) [178.178.222.58]:48216: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.220.235
country_id: 1814991
description:
2025-02-07 01:05:08 dovecot_plain authenticator failed for ([118.122.220.235]) [118.122.220.235]:41484: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.131.211.168
country_id: 690791
description:
Feb  7 01:05:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.131.211.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.128.162.146
country_id: 1814991
description:
Feb  7 01:05:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.128.162.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.144.38
country_id: 3469034
description:
Feb  7 01:05:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.144.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
country_id: 337996
description:
Feb  7 01:05:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
country_id: 2017370
description:
2025-02-07 01:04:59 dovecot_plain authenticator failed for (13-78-123-185.host.cirex.ru) [185.123.78.13]:56307: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
country_id: 3351879
description:
2025-02-07 01:06:41 dovecot_login authenticator failed for (cust61-165.63.41.tvcabo.ao) [41.63.165.61]:31975: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.162.227
country_id: 2017370
description:
2025-02-07 01:06:04 dovecot_plain authenticator failed for broadband-178-140-162-227.ip.moscow.rt.ru [178.140.162.227]:60724: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
country_id: 6252001
description:
Feb  7 01:06:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.61.6
country_id: 290557
description:
Feb  7 01:06:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.61.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2025-02-07 01:06:28 dovecot_login authenticator failed for ([5.32.61.6]) [5.32.61.6]:39654: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.165.61
country_id: 3351879
description:
Feb  7 01:06:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.165.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.162.227
country_id: 2017370
description:
Feb  7 01:06:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.162.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-02-07 01:06:31 dovecot_plain authenticator failed for ([216.194.174.27]) [216.194.174.27]:25261: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.44
country_id: 6251999
description:
2025-02-07 01:07:28 dovecot_plain authenticator failed for ([207.219.222.44]) [207.219.222.44]:44535: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.227
country_id: 3469034
description:
Feb  7 01:07:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.170.35.50
country_id: 6252001
description:
Feb  7 01:07:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.170.35.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-02-07 01:07:43 dovecot_plain authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:53186: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.206.19
country_id: 6252001
description:
Feb  7 01:07:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.206.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.21.171
country_id: 1668284
description:
Feb  7 01:07:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.21.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.21.171
country_id: 1668284
description:
2025-02-07 01:07:47 dovecot_plain authenticator failed for 111-70-21-171.emome-ip.hinet.net [111.70.21.171]:45105: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 01:07:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.207.254.114
country_id: 6252001
description:
Feb  7 01:07:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.207.254.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.0.157.78
country_id: 6252001
description:
Feb  7 01:07:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.0.157.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.203.77.30
country_id: 6252001
description:
2025-02-07 01:07:43 dovecot_plain authenticator failed for ([50.203.77.30]) [50.203.77.30]:54413: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.206.19
country_id: 6252001
description:
2025-02-07 01:07:17 dovecot_plain authenticator failed for syn-076-176-206-019.res.spectrum.com [76.176.206.19]:53754: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2025-02-07 01:06:57 dovecot_plain authenticator failed for ([213.55.79.199]) [213.55.79.195]:49000: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.157.78
country_id: 6252001
description:
2025-02-07 01:07:37 dovecot_login authenticator failed for c-73-0-157-78.hsd1.fl.comcast.net [73.0.157.78]:51672: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.76.95.152
country_id: 2017370
description:
2025-02-07 01:07:48 dovecot_plain authenticator failed for ([62.76.95.152]) [62.76.95.152]:45356: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.170.35.50
country_id: 6252001
description:
2025-02-07 01:07:41 dovecot_plain authenticator failed for 50.35.170.34.bc.googleusercontent.com [34.170.35.50]:49444: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.7.248.50
country_id: 1814991
description:
Feb  7 01:07:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.7.248.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.76.95.152
country_id: 2017370
description:
Feb  7 01:07:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.76.95.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.207.254.114
country_id: 6252001
description:
2025-02-07 01:07:28 dovecot_login authenticator failed for static-138-207-254-114.paw.cpe.atlanticbb.net [138.207.254.114]:43890: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.227
country_id: 3469034
description:
2025-02-07 01:07:32 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.227]:57476: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
country_id: 2017370
description:
2025-02-07 01:07:36 dovecot_plain authenticator failed for (13-78-123-185.host.cirex.ru) [185.123.78.13]:61996: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.203.77.30
country_id: 6252001
description:
Feb  7 01:07:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.203.77.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.7.248.50
country_id: 1814991
description:
2025-02-07 01:07:46 dovecot_plain authenticator failed for ([116.7.248.50]) [116.7.248.50]:56584: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.79.195
country_id: 337996
description:
Feb  7 01:06:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.79.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.44
country_id: 6251999
description:
Feb  7 01:07:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
country_id: 2017370
description:
Feb  7 01:07:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.76.194.159
country_id: 6252001
description:
Feb  7 01:07:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.76.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.20
country_id: 1269750
description:
Feb  7 01:07:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.20 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.157.121.211
country_id: 690791
description:
[2025-02-07 01:08:27 +0100] info [webmaild] 185.157.121.211 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 01:08:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.151.150
country_id: 3469034
description:
Feb  7 01:07:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.151.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.151.150
country_id: 3469034
description:
2025-02-07 01:07:55 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.151.150]:34434: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.115
country_id: 1819730
description:
2025-02-07 01:08:03 dovecot_plain authenticator failed for (m121-202-152-115.smartone.com) [121.202.152.115]:65208: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.115
country_id: 1819730
description:
Feb  7 01:08:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.98.10.109
country_id: 690791
description:
2025-02-07 01:07:54 dovecot_plain authenticator failed for ([46.98.10.109]) [46.98.10.109]:56984: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-02-07 01:07:59 dovecot_plain authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:39878: 535 Incorrect authentication data (set_id=awadzie)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:01-08.35.92.116.235


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.217.105
country_id: 1861060
description:
Feb  7 01:08:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.217.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.124.120
country_id: 1835841
description:
Feb  7 01:08:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.124.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.217.105
country_id: 1861060
description:
2025-02-07 01:08:02 dovecot_plain authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:37090: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2025-02-07 01:08:04 dovecot_plain authenticator failed for ([125.139.124.120]) [125.139.124.120]:42870: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.98.10.109
country_id: 690791
description:
Feb  7 01:07:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.98.10.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.20
country_id: 1269750
description:
2025-02-07 01:07:52 dovecot_plain authenticator failed for ([103.190.91.20]) [103.190.91.20]:37827: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.132.238.43
country_id: 6252001
description:
Feb  7 01:07:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.132.238.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.46
country_id: 290557
description:
2025-02-07 01:09:18 dovecot_login authenticator failed for ([91.73.195.46]) [91.73.195.46]:45781: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.48.197
country_id: 1269750
description:
Feb  7 01:09:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.48.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.46.7
country_id: 1819730
description:
Feb  7 01:09:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.46.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.7
country_id: 1819730
description:
2025-02-07 01:09:26 dovecot_plain authenticator failed for 007.46.246.220.static.netvigator.com [220.246.46.7]:57237: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.94.18.69
country_id: 3017382
description:
Feb  7 01:09:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.94.18.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.216.120.234
country_id: 6252001
description:
2025-02-07 01:09:04 dovecot_plain authenticator failed for 76-216-120-234.lightspeed.tukrga.sbcglobal.net [76.216.120.234]:43978: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.73.195.46
country_id: 290557
description:
Feb  7 01:09:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.73.195.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.94.18.69
country_id: 3017382
description:
2025-02-07 01:09:47 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:46206: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.179.123.172
country_id: 1814991
description:
2025-02-07 01:09:11 dovecot_plain authenticator failed for ([163.179.123.172]) [163.179.123.172]:58667: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.191.163.102
country_id: 1814991
description:
Feb  7 01:09:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.191.163.102 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:01-08.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
country_id: 3469034
description:
Feb  7 01:09:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.172.48.197
country_id: 1269750
description:
2025-02-07 01:09:23 dovecot_plain authenticator failed for ([103.172.48.197]) [103.172.48.197]:57104: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.204.162.116
country_id: 2017370
description:
Feb  7 01:09:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.204.162.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.204.162.116
country_id: 2017370
description:
2025-02-07 01:09:25 dovecot_plain authenticator failed for ([82.204.162.116]) [82.204.162.116]:55524: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
country_id: 2661886
description:
Feb  7 01:09:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
country_id: 2661886
description:
2025-02-07 01:09:06 dovecot_login authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:39648: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
country_id: 3469034
description:
2025-02-07 01:09:11 dovecot_plain authenticator failed for (189-56-79-105.customer.tdatabrasil.net.br) [186.200.249.162]:47667: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.179.123.172
country_id: 1814991
description:
Feb  7 01:09:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.179.123.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.191.163.102
country_id: 1814991
description:
2025-02-07 01:09:37 dovecot_plain authenticator failed for ([61.191.163.102]) [61.191.163.102]:43950: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.216.120.234
country_id: 6252001
description:
Feb  7 01:09:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.216.120.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 01:12:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.148.199.165
country_id: 2077456
description:
Feb  7 01:11:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.148.199.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-02-07 01:11:54 dovecot_plain authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:46913: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
country_id: 2017370
description:
Feb  7 01:12:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
country_id: 2017370
description:
2025-02-07 01:12:03 dovecot_plain authenticator failed for (12-78-123-185.host.cirex.ru) [185.123.78.13]:3118: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.172.72
country_id: 1819730
description:
Feb  7 01:13:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.172.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.172.72
country_id: 1819730
description:
2025-02-07 01:13:03 dovecot_plain authenticator failed for (223-197-172-72.static.imsbiz.com) [223.197.172.72]:51086: 535 Incorrect authentication data (set_id=ads89b99891y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 01:13:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.165.222
country_id: 1814991
description:
Feb  7 01:12:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.165.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.165.222
country_id: 1814991
description:
2025-02-07 01:12:52 dovecot_plain authenticator failed for ([183.247.165.222]) [183.247.165.222]:52218: 535 Incorrect authentication data (set_id=ads89b99891y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 01:14:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
country_id: 130758
description:
Feb  7 01:14:12 ait sshd[1512537]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
country_id: 130758
description:
Feb  7 01:14:12 ait sshd[1512537]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.129.245.249
country_id: 1814991
description:
Feb  7 01:15:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.129.245.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2025-02-07 01:15:42 dovecot_plain authenticator failed for ([123.129.245.249]) [123.129.245.249]:43733: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.12.179
country_id: 1269750
description:
Feb  7 01:15:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.12.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-02-07 01:15:47 dovecot_plain authenticator failed for ([128.185.12.179]) [128.185.12.179]:54354: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.19.149
country_id: 1668284
description:
Feb  7 01:15:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.19.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.19.149
country_id: 1668284
description:
2025-02-07 01:15:27 dovecot_login authenticator failed for 111-70-19-149.emome-ip.hinet.net [111.70.19.149]:53025: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.70.94.155
country_id: 1814991
description:
Feb  7 01:15:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.70.94.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.70.94.155
country_id: 1814991
description:
2025-02-07 01:15:38 dovecot_login authenticator failed for ([117.70.94.155]) [117.70.94.155]:54300: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.150.100.139
country_id: 6252001
description:
2025-02-07 01:16:24 dovecot_plain authenticator failed for ([107.150.100.139]) [107.150.100.139]:26112: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.69.157.215
country_id: 3175395
description:
Feb  7 01:16:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.69.157.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.233.4.50
country_id: 1814991
description:
Feb  7 01:16:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.233.4.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.254.67
country_id: 1835841
description:
2025-02-07 01:16:40 dovecot_plain authenticator failed for ([183.108.254.67]) [183.108.254.67]:54877: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.16
country_id: 1819730
description:
Feb  7 01:16:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.137
country_id: 2017370
description:
Feb  7 01:16:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.121.69
country_id: 1814991
description:
2025-02-07 01:16:32 dovecot_plain authenticator failed for ([183.238.121.69]) [183.238.121.69]:44566: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.159.57.4
country_id: 1814991
description:
Feb  7 01:16:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.159.57.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.254.67
country_id: 1835841
description:
Feb  7 01:16:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.108.70.38
country_id: 1814991
description:
Feb  7 01:16:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.108.70.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.100.151
country_id: 2750405
description:
Feb  7 01:15:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.38.100.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.181.19.131
country_id: 3923057
description:
2025-02-07 01:16:16 dovecot_plain authenticator failed for static-190-181-19-131.acelerate.net [190.181.19.131]:52108: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.90.195.68
country_id: 953987
description:
Feb  7 01:16:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.90.195.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.233.4.50
country_id: 1814991
description:
2025-02-07 01:16:33 dovecot_plain authenticator failed for ([61.233.4.50]) [61.233.4.50]:37324: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.160.128.46
country_id: 3144096
description:
2025-02-07 01:16:17 dovecot_plain authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:38625: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.172.72
country_id: 1819730
description:
2025-02-07 01:16:17 dovecot_plain authenticator failed for (223-197-172-72.static.imsbiz.com) [223.197.172.72]:54444: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.154.149
country_id: 1880251
description:
2025-02-07 01:16:20 dovecot_plain authenticator failed for ([175.156.154.149]) [175.156.154.149]:48816: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.136
country_id: 2017370
description:
2025-02-07 01:16:30 dovecot_plain authenticator failed for ([178.178.194.136]) [178.178.194.136]:40862: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.163.182.162
country_id: 1835841
description:
Feb  7 01:16:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.163.182.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2025-02-07 01:16:17 dovecot_plain authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:36518: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.154.149
country_id: 1880251
description:
Feb  7 01:16:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.154.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.205.232
country_id: 1269750
description:
Feb  7 01:16:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.205.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
country_id: 3469034
description:
2025-02-07 01:16:14 dovecot_plain authenticator failed for (18776174254.telemar.net.br) [187.76.174.254]:43712: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  7 01:16:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.93.177.228
country_id: 1269750
description:
Feb  7 01:16:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.93.177.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.69.157.215
country_id: 3175395
description:
2025-02-07 01:16:31 dovecot_plain authenticator failed for ([151.69.157.215]) [151.69.157.215]:57714: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.208.186.206
country_id: 1835841
description:
Feb  7 01:16:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.208.186.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2025-02-07 01:16:31 dovecot_plain authenticator failed for ([111.93.177.228]) [111.93.177.228]:39148: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.137
country_id: 2017370
description:
2025-02-07 01:16:19 dovecot_plain authenticator failed for ([178.178.194.137]) [178.178.194.137]:46904: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-07 01:16:19 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-173.static.tpgi.com.au) [110.175.220.250]:53806: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.208.186.206
country_id: 1835841
description:
2025-02-07 01:16:19 dovecot_plain authenticator failed for ([175.208.186.206]) [175.208.186.206]:43268: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.216.77.3
country_id: 1814991
description:
2025-02-07 01:16:24 dovecot_plain authenticator failed for ([60.216.77.3]) [60.216.77.3]:33651: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.108.70.38
country_id: 1814991
description:
2025-02-07 01:16:42 dovecot_plain authenticator failed for ([218.108.70.38]) [218.108.70.38]:36776: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.151.45.136
country_id: 1814991
description:
2025-02-07 01:16:44 dovecot_plain authenticator failed for ([182.151.45.136]) [182.151.45.136]:55085: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.68.226.171
country_id: 3017382
description:
Feb  7 01:16:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.68.226.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.97.236.1
country_id: 3469034
description:
2025-02-07 01:16:17 dovecot_plain authenticator failed for (ip-189-97-236-1.user.vivozap.com.br) [189.97.236.1]:50751: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.59.2
country_id: 6252001
description:
2025-02-07 01:16:12 dovecot_plain authenticator failed for syn-074-062-059-002.biz.spectrum.com [74.62.59.2]:33188: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.19.131
country_id: 3923057
description:
Feb  7 01:16:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.19.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.90.195.68
country_id: 953987
description:
2025-02-07 01:16:28 dovecot_plain authenticator failed for (197-90-195-68.dyn.mweb.co.za) [197.90.195.68]:45290: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
country_id: 6252001
description:
Feb  7 01:16:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.54.3.2
country_id: 1814991
description:
Feb  7 01:16:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.54.3.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.250
country_id: 1819730
description:
Feb  7 01:16:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.250
country_id: 1819730
description:
2025-02-07 01:16:05 dovecot_login authenticator failed for (m121-202-154-250.smartone.com) [121.202.154.250]:64735: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.227.87.29
country_id: 1814991
description:
Feb  7 01:16:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.227.87.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.30.180.58
country_id: 1835841
description:
Feb  7 01:16:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.30.180.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.172.72
country_id: 1819730
description:
Feb  7 01:16:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.172.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.97.236.1
country_id: 3469034
description:
Feb  7 01:16:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.97.236.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.145.254
country_id: 1880251
description:
Feb  7 01:16:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.145.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.245.145.254
country_id: 1880251
description:
2025-02-07 01:16:15 dovecot_plain authenticator failed for ([157.245.145.254]) [157.245.145.254]:39320: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2025-02-07 01:16:48 dovecot_plain authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:57138: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.38.100.151
country_id: 2750405
description:
2025-02-07 01:15:52 dovecot_plain authenticator failed for ([209.38.100.151]) [209.38.100.151]:54224: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.184
country_id: 1668284
description:
2025-02-07 01:16:04 dovecot_plain authenticator failed for 111-70-49-184.emome-ip.hinet.net [111.70.49.184]:49290: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.225.185.148
country_id: 1814991
description:
Feb  7 01:16:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.225.185.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.54.3.2
country_id: 1814991
description:
2025-02-07 01:16:41 dovecot_plain authenticator failed for ([182.54.3.2]) [182.54.3.2]:34221: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.151.45.136
country_id: 1814991
description:
Feb  7 01:16:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.151.45.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.218
country_id: 337996
description:
Feb  7 01:16:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.121.69
country_id: 1814991
description:
Feb  7 01:16:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.121.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-02-07 01:16:36 dovecot_plain authenticator failed for ([216.194.174.103]) [216.194.174.27]:20369: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.160.128.46
country_id: 3144096
description:
Feb  7 01:16:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.160.128.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.150.100.139
country_id: 6252001
description:
Feb  7 01:16:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.150.100.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.180.58
country_id: 1835841
description:
2025-02-07 01:16:42 dovecot_plain authenticator failed for ([114.30.180.58]) [114.30.180.58]:40136: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.136
country_id: 2017370
description:
Feb  7 01:16:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.205.232
country_id: 1269750
description:
2025-02-07 01:16:28 dovecot_plain authenticator failed for (abts-ap-dynamic-232.205.169.122.airtelbroadband.in) [122.169.205.232]:56043: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2025-02-07 01:16:30 dovecot_plain authenticator failed for ([196.189.124.218]) [196.189.124.218]:34290: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.227.87.29
country_id: 1814991
description:
2025-02-07 01:16:34 dovecot_plain authenticator failed for ([106.227.87.29]) [106.227.87.29]:45438: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.57.4
country_id: 1814991
description:
2025-02-07 01:16:38 dovecot_plain authenticator failed for ([219.159.57.4]) [219.159.57.4]:51011: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
country_id: 3469034
description:
Feb  7 01:16:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.216.77.3
country_id: 1814991
description:
Feb  7 01:16:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.216.77.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.59.2
country_id: 6252001
description:
Feb  7 01:16:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.59.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.182.162
country_id: 1835841
description:
2025-02-07 01:16:38 dovecot_plain authenticator failed for ([61.83.232.94]) [221.163.182.162]:50078: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.229.1.186
country_id: 6252001
description:
Feb  7 01:16:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.229.1.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.184
country_id: 1668284
description:
Feb  7 01:16:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.16
country_id: 1819730
description:
2025-02-07 01:16:07 dovecot_plain authenticator failed for ([121.202.155.16]) [121.202.155.16]:9312: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.228.40
country_id: 6252001
description:
Feb  7 01:16:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.228.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.196.237.146
country_id: 1814991
description:
2025-02-07 01:16:55 dovecot_plain authenticator failed for ([120.196.237.146]) [120.196.237.146]:55097: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.252.92.5
country_id: 1821275
description:
Feb  7 01:17:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.252.92.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.196.237.146
country_id: 1814991
description:
Feb  7 01:16:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.196.237.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.93.183
country_id: 3469034
description:
Feb  7 01:16:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.93.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.9
country_id: 617790
description:
2025-02-07 01:17:01 dovecot_plain authenticator failed for ([185.167.58.9]) [185.167.58.9]:58372: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 146.70.29.205
country_id: 1880251
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:01-17.146.70.29.205


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.228.40
country_id: 6252001
description:
2025-02-07 01:16:57 dovecot_login authenticator failed for ([104.241.228.40]) [104.241.228.40]:50857: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.9
country_id: 617790
description:
Feb  7 01:16:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
country_id: 3469034
description:
2025-02-07 01:17:00 dovecot_plain authenticator failed for (corporativo.static.gvt.net.br) [189.115.93.183]:46709: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 01:17:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.252.92.5
country_id: 1821275
description:
2025-02-07 01:17:24 dovecot_login authenticator failed for (ADMIN) [84.252.92.5]:44008: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.225.185.148
country_id: 1814991
description:
2025-02-07 01:16:50 dovecot_plain authenticator failed for ([124.225.185.148]) [124.225.185.148]:33098: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.39.82
country_id: 1814991
description:
Feb  7 01:17:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.39.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.39.82
country_id: 1814991
description:
2025-02-07 01:17:11 dovecot_login authenticator failed for ([60.174.39.82]) [60.174.39.82]:57327: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 01:18:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.142.238
country_id: 1269750
description:
2025-02-07 01:17:52 dovecot_login authenticator failed for ([114.143.224.97]) [182.156.142.238]:62990: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.87.152.161
country_id: 2017370
description:
2025-02-07 01:18:11 dovecot_plain authenticator failed for (194.87.152.161-FTTB.planeta.tc) [194.87.152.161]:50838: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.87.152.161
country_id: 2017370
description:
Feb  7 01:18:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.87.152.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.224.123.153
country_id: 6252001
description:
2025-02-07 01:17:55 dovecot_plain authenticator failed for ([24.224.123.153]) [24.224.123.153]:55664: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.45.179.200
country_id: 1861060
description:
2025-02-07 01:18:35 dovecot_plain authenticator failed for p391201-obmd01.tokyo.ocn.ne.jp [60.45.179.200]:35232: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.213
country_id: 1819730
description:
Feb  7 01:18:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.213 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:01-17.35.92.116.235


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.224.123.153
country_id: 6252001
description:
Feb  7 01:17:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.224.123.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.153.94
country_id: 1814991
description:
Feb  7 01:18:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.153.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.153.94
country_id: 1814991
description:
2025-02-07 01:18:02 dovecot_login authenticator failed for ([150.242.239.128]) [222.68.153.94]:49929: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 01:18:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.45.179.200
country_id: 1861060
description:
Feb  7 01:18:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.45.179.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.213
country_id: 1819730
description:
2025-02-07 01:18:45 dovecot_plain authenticator failed for (m121-202-154-213.smartone.com) [121.202.154.213]:9906: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.156.142.238
country_id: 1269750
description:
Feb  7 01:17:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.156.142.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.85.137
country_id: 3469034
description:
Feb  7 01:18:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.85.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.195.217.94
country_id: 1814991
description:
Feb  7 01:18:58 ait sshd[1514132]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.195.217.94 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.195.217.94
country_id: 1814991
description:
Feb  7 01:18:58 ait sshd[1514132]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.195.217.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.85.137
country_id: 3469034
description:
2025-02-07 01:18:59 dovecot_plain authenticator failed for (177-174-85-137.user.vivozap.com.br) [177.174.85.137]:49269: 535 Incorrect authentication data (set_id=abio17@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
country_id: 6252001
description:
Feb  7 01:18:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
country_id: 6252001
description:
2025-02-07 01:18:54 dovecot_plain authenticator failed for ([96.79.174.131]) [96.79.174.131]:34433: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.100.136
country_id: 1821275
description:
Feb  7 01:19:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.100.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.237.100.136
country_id: 1821275
description:
2025-02-07 01:19:10 dovecot_plain authenticator failed for ([103.237.100.136]) [103.237.100.136]:54304: 535 Incorrect authentication data (set_id=abio17)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.46.250
country_id: 3469034
description:
2025-02-07 01:20:41 dovecot_plain authenticator failed for ([189.80.46.250]) [189.80.46.250]:33542: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.159.145.190
country_id: 2400553
description:
Feb  7 01:20:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.159.145.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.159.145.190
country_id: 2400553
description:
2025-02-07 01:20:27 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:39782: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.80.46.250
country_id: 3469034
description:
Feb  7 01:20:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.80.46.250 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 204.10.194.42
country_id: 2921044
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ASD-ATA-0002||WPU:ASD-ATA-0002||RSV:6.65||T:APACHE||MV:01-20.204.10.194.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.192.94
country_id: 3469034
description:
2025-02-07 01:21:40 dovecot_plain authenticator failed for 186-247-192-94.user.veloxzone.com.br ([179.236.122.153]) [186.247.192.94]:59887: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
country_id: 3017382
description:
Feb  7 01:21:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
country_id: 3017382
description:
2025-02-07 01:21:08 dovecot_plain authenticator failed for (semass) [185.113.51.55]:52664: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.28.51
country_id: 1814991
description:
Feb  7 01:21:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.28.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.70.9.114
country_id: 1814991
description:
Feb  7 01:21:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.70.9.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.70.9.114
country_id: 1814991
description:
2025-02-07 01:21:29 dovecot_plain authenticator failed for ([218.70.9.114]) [218.70.9.114]:32869: 535 Incorrect authentication data (set_id=admin@elma-hk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.139.35.161
country_id: 6252001
description:
2025-02-07 01:21:41 dovecot_plain authenticator failed for 161.sm-u1.dialup.garlic.net [216.139.35.161]:53244: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.241.247.150
country_id: 3469034
description:
2025-02-07 01:21:46 dovecot_plain authenticator failed for ([191.241.247.150]) [191.241.247.150]:53578: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.25.116
country_id: 1880251
description:
47.128.25.116 - - [07/Feb/2025:01:21:25 +0100] "GET /wp-content/uploads/sites/6/2022/05/Smart-Logo.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15533115" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.25.116


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.124
country_id: 1036973
description:
Feb  7 01:21:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-02-07 01:21:37 dovecot_plain authenticator failed for ([196.28.226.124]) [196.28.226.124]:45961: 535 Incorrect authentication data (set_id=eng19a00097y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.139.35.161
country_id: 6252001
description:
Feb  7 01:21:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.139.35.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.28.51
country_id: 1814991
description:
2025-02-07 01:21:13 dovecot_plain authenticator failed for ([222.128.28.51]) [222.128.28.51]:40092: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.70.166.51
country_id: 298795
description:
Feb  7 01:21:22 ait sshd[1515261]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.70.166.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.70.166.51
country_id: 298795
description:
Feb  7 01:21:22 ait sshd[1515261]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.70.166.51  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.192.94
country_id: 3469034
description:
Feb  7 01:21:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.192.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.241.247.150
country_id: 3469034
description:
Feb  7 01:21:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.241.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 144.126.218.165
country_id: 6252001
domain: gvu.titopen.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:gvu_admin||WPU:gvu_admin||RSV:6.65||T:APACHE||MV:01-21.144.126.218.165


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.151.51.223
country_id: 798544
description:
Feb  7 01:21:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.151.51.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.251.121.70
country_id: 1861060
description:
Feb  7 01:22:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.251.121.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 01:22:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.151.51.223
country_id: 798544
description:
2025-02-07 01:21:56 dovecot_plain authenticator failed for customer-ip-193-151-51-223.ipv.net.pl [193.151.51.223]:55246: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2025-02-07 01:22:08 dovecot_plain authenticator failed for works.ssc-gr.info [160.251.121.70]:43050: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:01-23.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.251.25.210
country_id: 1562822
description:
Feb  7 01:23:56 ait sshd[1516155]: pam_imunify(sshd:auth): [IM360_RBL] The IP 171.251.25.210 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 171.251.25.210
country_id: 1562822
description:
Feb  7 01:23:56 ait sshd[1516155]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.251.25.210  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.160.166.237
country_id: 1820814
description:
Feb  7 01:25:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.160.166.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
country_id: 1814991
description:
Feb  7 01:25:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 01:25:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.142.135
country_id: 1562822
description:
Feb  7 01:25:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.142.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.142.135
country_id: 1562822
description:
2025-02-07 01:25:42 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:55593: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.200.51
country_id: 294640
description:
Feb  7 01:25:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.200.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
country_id: 1814991
description:
2025-02-07 01:25:21 dovecot_plain authenticator failed for ([27.223.100.91]) [27.223.100.90]:55932: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.26.59
country_id: 1512440
description:
Feb  7 01:25:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.26.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.49.61.211
country_id: 6252001
description:
2025-02-07 01:24:59 dovecot_plain authenticator failed for ([136.49.61.211]) [136.49.61.211]:59248: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.26.59
country_id: 1512440
description:
2025-02-07 01:25:26 dovecot_plain authenticator failed for ([195.158.26.59]) [195.158.26.59]:35664: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.49.61.211
country_id: 6252001
description:
Feb  7 01:24:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.49.61.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-02-07 01:25:09 dovecot_plain authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:49790: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.200.51
country_id: 294640
description:
2025-02-07 01:25:22 dovecot_plain authenticator failed for mail.infologic.co.il [85.130.200.51]:57055: 535 Incorrect authentication data (set_id=ads20a00071y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-02-07 01:26:47 dovecot_plain authenticator failed for ([154.127.90.34]) [154.127.90.34]:47958: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.231.102.189
country_id: 6252001
description:
2025-02-07 01:26:06 dovecot_plain authenticator failed for ([73.231.102.189]) [73.231.102.189]:56552: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.2
country_id: 2077456
description:
2025-02-07 01:26:20 dovecot_plain authenticator failed for ([203.189.124.2]) [203.189.124.2]:41556: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.236.213.190
country_id: 3469034
description:
Feb  7 01:26:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.236.213.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.231.102.189
country_id: 6252001
description:
Feb  7 01:26:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.231.102.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.251.25.210
country_id: 1562822
description:
Feb  7 01:26:11 ait sshd[1516964]: pam_imunify(sshd:auth): [IM360_RBL] The IP 171.251.25.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.2
country_id: 2077456
description:
Feb  7 01:26:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.104
country_id: 1668284
description:
Feb  7 01:26:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.104
country_id: 1668284
description:
2025-02-07 01:26:02 dovecot_plain authenticator failed for 111-70-49-104.emome-ip.hinet.net [111.70.49.104]:52764: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.235.126
country_id: 1814991
description:
Feb  7 01:26:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.235.126 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 171.251.25.210
country_id: 1562822
description:
Feb  7 01:26:11 ait sshd[1516964]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.251.25.210


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.235.126
country_id: 1814991
description:
2025-02-07 01:26:13 dovecot_plain authenticator failed for ([220.189.235.126]) [220.189.235.126]:33495: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.236.213.190
country_id: 3469034
description:
2025-02-07 01:26:32 dovecot_plain authenticator failed for 179-236-213-190.user.veloxzone.com.br [179.236.213.190]:53562: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.90.34
country_id: 2440476
description:
Feb  7 01:26:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.90.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.243.50
country_id: 1814991
description:
2025-02-07 01:27:30 dovecot_plain authenticator failed for ([117.158.243.50]) [117.158.243.50]:34648: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:01-27.35.92.116.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.185
country_id: 337996
description:
2025-02-07 01:27:38 dovecot_plain authenticator failed for ([196.189.126.185]) [196.189.126.185]:42138: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.228.134.212
country_id: 3017382
description:
Feb  7 01:27:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.228.134.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.228.134.212
country_id: 3017382
description:
2025-02-07 01:27:44 dovecot_login authenticator failed for vps-cdb79a38.vps.ovh.net (CdpaTWi) [152.228.134.212]:41601: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.243.50
country_id: 1814991
description:
Feb  7 01:27:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.243.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.126.185
country_id: 337996
description:
Feb  7 01:27:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.126.185 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Feb  7 01:28:13 ait sshd[1517669]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.226.88
country_id: 3996063
description:
2025-02-07 01:28:44 dovecot_login authenticator failed for (187.161.226.88-clientes-izzi.mx) [187.161.226.88]:54601: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 171.251.25.210
country_id: 1562822
description:
Feb  7 01:28:35 ait sshd[1517836]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.251.25.210


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.6.133
country_id: 1835841
description:
2025-02-07 01:28:35 dovecot_plain authenticator failed for ([106.246.6.133]) [106.246.6.133]:48752: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.6.133
country_id: 1835841
description:
Feb  7 01:28:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.6.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.251.25.210
country_id: 1562822
description:
Feb  7 01:28:35 ait sshd[1517836]: pam_imunify(sshd:auth): [IM360_RBL] The IP 171.251.25.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.161.226.88
country_id: 3996063
description:
Feb  7 01:28:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.161.226.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.136.192.106
country_id: 1733045
description:
Feb  7 01:28:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.136.192.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.136.192.106
country_id: 1733045
description:
2025-02-07 01:28:47 dovecot_login authenticator failed for ([175.136.192.106]) [175.136.192.106]:52164: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-02-07 01:29:27 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:41102: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 01:29:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.148.43
country_id: 1835841
description:
Feb  7 01:29:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.148.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.214.52.214
country_id: 1835841
description:
Feb  7 01:29:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.214.52.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.169.151
country_id: 99237
description:
2025-02-07 01:29:48 dovecot_plain authenticator failed for ([65.20.169.151]) [65.20.169.151]:46161: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.220.168.116
country_id: 2017370
description:
Feb  7 01:28:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.220.168.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-02-07 01:29:21 dovecot_plain authenticator failed for ([195.222.57.190]) [195.222.57.190]:35494: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.97.10
country_id: 1814991
description:
Feb  7 01:29:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.97.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.142.135
country_id: 1562822
description:
2025-02-07 01:29:16 dovecot_login authenticator failed for ([171.244.142.135]) [171.244.142.135]:5542: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Feb  7 01:28:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.142.135
country_id: 1562822
description:
Feb  7 01:29:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.142.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
country_id: 3277605
description:
Feb  7 01:29:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.27.114
country_id: 1814991
description:
Feb  7 01:29:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.27.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.220.168.116
country_id: 2017370
description:
2025-02-07 01:28:54 dovecot_login authenticator failed for ([31.220.168.116]) [31.220.168.116]:54006: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 01:29:07 ait sshd[1517949]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.64.112.134
country_id: 1210997
description:
2025-02-07 01:29:27 dovecot_login authenticator failed for (ADMIN) [64.64.112.134]:58514: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-02-07 01:28:57 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:35351: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 01:29:07 ait sshd[1517949]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.27.114
country_id: 1814991
description:
2025-02-07 01:29:40 dovecot_plain authenticator failed for (114.27.33.36.adsl-pool.ah.cnuninet.net) [36.33.27.114]:41008: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.214.52.214
country_id: 1835841
description:
2025-02-07 01:29:50 dovecot_login authenticator failed for ([175.214.52.214]) [175.214.52.214]:57368: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.216.81.126
country_id: 49518
description:
Feb  7 01:29:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.216.81.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.148.43
country_id: 1835841
description:
2025-02-07 01:29:36 dovecot_plain authenticator failed for ([183.109.148.43]) [183.109.148.43]:52896: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.169.151
country_id: 99237
description:
Feb  7 01:29:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.169.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.33.162
country_id: 1814991
description:
2025-02-07 01:29:02 dovecot_login authenticator failed for ([183.237.33.162]) [183.237.33.162]:59290: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.97.10
country_id: 1814991
description:
2025-02-07 01:29:48 dovecot_login authenticator failed for ([116.114.97.10]) [116.114.97.10]:43918: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.33.162
country_id: 1814991
description:
Feb  7 01:29:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.33.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.134.177
country_id: 1269750
description:
2025-02-07 01:30:06 dovecot_plain authenticator failed for ([103.59.134.177]) [103.59.134.177]:6072: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 112.132.249.164
country_id: 1814991
description:
Feb  7 01:30:15 ait sshd[1518483]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.132.249.164  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2025-02-07 01:30:30 dovecot_plain authenticator failed for ([186.239.41.74]) [186.239.41.74]:37504: 535 Incorrect authentication data (set_id=abs20a00063y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.10
country_id: 337996
description:
2025-02-07 01:30:34 dovecot_plain authenticator failed for ([196.189.126.10]) [196.189.126.10]:59704: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2025-02-07 01:30:01 dovecot_login authenticator failed for ([121.179.93.147]) [121.179.93.147]:55614: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.177
country_id: 1269750
description:
Feb  7 01:30:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.126.10
country_id: 337996
description:
Feb  7 01:30:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.126.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.74
country_id: 3469034
description:
Feb  7 01:30:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.196.240
country_id: 6252001
description:
2025-02-07 01:30:16 dovecot_plain authenticator failed for (mobile-166-195-196-240.mycingular.net) [166.195.196.240]:55841: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.151.71.8
country_id: 1522867
description:
Feb  7 01:30:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.151.71.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.71.8
country_id: 1522867
description:
2025-02-07 01:30:46 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:51489: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.249.164
country_id: 1814991
description:
Feb  7 01:30:15 ait sshd[1518483]: pam_imunify(sshd:auth): [IM360_RBL] The IP 112.132.249.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
country_id: 1835841
description:
Feb  7 01:29:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.196.240
country_id: 6252001
description:
Feb  7 01:30:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.196.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.100
country_id: 1819730
description:
2025-02-07 01:31:10 dovecot_plain authenticator failed for (m121-202-153-100.smartone.com) [121.202.153.100]:42963: 535 Incorrect authentication data (set_id=abs20a00063y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.65.1.179
country_id: 1814991
description:
Feb  7 01:31:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.65.1.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.65.1.179
country_id: 1814991
description:
2025-02-07 01:31:31 dovecot_plain authenticator failed for ([49.65.1.179]) [49.65.1.179]:13907: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.110.124.105
country_id: 1562822
description:
Feb  7 01:30:59 ait sshd[1518652]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.110.124.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.100
country_id: 1819730
description:
Feb  7 01:31:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.100 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.110.124.105
country_id: 1562822
description:
Feb  7 01:30:59 ait sshd[1518652]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.110.124.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.75.188.242
country_id: 1562822
description:
Feb  7 01:31:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.75.188.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.75.188.242
country_id: 1562822
description:
2025-02-07 01:31:48 dovecot_plain authenticator failed for ([115.75.188.242]) [115.75.188.242]:46360: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.97.10
country_id: 1814991
description:
Feb  7 01:32:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.97.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.97.10
country_id: 1814991
description:
2025-02-07 01:32:14 dovecot_plain authenticator failed for ([116.114.97.10]) [116.114.97.10]:55843: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.228.105.192
country_id: 1835841
description:
Feb  7 01:31:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.228.105.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.228.105.192
country_id: 1835841
description:
2025-02-07 01:32:00 dovecot_plain authenticator failed for ([58.228.105.192]) [58.228.105.192]:35597: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.61
country_id: 1819730
description:
2025-02-07 01:33:28 dovecot_plain authenticator failed for (m121-202-155-61.smartone.com) [121.202.155.61]:1248: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.216.176.90
country_id: 6252001
description:
2025-02-07 01:33:38 dovecot_plain authenticator failed for 32-216-176-90.bng02.brpt.ct.frontiernet.net [32.216.176.90]:63414: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.110.124.105
country_id: 1562822
description:
Feb  7 01:33:40 ait sshd[1519613]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.110.124.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.166.68.184
country_id: 2017370
description:
2025-02-07 01:33:45 dovecot_plain authenticator failed for (5x166x68x184.dynamic.barnaul.ertelecom.ru) [5.166.68.184]:54058: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.122.179.118
country_id: 1835841
description:
Feb  7 01:33:23 ait sshd[1519573]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.122.179.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.61
country_id: 1819730
description:
Feb  7 01:33:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.97.198
country_id: 337996
description:
2025-02-07 01:33:06 dovecot_plain authenticator failed for ([197.156.97.198]) [197.156.97.198]:60608: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.110.124.105
country_id: 1562822
description:
Feb  7 01:33:40 ait sshd[1519613]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.110.124.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.183.225.156
country_id: 3658394
description:
Feb  7 01:33:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.183.225.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-02-07 01:33:25 dovecot_plain authenticator failed for ([201.183.225.156]) [201.183.225.156]:50927: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 48.218.170.53
country_id: 1861060
description:
Feb  7 01:33:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 48.218.170.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 48.218.170.53
country_id: 1861060
description:
2025-02-07 01:33:35 dovecot_plain authenticator failed for ([48.218.170.53]) [48.218.170.53]:60212: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.166.68.184
country_id: 2017370
description:
Feb  7 01:33:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.166.68.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.156.97.198
country_id: 337996
description:
Feb  7 01:33:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.156.97.198 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.122.179.118
country_id: 1835841
description:
Feb  7 01:33:23 ait sshd[1519573]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.122.179.118


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.216.176.90
country_id: 6252001
description:
Feb  7 01:33:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.216.176.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.115.76.186
country_id: 6252001
description:
Feb  7 01:32:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.115.76.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.115.76.186
country_id: 6252001
description:
2025-02-07 01:32:58 dovecot_plain authenticator failed for ool-45734cba.dyn.optonline.net [69.115.76.186]:51312: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.248.243.64
country_id: 2017370
description:
Feb  7 01:34:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.248.243.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 01:34:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.248.243.64
country_id: 2017370
description:
2025-02-07 01:34:49 dovecot_plain authenticator failed for ([87.248.243.64]) [87.248.243.64]:60440: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.202.105
country_id: 6251999
description:
Feb  7 01:33:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.202.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.32.102.90
country_id: 1814991
description:
2025-02-07 01:34:18 dovecot_plain authenticator failed for ([117.32.102.90]) [117.32.102.90]:49359: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.132.113
country_id: 2750405
description:
2025-02-07 01:34:42 dovecot_plain authenticator failed for ([188.226.132.113]) [188.226.132.113]:51396: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.142.41.167
country_id: 732800
description:
Feb  7 01:34:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.142.41.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.30.108.247
country_id: 1168579
description:
2025-02-07 01:33:54 dovecot_plain authenticator failed for static-host119-30-108-247.link.net.pk [119.30.108.247]:49563: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-02-07 01:34:21 dovecot_plain authenticator failed for ([14.98.28.43]) [14.98.28.43]:49284: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.132.113
country_id: 2750405
description:
Feb  7 01:34:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.132.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.30.108.247
country_id: 1168579
description:
Feb  7 01:33:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.30.108.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.32.102.90
country_id: 1814991
description:
Feb  7 01:34:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.32.102.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.100
country_id: 1819730
description:
2025-02-07 01:33:58 dovecot_plain authenticator failed for (m121-202-204-100.smartone.com) [121.202.204.100]:27643: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.98.28.43
country_id: 1269750
description:
Feb  7 01:34:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.98.28.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.142.41.167
country_id: 732800
description:
2025-02-07 01:34:46 dovecot_plain authenticator failed for ([78.142.41.167]) [78.142.41.167]:59398: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.41.202.105
country_id: 6251999
description:
2025-02-07 01:33:52 dovecot_login authenticator failed for (ADMIN) [181.41.202.105]:45376: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.100
country_id: 1819730
description:
Feb  7 01:33:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-02-07 01:35:19 dovecot_plain authenticator failed for ([196.28.226.124]) [196.28.226.124]:53574: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.236.145.128
country_id: 6252001
description:
Feb  7 01:35:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.236.145.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.6.118.248
country_id: 1814991
description:
Feb  7 01:35:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.6.118.248 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.188
country_id: 1819730
description:
Feb  7 01:35:37 ait sshd[1520534]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-02-07 01:34:54 dovecot_plain authenticator failed for ([185.255.212.178]) [185.255.212.178]:54039: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.118.248
country_id: 1814991
description:
2025-02-07 01:35:02 dovecot_plain authenticator failed for ([183.6.118.248]) [183.6.118.248]:36965: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.241.247.150
country_id: 3469034
description:
Feb  7 01:35:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.241.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
country_id: 732800
description:
Feb  7 01:34:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.124
country_id: 1036973
description:
Feb  7 01:35:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.69.157.215
country_id: 3175395
description:
2025-02-07 01:35:21 dovecot_plain authenticator failed for ([151.69.157.215]) [151.69.157.215]:37291: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.205.48.62
country_id: 6252001
description:
Feb  7 01:35:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.205.48.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.65.1.179
country_id: 1814991
description:
2025-02-07 01:35:06 dovecot_plain authenticator failed for ([49.65.1.179]) [49.65.1.179]:29774: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.110.124.105
country_id: 1562822
description:
Feb  7 01:35:13 ait sshd[1520167]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.110.124.105  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.241.247.150
country_id: 3469034
description:
2025-02-07 01:35:38 dovecot_plain authenticator failed for ([191.241.247.150]) [191.241.247.150]:34484: 535 Incorrect authentication data (set_id=ofei)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.245.131.229
country_id: 6252001
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:01-34.157.245.131.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.65.1.179
country_id: 1814991
description:
Feb  7 01:35:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.65.1.179 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/donate.php


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.205.48.62
country_id: 6252001
description:
2025-02-07 01:35:31 dovecot_plain authenticator failed for 47-205-48-62.tamp.fl.frontiernet.net [47.205.48.62]:43410: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.110.124.105
country_id: 1562822
description:
Feb  7 01:35:13 ait sshd[1520167]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.110.124.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.69.157.215
country_id: 3175395
description:
Feb  7 01:35:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.69.157.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-02-07 01:35:44 dovecot_plain authenticator failed for ([104.236.145.128]) [104.236.145.128]:46009: 535 Incorrect authentication data (set_id=ads19b00191y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.61
country_id: 1819730
description:
Feb  7 01:36:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.61
country_id: 1819730
description:
2025-02-07 01:36:19 dovecot_plain authenticator failed for (m121-202-155-61.smartone.com) [121.202.155.61]:10782: 535 Incorrect authentication data (set_id=ads19b00191y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.101.128.156
country_id: 6252001
description:
Feb  7 01:36:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.101.128.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.122.179.118
country_id: 1835841
description:
Feb  7 01:37:24 ait sshd[1521125]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.122.179.118 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.122.179.118
country_id: 1835841
description:
Feb  7 01:37:24 ait sshd[1521125]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.122.179.118  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.238
country_id: 337996
description:
2025-02-07 01:37:13 dovecot_plain authenticator failed for ([196.191.212.238]) [196.191.212.238]:45572: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 112.132.249.164
country_id: 1814991
description:
Feb  7 01:37:15 ait sshd[1521039]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.132.249.164  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
country_id: 130758
description:
Feb  7 01:37:19 ait sshd[1521092]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.238
country_id: 337996
description:
Feb  7 01:37:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.238 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:01-37.35.92.116.235


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.249.164
country_id: 1814991
description:
Feb  7 01:37:15 ait sshd[1521039]: pam_imunify(sshd:auth): [IM360_RBL] The IP 112.132.249.164 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
country_id: 130758
description:
Feb  7 01:37:19 ait sshd[1521092]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49  user=root


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.101.128.156
country_id: 6252001
description:
2025-02-07 01:36:54 dovecot_plain authenticator failed for c-73-101-128-156.hsd1.pa.comcast.net [73.101.128.156]:33076: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.249.164
country_id: 1814991
description:
Feb  7 01:38:09 ait sshd[1521404]: pam_imunify(sshd:auth): [IM360_RBL] The IP 112.132.249.164 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 112.132.249.164
country_id: 1814991
description:
Feb  7 01:38:09 ait sshd[1521404]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.132.249.164  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.145.186.171
country_id: 2542007
description:
[2025-02-07 01:38:25 +0100] info [webmaild] 197.145.186.171 - info@aitsmartschool.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:01-38.80.76.51.123


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/engine1/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.65.68.104
country_id: 732800
description:
Feb  7 01:38:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.65.68.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.65.68.104
country_id: 732800
description:
2025-02-07 01:38:52 dovecot_plain authenticator failed for ([45.65.68.104]) [45.65.68.104]:45652: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.143.123
country_id: 3374766
description:
2025-02-07 01:38:51 dovecot_login authenticator failed for ([197.255.143.123]) [197.255.143.123]:51239: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.89.146
country_id: 1814991
description:
Feb  7 01:39:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.89.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2025-02-07 01:39:08 dovecot_login authenticator failed for ([116.114.94.242]) [116.114.94.242]:51272: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.89.146
country_id: 1814991
description:
2025-02-07 01:39:07 dovecot_plain authenticator failed for ([58.18.89.146]) [58.18.89.146]:51481: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.84.158.215
country_id: 2017370
description:
Feb  7 01:39:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.84.158.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.84.158.215
country_id: 2017370
description:
2025-02-07 01:39:28 dovecot_plain authenticator failed for broadband-95-84-158-215.ip.moscow.rt.ru [95.84.158.215]:57980: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.80.166
country_id: 1880251
description:
Feb  7 01:39:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.80.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.143.123
country_id: 3374766
description:
Feb  7 01:38:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.143.123 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.25.132.213
country_id: 3439705
description:
[2025-02-07 01:38:51 +0100] info [webmaild] 179.25.132.213 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.80.166
country_id: 1880251
description:
2025-02-07 01:39:40 dovecot_plain authenticator failed for (166.80.156.175.unknown.m1.com.sg) [175.156.80.166]:46884: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.94.242
country_id: 1814991
description:
Feb  7 01:39:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.94.242 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/js/js/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.205.242
country_id: 1814991
description:
Feb  7 01:40:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.205.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.205.242
country_id: 1814991
description:
2025-02-07 01:40:42 dovecot_login authenticator failed for ([218.4.205.242]) [218.4.205.242]:32781: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.130.87.125
country_id: 1814991
description:
Feb  7 01:40:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.130.87.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.130.87.125
country_id: 1814991
description:
2025-02-07 01:40:58 dovecot_plain authenticator failed for ([221.130.87.125]) [221.130.87.125]:36708: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.76.194.159
country_id: 6252001
description:
Feb  7 01:41:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.76.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-02-07 01:41:14 dovecot_plain authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:54662: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.186.225.144
country_id: 248816
description:
[2025-02-07 01:41:38 +0100] info [webmaild] 91.186.225.144 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.43.109
country_id: 1819730
description:
Feb  7 01:40:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.43.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
country_id: 1819730
description:
2025-02-07 01:40:52 dovecot_login authenticator failed for 109.43.246.220.static.netvigator.com [220.246.43.109]:64323: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 51.222.30.67
country_id: 6251999
domain: ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:01-42.51.222.30.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.212.68
country_id: 1814991
description:
2025-02-07 01:43:24 dovecot_plain authenticator failed for ([111.39.212.68]) [111.39.212.68]:57843: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.212.68
country_id: 1814991
description:
Feb  7 01:43:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.212.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.75.227.38
country_id: 2017370
description:
2025-02-07 01:43:36 dovecot_plain authenticator failed for 128-75-227-38.broadband.corbina.ru [128.75.227.38]:39697: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.193.133
country_id: 99237
description:
Feb  7 01:43:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.193.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.193.133
country_id: 99237
description:
2025-02-07 01:43:46 dovecot_plain authenticator failed for (unrea) [65.20.193.133]:48794: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/js/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.75.227.38
country_id: 2017370
description:
Feb  7 01:43:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.75.227.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.195
country_id: 798549
description:
Feb  7 01:43:55 ait sshd[1523544]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.102.48.9
country_id: 1814991
description:
Feb  7 01:44:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.102.48.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.130.18.21
country_id: 1668284
description:
2025-02-07 01:44:35 dovecot_login authenticator failed for 220-130-18-21.hinet-ip.hinet.net [220.130.18.21]:35600: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
country_id: 1814991
description:
Feb  7 01:44:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.195
country_id: 798549
description:
Feb  7 01:43:55 ait sshd[1523544]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-02-07 01:43:57 dovecot_plain authenticator failed for (aalitiony) [65.20.147.45]:35981: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.201.58
country_id: 1814991
description:
Feb  7 01:44:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.201.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.48.9
country_id: 1814991
description:
2025-02-07 01:44:04 dovecot_plain authenticator failed for ([112.102.48.9]) [112.102.48.9]:47912: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.144.187.114
country_id: 130758
description:
2025-02-07 01:44:18 dovecot_plain authenticator failed for ([89.144.187.114]) [89.144.187.114]:55447: 535 Incorrect authentication data (set_id=suvie)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/js/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.91.10.114
country_id: 3017382
description:
Feb  7 01:44:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.91.10.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.91.10.114
country_id: 3017382
description:
2025-02-07 01:44:13 dovecot_plain authenticator failed for vps-0b1302de.vps.ovh.net [51.91.10.114]:60268: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.144.187.114
country_id: 130758
description:
Feb  7 01:44:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.144.187.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.130.18.21
country_id: 1668284
description:
Feb  7 01:44:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.130.18.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.61.209
country_id: 1814991
description:
2025-02-07 01:44:41 dovecot_plain authenticator failed for ([39.165.61.209]) [39.165.61.209]:46924: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.201.58
country_id: 1814991
description:
2025-02-07 01:44:05 dovecot_plain authenticator failed for ([220.178.201.58]) [220.178.201.58]:58056: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.147.45
country_id: 99237
description:
Feb  7 01:43:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.147.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.61.209
country_id: 1814991
description:
Feb  7 01:44:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.61.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2025-02-07 01:44:49 dovecot_login authenticator failed for ([39.165.183.70]) [39.165.183.70]:35660: 535 Incorrect authentication data (set_id=oudoc)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/js/engine1/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.230.98
country_id: 1814991
description:
Feb  7 01:45:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.230.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.230.98
country_id: 1814991
description:
2025-02-07 01:45:28 dovecot_plain authenticator failed for ([1.180.230.112]) [1.180.230.98]:52692: 535 Incorrect authentication data (set_id=nyarko@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.68.39
country_id: 1814991
description:
Feb  7 01:45:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.68.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.101.16.250
country_id: 272103
description:
Feb  7 01:45:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.101.16.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.126.247
country_id: 1835841
description:
2025-02-07 01:45:37 dovecot_plain authenticator failed for ([112.172.126.247]) [112.172.126.247]:40718: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.113.43.143
country_id: 1269750
description:
2025-02-07 01:45:38 dovecot_plain authenticator failed for vps-b909f986.vps.ovh.ca [148.113.43.143]:42462: 535 Incorrect authentication data (set_id=nyarko)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.136.172.98
country_id: 192950
description:
Feb  7 01:45:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.136.172.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.136.172.98
country_id: 192950
description:
2025-02-07 01:45:41 dovecot_plain authenticator failed for ([197.136.236.1]) [197.136.172.98]:38490: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 57.128.47.31
country_id: 3017382
domain: ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:01-44.57.128.47.31


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.40.72.101
country_id: 798549
description:
Feb  7 01:44:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.40.72.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.113.43.143
country_id: 1269750
description:
Feb  7 01:45:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.113.43.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.68.39
country_id: 1814991
description:
2025-02-07 01:45:36 dovecot_plain authenticator failed for ([61.185.68.39]) [61.185.68.39]:40707: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.40.72.101
country_id: 798549
description:
2025-02-07 01:44:56 dovecot_plain authenticator failed for ([89.40.72.101]) [89.40.72.101]:40644: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.50.120.215
country_id: 1814991
description:
Feb  7 01:45:31 ait sshd[1524106]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.120.215


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.126.247
country_id: 1835841
description:
Feb  7 01:45:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.126.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-02-07 01:45:49 dovecot_plain authenticator failed for ([185.134.179.106]) [185.101.16.250]:54273: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.35.63.27
country_id: 1835841
description:
2025-02-07 01:45:56 dovecot_plain authenticator failed for ([110.35.63.27]) [110.35.63.27]:49554: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.190.147.29
country_id: 6252001
description:
2025-02-07 01:45:59 dovecot_plain authenticator failed for static-47-190-147-29.dlls.tx.frontiernet.net [47.190.147.29]:59697: 535 Incorrect authentication data (set_id=tsikpo)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/engine1/js/engine1/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.92.248
country_id: 1269750
description:
Feb  7 01:46:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.92.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.92.248
country_id: 1269750
description:
2025-02-07 01:46:43 dovecot_plain authenticator failed for ([106.51.92.248]) [106.51.92.248]:38244: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.35.63.27
country_id: 1835841
description:
Feb  7 01:45:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.35.63.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.190.147.29
country_id: 6252001
description:
Feb  7 01:45:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.190.147.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.152.234.134
country_id: 1643084
description:
2025-02-07 01:47:34 dovecot_login authenticator failed for ([103.152.234.134]) [103.152.234.134]:41430: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


