# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
description:
2025-02-03 23:03:47 dovecot_plain authenticator failed for ([218.147.6.84]) [218.147.6.84]:37432: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.82.28.97
description:
[2025-02-03 23:04:08 +0100] info [webmaild] 170.82.28.97 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.105.104.168
description:
Feb  3 23:04:14 ait sshd[3770712]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.105.104.168  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.13.138.138
description:
2025-02-03 23:04:03 dovecot_plain authenticator failed for (hn.kd.smx.adsl) [221.13.138.138]:43789: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.13.138.138
description:
Feb  3 23:04:01 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.13.138.138 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 41.216.188.18
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:superadmin||WPU:superadmin||RSV:6.65||T:APACHE||MV:23-04.41.216.188.18


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.105.104.168
description:
Feb  3 23:04:14 ait sshd[3770712]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.105.104.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.7.86.144
description:
Feb  3 23:04:47 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.7.86.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.189.153.136
description:
Feb  3 23:04:23 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.189.153.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.189.153.136
description:
2025-02-03 23:04:25 dovecot_plain authenticator failed for ([110.189.153.136]) [110.189.153.136]:40587: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.251.132
description:
2025-02-03 23:04:50 dovecot_plain authenticator failed for (132.251.223.60.adsl-pool.sx.cn) [60.223.251.132]:41292: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Feb  3 23:04:31 ait sshd[3770801]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.36.108.223
description:
Feb  3 23:04:31 ait sshd[3770801]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.36.108.223


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.29.49
description:
[2025-02-03 23:04:42 +0100] info [webmaild] 45.70.29.49 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.7.86.144
description:
2025-02-03 23:04:49 dovecot_login authenticator failed for (hn.kd.ny.adsl) [123.7.86.144]:56226: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.250.72.164
description:
[2025-02-03 23:04:57 +0100] info [webmaild] 167.250.72.164 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.236.111.18
description:
Feb  3 23:05:00 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.236.111.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.236.111.18
description:
2025-02-03 23:05:02 dovecot_login authenticator failed for ([156.236.111.18]) [156.236.111.18]:41747: 535 Incorrect authentication data (set_id=awadzie)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.21.185
domain: gou.university
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:6.65||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.156.73.162
description:
[2025-02-03 23:04:24 +0100] info [webmaild] 38.156.73.162 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.251.132
description:
Feb  3 23:04:48 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.251.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.37.35.155
description:
2025-02-03 23:05:33 dovecot_plain authenticator failed for c-68-37-35-155.hsd1.mi.comcast.net [68.37.35.155]:59874: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
description:
Feb  3 23:05:50 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.98.249.9
description:
Feb  3 23:05:30 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.98.249.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.37.35.155
description:
Feb  3 23:05:31 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.37.35.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
description:
2025-02-03 23:05:52 dovecot_plain authenticator failed for (abioding) [64.72.74.162]:36718: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.96.43.215
description:
Feb  3 23:06:06 ait sshd[3771668]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.96.43.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.96.43.215
description:
Feb  3 23:06:06 ait sshd[3771668]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.43.215


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 158.69.27.117
description:
Feb  3 23:06:12 ait sshd[3771691]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.69.27.117


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.20.146
description:
2025-02-03 23:05:21 dovecot_plain authenticator failed for ([31.173.20.146]) [31.173.20.146]:51264: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.195.63.151
description:
Feb  3 23:05:48 ait sshd[3771506]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.195.63.151


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Feb  3 23:05:53 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.20.146
description:
Feb  3 23:05:19 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.20.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-02-03 23:05:55 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (hultiom) [91.56.31.167]:59498: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.29.235.66
description:
Feb  3 23:06:55 ait sshd[3771881]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.29.235.66 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.29.235.66
description:
Feb  3 23:06:55 ait sshd[3771881]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.29.235.66  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.39.108.141
description:
[2025-02-03 23:07:09 +0100] info [webmaild] 189.39.108.141 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Feb  3 23:06:51 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-02-03 23:06:53 dovecot_plain authenticator failed for (prens) [46.30.161.197]:35465: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Feb  3 23:07:12 ait sshd[3771933]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.107.0.188
description:
Feb  3 23:07:15 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.107.0.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.90.227.255
description:
Feb  3 23:07:16 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.90.227.255 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 175.107.226.254
description:
[2025-02-03 23:07:05 +0100] info [webmaild] 175.107.226.254 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Feb  3 23:07:12 ait sshd[3771933]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.127.67.83
description:
Feb  3 23:07:58 ait sshd[3772203]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.127.67.83 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.151.218.110
description:
Feb  3 23:07:36 ait sshd[3772035]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.151.218.110  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Feb  3 23:07:25 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-02-03 23:07:27 dovecot_login authenticator failed for ([171.244.40.228]) [171.244.40.236]:19852: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.0.45.250
description:
[2025-02-03 23:07:42 +0100] info [webmaild] 138.0.45.250 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.176.249.35
description:
2025-02-03 23:07:50 dovecot_login authenticator failed for ([112.176.249.35]) [112.176.249.35]:35369: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.227.255
description:
2025-02-03 23:07:18 dovecot_login authenticator failed for syn-172-090-227-255.res.spectrum.com [172.90.227.255]:50228: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
description:
2025-02-03 23:08:11 dovecot_login authenticator failed for syn-050-074-136-134.biz.spectrum.com [50.74.136.134]:43516: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.127.67.83
description:
Feb  3 23:07:58 ait sshd[3772203]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.67.83  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.46.70.41
description:
[2025-02-03 23:07:34 +0100] info [webmaild] 95.46.70.41 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.221.133.6
description:
Feb  3 23:07:59 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.221.133.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.190.39.142
description:
Feb  3 23:07:25 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.190.39.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.190.39.142
description:
2025-02-03 23:07:27 dovecot_login authenticator failed for (442534-test.customer.zol.co.zw) [41.190.39.142]:52610: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.176.249.35
description:
Feb  3 23:07:48 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.176.249.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.221.133.6
description:
2025-02-03 23:08:01 dovecot_login authenticator failed for 6-133-221-131.dynamic.v1telecom.com.br [131.221.133.6]:39719: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.74.136.134
description:
Feb  3 23:08:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.74.136.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.107.0.188
description:
2025-02-03 23:07:17 dovecot_login authenticator failed for ([218.107.0.188]) [218.107.0.188]:43044: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.143.231.208
description:
2025-02-03 23:08:49 dovecot_plain authenticator failed for ([43.143.231.208]) [43.143.231.208]:45744: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.0.134.10
description:
Feb  3 23:08:52 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.0.134.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.67.162
description:
2025-02-03 23:09:07 dovecot_login authenticator failed for (ADMIN) [191.96.67.162]:45508: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.220.209.59
description:
2025-02-03 23:08:18 dovecot_login authenticator failed for ([114.220.209.59]) [114.220.209.59]:46966: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.37.177.99
description:
2025-02-03 23:08:28 dovecot_plain authenticator failed for syn-047-037-177-099.res.spectrum.com [47.37.177.99]:48067: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.11.202.38
description:
Feb  3 23:08:28 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.11.202.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.206.193.131
description:
Feb  3 23:08:42 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.206.193.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.206.193.131
description:
2025-02-03 23:08:44 dovecot_plain authenticator failed for host-37-206-193-131.business.telecomitalia.it [37.206.193.131]:41513: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.143.231.208
description:
Feb  3 23:08:47 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.143.231.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
description:
2025-02-03 23:08:58 dovecot_login authenticator failed for ([109.233.21.109]) [109.233.21.109]:54058: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.220.209.59
description:
Feb  3 23:08:16 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.220.209.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  3 23:08:37 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.14.36.47
description:
Feb  3 23:09:08 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.14.36.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.14.36.47
description:
2025-02-03 23:09:10 dovecot_login authenticator failed for ([60.14.36.47]) [60.14.36.47]:39669: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.37.177.99
description:
Feb  3 23:08:26 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.37.177.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.11.202.38
description:
2025-02-03 23:08:30 dovecot_login authenticator failed for ([59.11.202.38]) [59.11.202.38]:56316: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.0.134.10
description:
2025-02-03 23:08:54 dovecot_plain authenticator failed for ([153.0.134.10]) [153.0.134.10]:58851: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.233.21.109
description:
Feb  3 23:08:56 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.233.21.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.97.17.208
description:
Feb  3 23:10:12 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.97.17.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.29.100.218
description:
Feb  3 23:10:14 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.29.100.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.245.31.174
description:
2025-02-03 23:09:37 dovecot_login authenticator failed for ([183.245.31.174]) [183.245.31.174]:53212: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.192.94
description:
2025-02-03 23:10:04 dovecot_login authenticator failed for 186-247-192-94.user.veloxzone.com.br ([179.236.122.153]) [186.247.192.94]:42005: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.185.207.108
description:
[2025-02-03 23:10:11 +0100] info [webmaild] 197.185.207.108 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.65.27
description:
2025-02-03 23:09:45 dovecot_login authenticator failed for 46-10-65-27.ip.btc-net.bg [46.10.65.27]:36524: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.101.41.212
description:
[2025-02-03 23:09:50 +0100] info [webmaild] 177.101.41.212 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.192.94
description:
Feb  3 23:10:02 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.192.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.106.67.50
description:
Feb  3 23:09:24 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.106.67.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.103
description:
2025-02-03 23:09:48 dovecot_login authenticator failed for (m121-202-195-103.smartone.com) [121.202.195.103]:17474: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.255.209
description:
Feb  3 23:09:49 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.255.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.29.100.218
description:
2025-02-03 23:10:16 dovecot_login authenticator failed for ([60.29.100.218]) [60.29.100.218]:40037: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.245.31.174
description:
Feb  3 23:09:35 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.245.31.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.10.65.27
description:
Feb  3 23:09:43 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.10.65.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.195.103
description:
Feb  3 23:09:46 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.195.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.106.67.50
description:
2025-02-03 23:09:26 dovecot_login authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:46436: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.161.208.186
description:
[2025-02-03 23:09:40 +0100] info [webmaild] 189.161.208.186 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.182.71.73
description:
Feb  3 23:10:21 ait sshd[3773026]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.182.71.73  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.220.196
description:
Feb  3 23:11:15 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.220.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.139.150.2
description:
Feb  3 23:10:27 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.139.150.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Feb  3 23:10:53 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.81.209.157
description:
Feb  3 23:11:07 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.81.209.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.81.209.157
description:
2025-02-03 23:11:09 dovecot_plain authenticator failed for ([127.0.0.1]) [23.81.209.157]:62995: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.139.150.2
description:
2025-02-03 23:10:29 dovecot_plain authenticator failed for 2.sub-166-139-150.myvzw.com [166.139.150.2]:53642: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.150.27.132
description:
Feb  3 23:10:44 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.150.27.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.182.71.73
description:
Feb  3 23:10:21 ait sshd[3773026]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.182.71.73 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.211.97.51
description:
Feb  3 23:10:55 ait sshd[3773321]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.211.97.51  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.113.91
description:
Feb  3 23:10:40 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.113.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.97.51
description:
Feb  3 23:10:55 ait sshd[3773321]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.211.97.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.229.202
description:
2025-02-03 23:11:08 dovecot_plain authenticator failed for ([124.115.229.202]) [124.115.229.202]:45376: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.97.17.208
description:
Feb  3 23:10:22 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.97.17.208 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.106.43.194
description:
[2025-02-03 23:10:24 +0100] info [webmaild] 91.106.43.194 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-02-03 23:10:55 dovecot_plain authenticator failed for (whies) [109.166.70.166]:45269: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
description:
Feb  3 23:10:22 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.35.66.243
description:
Feb  3 23:10:37 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 4.35.66.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.35.66.243
description:
2025-02-03 23:10:39 dovecot_plain authenticator failed for ([4.35.66.243]) [4.35.66.243]:49632: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.97.10
description:
Feb  3 23:10:49 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.97.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.229.202
description:
Feb  3 23:11:06 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.229.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.156.185.224
description:
Feb  3 23:11:37 ait sshd[3773626]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.156.185.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.59.2
description:
Feb  3 23:12:14 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.59.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.59.2
description:
2025-02-03 23:12:16 dovecot_plain authenticator failed for syn-074-062-059-002.biz.spectrum.com [74.62.59.2]:40995: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.200.71
description:
Feb  3 23:11:18 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.200.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.200.71
description:
2025-02-03 23:11:20 dovecot_plain authenticator failed for (bibecomas) [65.20.200.71]:37630: 535 Incorrect authentication data (set_id=ads39a22282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.4.42.19
description:
Feb  3 23:11:25 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.4.42.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.143.30.155
description:
2025-02-03 23:12:04 dovecot_plain authenticator failed for ([222.143.30.155]) [222.143.30.155]:52342: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.220.196
description:
2025-02-03 23:11:17 dovecot_plain authenticator failed for ([95.221.220.196]) [95.221.220.196]:51054: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.156.185.224
description:
Feb  3 23:11:37 ait sshd[3773626]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.156.185.224  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.143.30.155
description:
Feb  3 23:12:02 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.143.30.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.196.106
description:
2025-02-03 23:12:35 dovecot_plain authenticator failed for 186-247-196-106.user.veloxzone.com.br (186-247-196-225.user.veloxzone.com.br) [186.247.196.106]:52937: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.111.34
description:
Feb  3 23:12:47 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.111.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.232.124.169
description:
Feb  3 23:12:30 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.232.124.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.196.106
description:
Feb  3 23:12:33 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.196.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.88.22
description:
2025-02-03 23:12:35 dovecot_login authenticator failed for ([61.150.88.22]) [61.150.88.22]:47847: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.217.229.150
description:
[2025-02-03 23:12:54 +0100] info [webmaild] 179.217.229.150 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 66.231.73.52
description:
[2025-02-03 23:13:10 +0100] info [webmaild] 66.231.73.52 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.251.23.95
description:
2025-02-03 23:12:18 dovecot_plain authenticator failed for (dynamic-ip-adsl.viettel.vn) [171.251.23.95]:38834: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.109.12.90
description:
[2025-02-03 23:12:24 +0100] info [webmaild] 179.109.12.90 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.180.193.176
description:
Feb  3 23:12:43 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.180.193.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.115.40.138
description:
2025-02-03 23:12:37 dovecot_plain authenticator failed for ([27.115.40.138]) [27.115.40.138]:56681: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.180.193.176
description:
2025-02-03 23:12:45 dovecot_login authenticator failed for wsip-184-180-193-176.tu.ok.cox.net [184.180.193.176]:53916: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.251.23.95
description:
Feb  3 23:12:16 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.251.23.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.150.88.22
description:
Feb  3 23:12:33 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.150.88.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.115.40.138
description:
Feb  3 23:12:35 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.115.40.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.51.29.21
description:
[2025-02-03 23:12:37 +0100] info [webmaild] 38.51.29.21 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.111.34
description:
2025-02-03 23:12:49 dovecot_plain authenticator failed for ([180.168.111.34]) [180.168.111.34]:38162: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
description:
Feb  3 23:14:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.89.70
description:
Feb  3 23:14:14 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.89.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-02-03 23:13:22 dovecot_plain authenticator failed for (jaglace) [109.166.70.166]:13617: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
description:
2025-02-03 23:14:11 dovecot_plain authenticator failed for (coevably) [102.53.15.56]:46912: 535 Incorrect authentication data (set_id=eng38b22452y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.151.20.214
description:
2025-02-03 23:14:07 dovecot_plain authenticator failed for p509714d6.dip0.t-ipconnect.de (kninables) [80.151.20.214]:36116: 535 Incorrect authentication data (set_id=eng38b22452y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
description:
Feb  3 23:14:13 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.93.183
description:
Feb  3 23:14:15 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.93.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Feb  3 23:13:20 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.249.93
description:
Feb  3 23:14:05 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.249.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.151.20.214
description:
Feb  3 23:14:05 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.151.20.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
description:
2025-02-03 23:14:15 dovecot_plain authenticator failed for (reterinal) [37.224.119.19]:46208: 535 Incorrect authentication data (set_id=eng38b22452y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.249.93
description:
2025-02-03 23:14:07 dovecot_login authenticator failed for ([96.79.249.93]) [96.79.249.93]:57943: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.156.142.238
description:
Feb  3 23:14:15 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.156.142.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.89.70
description:
2025-02-03 23:14:16 dovecot_plain authenticator failed for ([106.246.89.70]) [106.246.89.70]:41979: 535 Incorrect authentication data (set_id=abio17@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.115.19.225
description:
Feb  3 23:14:25 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.115.19.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.113.91.98
description:
Feb  3 23:14:31 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.113.91.98 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 3.141.24.81
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:stprincewill5@gmail.com||WPU:stprincewill5@gmail.com||RSV:6.65||T:APACHE||MV:23-15.3.141.24.81


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.144.100.159
description:
Feb  3 23:15:08 ait sshd[3775077]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.144.100.159 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 130.61.228.21
description:
Feb  3 23:14:34 ait sshd[3774682]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=130.61.228.21  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.180.173.244
description:
[2025-02-03 23:15:00 +0100] info [webmaild] 187.180.173.244 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.144.100.159
description:
Feb  3 23:15:08 ait sshd[3775077]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.144.100.159  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
description:
2025-02-03 23:14:17 dovecot_plain authenticator failed for (corporativo.static.gvt.net.br) [189.115.93.183]:52624: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.246.69.10
description:
[2025-02-03 23:15:13 +0100] info [webmaild] 170.246.69.10 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.142.238
description:
2025-02-03 23:14:17 dovecot_login authenticator failed for ([114.143.224.97]) [182.156.142.238]:23367: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.115.19.225
description:
2025-02-03 23:14:27 dovecot_plain authenticator failed for 24.115.19.225.res-cmts.sm3.ptd.net [24.115.19.225]:32994: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.61.228.21
description:
Feb  3 23:14:34 ait sshd[3774682]: pam_imunify(sshd:auth): [IM360_RBL] The IP 130.61.228.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.113.91.98
description:
2025-02-03 23:14:33 dovecot_plain authenticator failed for ([223.113.91.98]) [223.113.91.98]:56168: 535 Incorrect authentication data (set_id=abio17)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.104.180
description:
2025-02-03 23:15:44 dovecot_plain authenticator failed for ([218.94.104.181]) [218.94.104.180]:41548: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Feb  3 23:15:18 ait sshd[3775115]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.191.27
description:
Feb  3 23:15:40 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.191.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.104.180
description:
Feb  3 23:15:42 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.104.180 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.59.188.36
description:
[2025-02-03 23:15:32 +0100] info [webmaild] 138.59.188.36 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
description:
2025-02-03 23:15:42 dovecot_plain authenticator failed for ([175.205.191.27]) [175.205.191.27]:56988: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Feb  3 23:15:18 ait sshd[3775115]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=aitopen


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
description:
Feb  3 23:15:25 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.165.222
description:
2025-02-03 23:15:30 dovecot_plain authenticator failed for ([183.247.165.222]) [183.247.165.222]:39949: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 3.141.24.81
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:zekpa2015||WPU:zekpa2015||RSV:6.65||T:APACHE||MV:23-16.3.141.24.81


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.220.242.224
description:
[2025-02-03 23:15:45 +0100] info [webmaild] 179.220.242.224 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.165.222
description:
Feb  3 23:15:28 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.165.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
description:
2025-02-03 23:15:27 dovecot_plain authenticator failed for ([220.80.223.144]) [220.80.223.144]:51286: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-15.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.120.208.148
description:
2025-02-03 23:17:11 dovecot_plain authenticator failed for ([146.120.208.148]) [146.120.208.148]:34581: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.181.19.131
description:
2025-02-03 23:17:12 dovecot_plain authenticator failed for static-190-181-19-131.acelerate.net [190.181.19.131]:61255: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.196.31.2
description:
Feb  3 23:17:13 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.196.31.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.12.145.198
description:
2025-02-03 23:17:15 dovecot_plain authenticator failed for ([111.12.145.198]) [111.12.145.198]:55361: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
description:
2025-02-03 23:17:15 dovecot_plain authenticator failed for ([121.128.76.110]) [211.196.31.2]:35804: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.4.42.19
description:
Feb  3 23:16:47 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.4.42.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.4.42.19
description:
2025-02-03 23:16:49 dovecot_plain authenticator failed for (host-194-4-42-19.net.intranetwifi.it) [194.4.42.19]:38292: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.120.208.148
description:
Feb  3 23:17:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.120.208.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.12.145.198
description:
Feb  3 23:17:13 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.12.145.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Feb  3 23:17:04 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-02-03 23:17:06 dovecot_plain authenticator failed for (nonia) [46.30.161.197]:35648: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.19.131
description:
Feb  3 23:17:10 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.19.131 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  3 23:17:39 ait sshd[3776016]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.152.82.139
description:
[2025-02-03 23:17:42 +0100] info [webmaild] 177.152.82.139 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.24.87.18
description:
2025-02-03 23:17:27 dovecot_plain authenticator failed for ([183.24.87.18]) [183.24.87.18]:49733: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.181.49.3
description:
2025-02-03 23:17:31 dovecot_plain authenticator failed for ([216.181.49.3]) [216.181.49.3]:39540: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Feb  3 23:17:39 ait sshd[3776016]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.35.63.30
description:
2025-02-03 23:17:31 dovecot_plain authenticator failed for ([110.35.63.30]) [110.35.63.30]:60792: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.131.163.41
description:
Feb  3 23:17:32 ait sshd[3776002]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.163.41  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.4.35.154
description:
[2025-02-03 23:17:44 +0100] info [webmaild] 45.4.35.154 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.196.146.249
description:
[2025-02-03 23:18:11 +0100] info [webmaild] 168.196.146.249 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.120.163.110
description:
Feb  3 23:17:27 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.120.163.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.35.63.30
description:
Feb  3 23:17:29 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.35.63.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
description:
2025-02-03 23:17:29 dovecot_plain authenticator failed for ([212.120.163.110]) [212.120.163.110]:36158: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.131.163.41
description:
Feb  3 23:17:32 ait sshd[3776002]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.131.163.41 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.48.48.69
description:
Feb  3 23:18:01 ait sshd[3776169]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.48.48.69  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  3 23:17:24 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.24.87.18
description:
Feb  3 23:17:25 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.24.87.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.181.49.3
description:
Feb  3 23:17:29 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.181.49.3 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.176.128.107
description:
[2025-02-03 23:18:18 +0100] info [webmaild] 31.176.128.107 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.54.36
description:
Feb  3 23:18:27 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.54.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.172.239.193
description:
Feb  3 23:18:34 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.172.239.193 has been locked due to Imunify RBL


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 124.48.48.69
description:
Feb  3 23:18:18 ait sshd[3776169]: error: maximum authentication attempts exceeded for root from 124.48.48.69 port 36650 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.54.36
description:
2025-02-03 23:18:29 dovecot_login authenticator failed for ([60.172.54.36]) [60.172.54.36]:46837: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.172.239.193
description:
2025-02-03 23:18:36 dovecot_login authenticator failed for sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:56375: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.248.243.181
description:
Feb  3 23:19:02 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.248.243.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Feb  3 23:19:03 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
description:
2025-02-03 23:19:04 dovecot_plain authenticator failed for (ovoendys) [41.248.243.181]:51004: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.61.67
description:
47.128.61.67 - - [03/Feb/2025:23:19:06 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17885319 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=106%2C125%2C205%2C30&filter_course-language=79%2C118&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.61.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.122
description:
2025-02-03 23:19:35 dovecot_plain authenticator failed for ([103.79.175.122]) [103.79.175.122]:34396: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.24.154.232
description:
Feb  3 23:19:54 ait sshd[3776730]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.24.154.232


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.180.0
description:
Feb  3 23:20:08 ait sshd[3776972]: pam_imunify(sshd:auth): [IM360_RBL] The IP 143.110.180.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.76.69.221
description:
Feb  3 23:20:14 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.76.69.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Feb  3 23:19:18 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.180.129.87
description:
Feb  3 23:19:27 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.180.129.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.122
description:
Feb  3 23:19:33 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.24.154.232
description:
Feb  3 23:19:54 ait sshd[3776730]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.24.154.232 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 143.110.180.0
description:
Feb  3 23:20:08 ait sshd[3776972]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.110.180.0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.108.45.83
description:
Feb  3 23:19:17 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.108.45.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.108.45.83
description:
2025-02-03 23:19:19 dovecot_plain authenticator failed for ([218.108.45.83]) [218.108.45.83]:57418: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Feb  3 23:20:28 ait sshd[3777107]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 142.4.1.40
description:
Feb  3 23:21:05 ait sshd[3777296]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.4.1.40  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Feb  3 23:20:28 ait sshd[3777107]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  3 23:21:00 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.4.1.40
description:
Feb  3 23:21:05 ait sshd[3777296]: pam_imunify(sshd:auth): [IM360_RBL] The IP 142.4.1.40 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.140.114.221
description:
[2025-02-03 23:20:24 +0100] info [webmaild] 200.140.114.221 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.153.199.210
description:
[2025-02-03 23:20:41 +0100] info [webmaild] 103.153.199.210 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.123.165.145
description:
[2025-02-03 23:20:26 +0100] info [webmaild] 187.123.165.145 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Feb  3 23:20:39 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-02-03 23:20:41 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (coraphylor) [91.56.31.167]:63276: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 72.27.183.30
description:
[2025-02-03 23:20:56 +0100] info [webmaild] 72.27.183.30 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 195.211.190.14
domain: aitedu.net
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/.git/config||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
description:
Feb  3 23:21:54 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
description:
2025-02-03 23:21:56 dovecot_login authenticator failed for ([61.153.208.38]) [61.153.208.38]:17655: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.188.143.166
description:
Feb  3 23:21:50 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.188.143.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.93
description:
2025-02-03 23:22:03 dovecot_plain authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:17282: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
description:
2025-02-03 23:21:52 dovecot_plain authenticator failed for ([180.188.143.166]) [180.188.143.166]:41398: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.93
description:
Feb  3 23:22:01 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.105.223
description:
Feb  3 23:21:37 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.105.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.223
description:
2025-02-03 23:21:39 dovecot_login authenticator failed for 110-25-105-223.adsl.fetnet.net [110.25.105.223]:47706: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.167.35.29
description:
Feb  3 23:22:39 ait sshd[3777928]: pam_imunify(sshd:auth): [IM360_RBL] The IP 72.167.35.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.139.35.161
description:
2025-02-03 23:22:41 dovecot_plain authenticator failed for 161.sm-u1.dialup.garlic.net [216.139.35.161]:41890: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.123.198.105
description:
[2025-02-03 23:22:45 +0100] info [webmaild] 94.123.198.105 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.99.36.130
description:
Feb  3 23:22:24 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.99.36.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.139.35.161
description:
Feb  3 23:22:39 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.139.35.161 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.71.174.62
description:
[2025-02-03 23:22:59 +0100] info [webmaild] 45.71.174.62 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.99.36.130
description:
2025-02-03 23:22:26 dovecot_plain authenticator failed for ([50.99.36.130]) [50.99.36.130]:35576: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 72.167.35.29
description:
Feb  3 23:22:39 ait sshd[3777928]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=72.167.35.29  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  3 23:22:57 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.71.26.149
description:
[2025-02-03 23:23:28 +0100] info [webmaild] 177.71.26.149 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.25.206
description:
2025-02-03 23:23:33 dovecot_plain authenticator failed for 111-70-25-206.emome-ip.hinet.net [111.70.25.206]:42693: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.230.100.252
description:
Feb  3 23:23:40 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.230.100.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.19.80.138
description:
Feb  3 23:23:50 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.19.80.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.16.4
description:
2025-02-03 23:24:02 dovecot_plain authenticator failed for (infled) [149.0.16.4]:52700: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.123.208.246
description:
Feb  3 23:23:18 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.123.208.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.25.206
description:
Feb  3 23:23:31 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.25.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.168.168.248
description:
[2025-02-03 23:23:32 +0100] info [webmaild] 45.168.168.248 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.230.100.252
description:
2025-02-03 23:23:42 dovecot_login authenticator failed for ([38.230.100.252]) [38.230.100.252]:53431: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.202.71.21
description:
2025-02-03 23:23:22 dovecot_plain authenticator failed for ([211.202.71.21]) [211.202.71.21]:55526: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.16.4
description:
Feb  3 23:24:00 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.16.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.202.71.21
description:
Feb  3 23:23:20 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.202.71.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.19.80.138
description:
2025-02-03 23:23:52 dovecot_login authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:47527: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.62.113
description:
2025-02-03 23:25:11 dovecot_plain authenticator failed for (lr8qs0qd2i9w937w1imi4mwlx1jqa) [77.40.62.113]:14780: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.43.253.231
description:
Feb  3 23:24:22 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.43.253.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.43.253.231
description:
2025-02-03 23:24:24 dovecot_plain authenticator failed for wllk-bri-66-ip-66-43-253-231.wireless.netins.net [66.43.253.231]:58531: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.32.229.86
description:
Feb  3 23:24:31 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.32.229.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.32.229.86
description:
2025-02-03 23:24:33 dovecot_plain authenticator failed for (host-41.32.229.86.tedata.net) [41.32.229.86]:55978: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.248.116.230
description:
Feb  3 23:24:51 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.248.116.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.248.116.230
description:
2025-02-03 23:24:53 dovecot_plain authenticator failed for data.autofrant.ru (repte) [151.248.116.230]:53792: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.62.113
description:
Feb  3 23:25:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.62.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.233.199.62
description:
[2025-02-03 23:25:39 +0100] info [webmaild] 170.233.199.62 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.104.21.52
description:
[2025-02-03 23:26:12 +0100] info [webmaild] 177.104.21.52 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.62.113
description:
Feb  3 23:25:15 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.62.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.93.172.127
description:
Feb  3 23:25:21 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.93.172.127 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 192.141.123.55
description:
[2025-02-03 23:25:29 +0100] info [webmaild] 192.141.123.55 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.252.60.195
description:
Feb  3 23:25:45 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.252.60.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.30.64.157
description:
[2025-02-03 23:25:59 +0100] info [webmaild] 189.30.64.157 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.62.113
description:
2025-02-03 23:25:17 dovecot_plain authenticator failed for (0optlrtuf0syx7v2c9mn7zx) [77.40.62.113]:16431: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.227.194
description:
2025-02-03 23:26:20 dovecot_plain authenticator failed for ([196.200.227.194]) [196.200.227.194]:48116: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.156.85
description:
Feb  3 23:26:28 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.156.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.156.85
description:
2025-02-03 23:26:30 dovecot_plain authenticator failed for (abts-north-static-085.156.160.122.airtelbroadband.in) [122.160.156.85]:48656: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.81.242
description:
Feb  3 23:27:02 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.81.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.139.150.2
description:
Feb  3 23:27:06 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.139.150.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.139.150.2
description:
2025-02-03 23:27:08 dovecot_plain authenticator failed for 2.sub-166-139-150.myvzw.com [166.139.150.2]:56338: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.200.227.194
description:
Feb  3 23:26:18 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.200.227.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.52.211.184
description:
Feb  3 23:27:44 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.52.211.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Feb  3 23:27:44 ait sshd[3779636]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.114.180.50
description:
Feb  3 23:27:53 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.114.180.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.180.50
description:
2025-02-03 23:27:55 dovecot_plain authenticator failed for ([124.114.180.50]) [124.114.180.50]:40776: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.5.145.179
description:
Feb  3 23:27:25 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.5.145.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.113.91
description:
Feb  3 23:27:37 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.113.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.101.131.83
description:
2025-02-03 23:27:36 dovecot_login authenticator failed for ([92.101.131.83]) [92.101.131.83]:48413: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.107.204.146
description:
Feb  3 23:28:02 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.107.204.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
description:
2025-02-03 23:27:46 dovecot_plain authenticator failed for 177-72-87-7.static.as262543.net.br (7.lifedns.com.br) [177.72.87.7]:52392: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.20.26.201
description:
2025-02-03 23:28:06 dovecot_login authenticator failed for 211-20-26-201.hinet-ip.hinet.net [211.20.26.201]:47658: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.81.242
description:
Feb  3 23:27:18 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.81.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.54.3.2
description:
Feb  3 23:27:25 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.54.3.2 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Feb  3 23:27:44 ait sshd[3779636]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.87.7
description:
Feb  3 23:27:44 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.87.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.34.22.236
description:
[2025-02-03 23:28:00 +0100] info [webmaild] 212.34.22.236 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.20.26.201
description:
Feb  3 23:28:04 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.20.26.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.253.166.181
description:
Feb  3 23:28:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.253.166.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  3 23:27:19 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.121
description:
Feb  3 23:27:30 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.101.131.83
description:
Feb  3 23:27:34 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.101.131.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.54.3.2
description:
2025-02-03 23:27:27 dovecot_plain authenticator failed for ([182.54.3.2]) [182.54.3.2]:49550: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.121
description:
2025-02-03 23:27:32 dovecot_plain authenticator failed for ([185.167.58.121]) [185.167.58.121]:49732: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.253.166.181
description:
Feb  3 23:28:17 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.253.166.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.92.77
description:
2025-02-03 23:28:31 dovecot_plain authenticator failed for ([124.246.92.77]) [124.246.92.77]:55033: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.121.69
description:
2025-02-03 23:29:13 dovecot_plain authenticator failed for ([183.238.121.69]) [183.238.121.69]:52413: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.246.92.77
description:
Feb  3 23:28:29 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.246.92.77 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.84.21.45
description:
[2025-02-03 23:28:31 +0100] info [webmaild] 170.84.21.45 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
description:
2025-02-03 23:28:37 dovecot_plain authenticator failed for ([61.81.151.97]) [61.81.151.97]:43514: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.204.128
description:
[2025-02-03 23:28:48 +0100] info [webmaild] 168.232.204.128 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.107.204.146
description:
Feb  3 23:28:17 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.107.204.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 94.154.35.67
description:
2025-02-03 23:28:28 H=(win-7n1fiecl6ic.domain) [94.154.35.67]:53278 F=<test@your-server.de> rejected RCPT <grantrussz@outlook.com>: Rejected relay attempt: '94.154.35.67' From: 'test@your-server.de' To: 'grantrussz@outlook.com'


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.252.218
description:
2025-02-03 23:28:20 dovecot_plain authenticator failed for ([220.189.252.218]) [220.189.252.218]:34736: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
description:
Feb  3 23:28:35 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.121.69
description:
Feb  3 23:29:11 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.121.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.133.10.204
description:
Feb  3 23:29:12 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.133.10.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.133.10.204
description:
2025-02-03 23:29:14 dovecot_plain authenticator failed for ([61.133.10.205]) [61.133.10.204]:60894: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.85.19.249
description:
[2025-02-03 23:28:16 +0100] info [webmaild] 187.85.19.249 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.252.218
description:
Feb  3 23:28:18 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.252.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.190.39.142
description:
2025-02-03 23:29:27 dovecot_plain authenticator failed for ([196.201.20.98]) [41.190.39.142]:36910: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.90.227.255
description:
Feb  3 23:30:07 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.90.227.255 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.190.39.142
description:
Feb  3 23:29:25 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.190.39.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.210.232
description:
2025-02-03 23:29:23 dovecot_plain authenticator failed for ([87.103.210.232]) [87.103.210.232]:48436: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.195.104
description:
Feb  3 23:29:29 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.187.195.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.255.21.110
description:
Feb  3 23:29:59 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.255.21.110 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-30.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.210.232
description:
Feb  3 23:29:21 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.210.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.156.85
description:
Feb  3 23:30:39 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.156.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.88.67.1
description:
Feb  3 23:30:42 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.88.67.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.29.121.110
description:
Feb  3 23:30:47 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.29.121.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.75.218.103
description:
Feb  3 23:30:52 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.75.218.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
description:
2025-02-03 23:30:54 dovecot_plain authenticator failed for ([103.55.89.5]) [116.75.218.103]:33682: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
description:
Feb  3 23:31:01 ait sshd[3780748]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49  user=gvu


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.188.48.220
description:
[2025-02-03 23:30:29 +0100] info [webmaild] 38.188.48.220 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
description:
Feb  3 23:30:37 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.83.123.71
description:
[2025-02-03 23:30:59 +0100] info [webmaild] 170.83.123.71 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
description:
Feb  3 23:31:01 ait sshd[3780748]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.78
description:
Feb  3 23:30:27 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.78
description:
2025-02-03 23:30:29 dovecot_plain authenticator failed for (nsg-corporate-78.229.187.122.airtel.in) [122.187.229.78]:39011: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
description:
2025-02-03 23:30:39 dovecot_plain authenticator failed for ([177.43.106.73]) [177.43.106.73]:49984: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.156.85
description:
2025-02-03 23:30:41 dovecot_plain authenticator failed for (abts-north-static-085.156.160.122.airtelbroadband.in) [122.160.156.85]:42514: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.233.84.149
description:
[2025-02-03 23:30:45 +0100] info [webmaild] 45.233.84.149 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.88.67.1
description:
2025-02-03 23:30:44 dovecot_plain authenticator failed for (wtl.worldcall.net.pk) [111.88.67.1]:49654: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.29.121.110
description:
2025-02-03 23:30:49 dovecot_plain authenticator failed for ([46.29.121.110]) [46.29.121.110]:38284: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.103
description:
Feb  3 23:31:24 ait sshd[3780946]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.103 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.103
description:
Feb  3 23:31:24 ait sshd[3780946]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.103


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.233
description:
Feb  3 23:31:37 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.233
description:
2025-02-03 23:31:39 dovecot_plain authenticator failed for (nsg-corporate-233.228.187.122.airtel.in) [122.187.228.233]:34866: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.255.44.46
description:
[2025-02-03 23:31:19 +0100] info [webmaild] 191.255.44.46 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.29.196.170
description:
Feb  3 23:31:20 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.29.196.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.29.196.170
description:
2025-02-03 23:31:22 dovecot_plain authenticator failed for ([71.29.196.170]) [71.29.196.170]:46344: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.167.235
description:
2025-02-03 23:32:14 dovecot_login authenticator failed for (ADMIN) [181.214.167.235]:43966: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  3 23:32:15 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.166.214
description:
2025-02-03 23:32:34 dovecot_login authenticator failed for ([220.180.166.214]) [220.180.166.214]:35600: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.233.177.34
description:
Feb  3 23:32:39 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.233.177.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.233.177.34
description:
2025-02-03 23:32:41 dovecot_login authenticator failed for ([183.233.177.34]) [183.233.177.34]:41448: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.56.11.148
description:
Feb  3 23:32:48 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.56.11.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.56.11.148
description:
2025-02-03 23:32:50 dovecot_login authenticator failed for 93-56-11-148.ip287.fastwebnet.it [93.56.11.148]:40796: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
description:
Feb  3 23:32:21 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.166.214
description:
Feb  3 23:32:32 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.166.214 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.49.209.34
description:
[2025-02-03 23:33:10 +0100] info [webmaild] 179.49.209.34 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
description:
2025-02-03 23:32:23 dovecot_login authenticator failed for ([195.222.57.182]) [195.222.57.190]:44346: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.252.8.34
description:
2025-02-03 23:33:46 dovecot_plain authenticator failed for ([43.252.8.34]) [43.252.8.34]:40806: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.208.136.225
description:
Feb  3 23:33:48 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.208.136.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.88.121.73
description:
2025-02-03 23:34:10 dovecot_plain authenticator failed for ([115.88.121.73]) [115.88.121.73]:50928: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.111.139.88
description:
2025-02-03 23:33:19 dovecot_plain authenticator failed for pool-98-111-139-88.phlapa.fios.verizon.net [98.111.139.88]:35385: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.5
description:
Feb  3 23:33:28 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.221.56
description:
Feb  3 23:33:37 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.221.56 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.171.97.216
description:
[2025-02-03 23:34:09 +0100] info [webmaild] 38.171.97.216 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.245.145.254
description:
2025-02-03 23:34:11 dovecot_login authenticator failed for ([157.245.145.254]) [157.245.145.254]:40206: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.5
description:
2025-02-03 23:33:30 dovecot_plain authenticator failed for 111-70-32-5.emome-ip.hinet.net [111.70.32.5]:53326: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.145.108.234
description:
Feb  3 23:33:31 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.145.108.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.30.115
description:
2025-02-03 23:33:56 dovecot_plain authenticator failed for ([5.31.30.115]) [5.31.30.115]:44690: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.90.207.82
description:
Feb  3 23:34:07 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.90.207.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.145.254
description:
Feb  3 23:34:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.145.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.90.207.82
description:
2025-02-03 23:34:09 dovecot_login authenticator failed for ([182.90.207.82]) [182.90.207.82]:40383: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.252.8.34
description:
Feb  3 23:33:44 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.252.8.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.30.115
description:
Feb  3 23:33:54 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.30.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.111.139.88
description:
Feb  3 23:33:17 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.111.139.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.221.56
description:
2025-02-03 23:33:39 dovecot_plain authenticator failed for ([183.236.221.56]) [183.236.221.56]:49758: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.12.240.14
description:
2025-02-03 23:33:42 dovecot_login authenticator failed for ([85.12.240.14]) [85.12.240.14]:38362: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.12.240.14
description:
Feb  3 23:33:40 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.12.240.14 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.103
description:
Feb  3 23:33:50 ait sshd[3781836]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.103  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.103
description:
Feb  3 23:33:50 ait sshd[3781836]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.145.108.234
description:
2025-02-03 23:33:33 dovecot_plain authenticator failed for ([216.145.108.234]) [216.145.108.234]:54274: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.131.135.179
description:
[2025-02-03 23:33:35 +0100] info [webmaild] 177.131.135.179 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.194.8.74
description:
[2025-02-03 23:33:39 +0100] info [webmaild] 185.194.8.74 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.136.225
description:
2025-02-03 23:33:50 dovecot_login authenticator failed for 31-208-136-225.cust.bredband2.com [31.208.136.225]:56354: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.194.9.65
description:
2025-02-03 23:34:25 dovecot_login authenticator failed for syn-024-194-009-065.res.spectrum.com [24.194.9.65]:52432: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.20.170
description:
Feb  3 23:34:20 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.20.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
description:
2025-02-03 23:34:22 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:55817: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.194.9.65
description:
Feb  3 23:34:23 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.194.9.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.44.165
description:
2025-02-03 23:36:09 dovecot_plain authenticator failed for ([49.245.44.165]) [49.245.44.165]:42905: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.67.186.253
description:
Feb  3 23:35:30 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.67.186.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.31
description:
2025-02-03 23:35:37 dovecot_login authenticator failed for (m121-202-200-31.smartone.com) [121.202.200.31]:16256: 535 Incorrect authentication data (set_id=abs3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
description:
2025-02-03 23:35:38 dovecot_plain authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:34868: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
description:
2025-02-03 23:35:44 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:43608: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.116.95.48
description:
Feb  3 23:35:48 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.116.95.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.44.165
description:
Feb  3 23:36:07 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.44.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.48.29
description:
2025-02-03 23:35:26 dovecot_login authenticator failed for ([112.102.48.29]) [112.102.48.29]:33072: 535 Incorrect authentication data (set_id=abs3@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.67.186.253
description:
2025-02-03 23:35:32 dovecot_plain authenticator failed for ([222.67.186.253]) [222.67.186.253]:35008: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.31
description:
Feb  3 23:35:35 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.129.201.81
description:
Feb  3 23:35:36 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.129.201.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.116.95.48
description:
2025-02-03 23:35:50 dovecot_plain authenticator failed for ([203.116.95.48]) [203.116.95.48]:58206: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.106.225.68
description:
[2025-02-03 23:36:05 +0100] info [webmaild] 189.106.225.68 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.210.232
description:
2025-02-03 23:35:31 dovecot_plain authenticator failed for ([87.103.210.232]) [87.103.210.232]:43169: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
description:
Feb  3 23:35:54 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.48.39.18
description:
2025-02-03 23:36:05 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:53170: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.119.20.149
description:
Feb  3 23:35:34 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.119.20.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
description:
Feb  3 23:35:42 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.124.241.138
description:
2025-02-03 23:35:50 dovecot_plain authenticator failed for ([116.124.241.138]) [116.124.241.138]:55456: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
description:
2025-02-03 23:35:56 dovecot_plain authenticator failed for (culfory) [88.87.84.104]:33026: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.93.113.138
description:
2025-02-03 23:35:32 dovecot_plain authenticator failed for ([41.93.113.138]) [41.93.113.138]:51914: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.1.40.151
description:
Feb  3 23:35:36 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.1.40.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.119.20.149
description:
2025-02-03 23:35:36 dovecot_login authenticator failed for ([175.119.20.149]) [175.119.20.149]:50047: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
description:
2025-02-03 23:35:51 dovecot_plain authenticator failed for (nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:51850: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.223.176.171
description:
Feb  3 23:35:18 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.223.176.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
description:
2025-02-03 23:35:20 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:39586: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.93.113.138
description:
Feb  3 23:35:30 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.93.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.45.68
description:
2025-02-03 23:35:32 dovecot_plain authenticator failed for ([218.146.45.68]) [218.146.45.68]:46178: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.199.11
description:
Feb  3 23:35:39 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.199.11 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.73.176.210
description:
[2025-02-03 23:35:43 +0100] info [webmaild] 189.73.176.210 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.226.240
description:
Feb  3 23:35:49 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.226.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.48.39.18
description:
Feb  3 23:36:03 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.48.39.18 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.147.63
description:
[2025-02-03 23:36:12 +0100] info [webmaild] 179.125.147.63 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.102.48.29
description:
Feb  3 23:35:24 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.102.48.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.210.232
description:
Feb  3 23:35:29 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.210.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.45.68
description:
Feb  3 23:35:30 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.45.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.124.241.138
description:
Feb  3 23:35:48 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.124.241.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.101.131.83
description:
Feb  3 23:35:51 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.101.131.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.101.131.83
description:
2025-02-03 23:35:53 dovecot_plain authenticator failed for ([92.101.131.83]) [92.101.131.83]:42496: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.129.201.81
description:
2025-02-03 23:35:38 dovecot_plain authenticator failed for ([103.129.201.82]) [103.129.201.81]:38156: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.199.11
description:
2025-02-03 23:35:41 dovecot_plain authenticator failed for (ppp11-lumwana.zamnet.zm) [196.46.199.11]:58603: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.151.148
description:
Feb  3 23:36:46 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.151.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.108.88.121
description:
2025-02-03 23:36:51 dovecot_plain authenticator failed for ([113.108.88.121]) [113.108.88.121]:32904: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.50
description:
2025-02-03 23:37:00 dovecot_plain authenticator failed for ([213.154.80.21]) [213.154.80.50]:47773: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.3.134.232
description:
Feb  3 23:37:05 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.3.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.238.206
description:
Feb  3 23:36:44 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.238.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.86.134.216
description:
Feb  3 23:36:48 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.86.134.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.219.154.156
description:
Feb  3 23:36:49 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.219.154.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
description:
Feb  3 23:36:54 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.120.57.125
description:
Feb  3 23:37:06 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.120.57.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.186.57
description:
Feb  3 23:36:46 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.186.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.177.38
description:
Feb  3 23:36:55 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.177.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.205.48.62
description:
Feb  3 23:36:59 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.205.48.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.80.209
description:
2025-02-03 23:37:01 dovecot_plain authenticator failed for ([2.55.80.209]) [2.55.80.209]:59777: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.132.150.162
description:
Feb  3 23:36:57 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.132.150.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.28.26.250
description:
2025-02-03 23:36:57 dovecot_plain authenticator failed for (201-28-26-250.customer.tdatabrasil.net.br) [201.28.26.250]:49976: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.228.78.6
description:
[2025-02-03 23:36:41 +0100] info [webmaild] 186.228.78.6 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.204.162.116
description:
Feb  3 23:36:44 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.204.162.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.238.206
description:
2025-02-03 23:36:46 dovecot_plain authenticator failed for ([95.221.238.206]) [95.221.238.206]:39572: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.60.13
description:
2025-02-03 23:36:48 dovecot_plain authenticator failed for ([112.196.60.13]) [112.196.60.13]:58538: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.120
description:
Feb  3 23:36:49 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.151.51.223
description:
2025-02-03 23:36:53 dovecot_plain authenticator failed for customer-ip-193-151-51-223.ipv.net.pl [193.151.51.223]:38454: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.80.209
description:
Feb  3 23:36:59 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.80.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.15.251.33
description:
Feb  3 23:37:06 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.15.251.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.212.190.170
description:
Feb  3 23:36:44 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.212.190.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.16.161.35
description:
2025-02-03 23:36:48 dovecot_plain authenticator failed for ([105.16.161.35]) [105.16.161.35]:46032: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.195.225.182
description:
2025-02-03 23:36:50 dovecot_plain authenticator failed for 123-195-225-182.dynamic.kbronet.com.tw [123.195.225.182]:41164: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.123.175.194
description:
Feb  3 23:37:01 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.123.175.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.231.242
description:
Feb  3 23:37:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.231.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.58.94
description:
2025-02-03 23:37:10 dovecot_plain authenticator failed for ([183.238.58.94]) [183.238.58.94]:41591: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.49.167.162
description:
Feb  3 23:36:44 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.49.167.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.136.164.157
description:
Feb  3 23:36:46 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.136.164.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.67.133.193
description:
2025-02-03 23:36:59 dovecot_plain authenticator failed for ([222.67.133.193]) [222.67.133.193]:10246: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.86.134.216
description:
2025-02-03 23:36:50 dovecot_plain authenticator failed for syn-097-086-134-216.res.spectrum.com [97.86.134.216]:4038: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
description:
2025-02-03 23:36:51 dovecot_plain authenticator failed for ([103.219.154.156]) [103.219.154.156]:40298: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
description:
2025-02-03 23:37:08 dovecot_plain authenticator failed for 221-120-57-125.emome-ip.hinet.net [221.120.57.125]:56052: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.159.145.190
description:
2025-02-03 23:36:48 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:53060: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.34.142
description:
Feb  3 23:36:49 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.34.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.156.97.198
description:
Feb  3 23:36:50 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.156.97.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
description:
Feb  3 23:37:01 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.211.203.185
description:
2025-02-03 23:37:06 dovecot_plain authenticator failed for ([50.211.203.185]) [50.211.203.185]:51460: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.6.69.226
description:
2025-02-03 23:37:10 dovecot_plain authenticator failed for ([221.6.69.226]) [221.6.69.226]:41165: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.151.148
description:
2025-02-03 23:36:48 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.151.148]:45680: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.170.102
description:
2025-02-03 23:36:50 dovecot_plain authenticator failed for ([183.234.170.102]) [183.234.170.102]:21536: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.31.8.12
description:
Feb  3 23:37:02 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.31.8.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.240.26.106
description:
Feb  3 23:37:04 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.240.26.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.53.59
description:
2025-02-03 23:37:03 dovecot_plain authenticator failed for (58-115-53-59.twt1.com.tw) [58.115.53.59]:41102: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.58.94
description:
Feb  3 23:37:08 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.58.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.67.133.193
description:
Feb  3 23:36:57 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.67.133.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.117.32.22
description:
2025-02-03 23:36:59 dovecot_plain authenticator failed for ([87.117.32.22]) [87.117.32.22]:59020: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Feb  3 23:37:06 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.9
description:
2025-02-03 23:36:46 dovecot_plain authenticator failed for ([185.167.58.9]) [185.167.58.9]:51908: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.26.59
description:
2025-02-03 23:36:54 dovecot_plain authenticator failed for ([195.158.26.59]) [195.158.26.59]:32776: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.249
description:
2025-02-03 23:36:55 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.152.249]:55970: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.59.174
description:
2025-02-03 23:36:58 dovecot_plain authenticator failed for ([222.236.59.174]) [222.236.59.174]:40470: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
description:
2025-02-03 23:37:05 dovecot_plain authenticator failed for ([211.109.75.66]) [211.109.75.69]:54928: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-02-03 23:37:08 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:49012: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
description:
2025-02-03 23:36:48 dovecot_plain authenticator failed for syn-208-105-196-214.biz.spectrum.com (rrcs-208-105-196-214.nys.biz.rr.com) [208.105.196.214]:33245: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.134.142.166
description:
Feb  3 23:37:04 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.134.142.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.200.227.194
description:
Feb  3 23:37:01 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.200.227.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.115.211
description:
2025-02-03 23:37:05 dovecot_plain authenticator failed for (211.115.156.175.unknown.m1.com.sg) [175.156.115.211]:38081: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.175.194.139
description:
Feb  3 23:36:46 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.175.194.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
description:
2025-02-03 23:36:46 dovecot_plain authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:61138: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.55.177.39
description:
2025-02-03 23:36:50 dovecot_plain authenticator failed for ([218.55.177.39]) [218.55.177.39]:57722: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.236.59.174
description:
Feb  3 23:36:56 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.236.59.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.154.80.50
description:
Feb  3 23:36:58 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.154.80.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.125.200
description:
2025-02-03 23:37:13 dovecot_plain authenticator failed for (2-55-125-200.orange.net.il) [2.55.125.200]:56246: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.55.177.39
description:
Feb  3 23:36:48 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.55.177.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.133.182
description:
Feb  3 23:36:48 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.133.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.33.74.81
description:
Feb  3 23:36:48 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.33.74.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.175.194.139
description:
2025-02-03 23:36:48 dovecot_plain authenticator failed for syn-072-175-194-139.res.spectrum.com [72.175.194.139]:26071: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
description:
2025-02-03 23:36:48 dovecot_plain authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:49087: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.120
description:
2025-02-03 23:36:51 dovecot_plain authenticator failed for ([121.202.152.120]) [121.202.152.120]:57376: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.195.225.182
description:
Feb  3 23:36:48 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.195.225.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.219.177.95
description:
2025-02-03 23:36:50 dovecot_plain authenticator failed for ([113.219.177.95]) [113.219.177.95]:40136: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.89.99
description:
Feb  3 23:37:01 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.89.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.153.166
description:
2025-02-03 23:37:04 dovecot_plain authenticator failed for ([187.93.153.166]) [187.93.153.166]:50670: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.134.142.166
description:
2025-02-03 23:37:06 dovecot_plain authenticator failed for ([124.43.78.147]) [112.134.142.166]:41272: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.3.134.232
description:
2025-02-03 23:37:07 dovecot_plain authenticator failed for ([151.3.134.232]) [151.3.134.232]:42397: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.196.214
description:
Feb  3 23:36:46 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.196.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.108.88.121
description:
Feb  3 23:36:49 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.108.88.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.117.32.22
description:
Feb  3 23:36:57 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.117.32.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Feb  3 23:37:01 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.22.116.38
description:
Feb  3 23:37:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.22.116.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.49.167.162
description:
2025-02-03 23:36:46 dovecot_plain authenticator failed for (l49-167-162.novotelecom.ru) [178.49.167.162]:53216: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.57
description:
2025-02-03 23:36:51 dovecot_plain authenticator failed for ([180.71.9.57]) [180.71.9.57]:52736: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.153.166
description:
Feb  3 23:37:02 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.153.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-02-03 23:37:03 dovecot_plain authenticator failed for ([14.88.228.202]) [14.88.228.202]:59288: 535 Incorrect authentication data (set_id=jessica1234)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.22.116.38
description:
2025-02-03 23:37:11 dovecot_plain authenticator failed for ([134.22.116.38]) [134.22.116.38]:40594: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.9
description:
Feb  3 23:36:44 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.28.51
description:
Feb  3 23:36:47 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.28.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.196.64.203
description:
Feb  3 23:37:07 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.196.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.231.242
description:
2025-02-03 23:37:11 dovecot_plain authenticator failed for ([124.115.231.242]) [124.115.231.242]:34732: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.170.102
description:
Feb  3 23:36:48 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.170.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
description:
2025-02-03 23:36:48 dovecot_plain authenticator failed for ([50.217.255.171]) [50.217.255.171]:54451: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.174.45
description:
Feb  3 23:36:55 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.174.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.244.126.105
description:
Feb  3 23:36:59 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.244.126.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.199.29.111
description:
Feb  3 23:37:14 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.199.29.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.28.26.250
description:
Feb  3 23:36:55 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.28.26.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.59.214.64
description:
2025-02-03 23:37:00 dovecot_plain authenticator failed for s142-59-214-64.ab.hsia.telus.net [142.59.214.64]:45022: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.194.206
description:
2025-02-03 23:37:00 dovecot_plain authenticator failed for ([65.20.194.206]) [65.20.194.206]:54986: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
description:
2025-02-03 23:37:00 dovecot_plain authenticator failed for ([213.230.65.53]) [213.230.65.53]:47614: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.15.101.6
description:
Feb  3 23:37:13 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.15.101.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.219.177.95
description:
Feb  3 23:36:48 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.219.177.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.28.51
description:
2025-02-03 23:36:49 dovecot_plain authenticator failed for ([222.128.28.51]) [222.128.28.51]:51788: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.152.249
description:
Feb  3 23:36:53 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.152.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.89.99
description:
2025-02-03 23:37:03 dovecot_plain authenticator failed for ([177.174.89.105]) [177.174.89.99]:37974: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.98.117
description:
2025-02-03 23:37:07 dovecot_plain authenticator failed for ([27.223.98.117]) [27.223.98.117]:50656: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.196.64.203
description:
2025-02-03 23:37:09 dovecot_plain authenticator failed for ([120.196.64.203]) [120.196.64.203]:34645: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.199.29.111
description:
2025-02-03 23:37:16 dovecot_plain authenticator failed for ([124.199.29.111]) [124.199.29.111]:34480: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.194.206
description:
Feb  3 23:36:58 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.194.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.129.25.70
description:
2025-02-03 23:36:59 dovecot_plain authenticator failed for ([39.129.25.70]) [39.129.25.70]:37960: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.211.203.185
description:
Feb  3 23:37:04 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.211.203.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.233
description:
Feb  3 23:37:04 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.6.69.226
description:
Feb  3 23:37:08 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.6.69.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.125.200
description:
Feb  3 23:37:11 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.117.144.194
description:
2025-02-03 23:36:50 dovecot_plain authenticator failed for ([211.117.144.194]) [211.117.144.194]:42132: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
description:
Feb  3 23:37:03 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.71.9.57
description:
Feb  3 23:36:49 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.71.9.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.151.51.223
description:
Feb  3 23:36:51 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.151.51.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.65.53
description:
Feb  3 23:36:58 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.65.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.38.239.52
description:
Feb  3 23:36:53 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.38.239.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
description:
2025-02-03 23:37:03 dovecot_plain authenticator failed for ([222.92.61.242]) [222.92.61.242]:33536: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.98.117
description:
Feb  3 23:37:05 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.98.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.0.200
description:
Feb  3 23:37:11 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.0.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.0.200
description:
2025-02-03 23:37:13 dovecot_plain authenticator failed for ([218.22.0.200]) [218.22.0.200]:53370: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.204.162.116
description:
2025-02-03 23:36:46 dovecot_plain authenticator failed for ([82.204.162.116]) [82.204.162.116]:54360: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.133.182
description:
2025-02-03 23:36:50 dovecot_plain authenticator failed for ([61.81.133.182]) [61.81.133.182]:46979: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.212.190.170
description:
2025-02-03 23:36:46 dovecot_plain authenticator failed for (176x212x190x170.dynamic.ryazan.ertelecom.ru) [176.212.190.170]:49382: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.26.59
description:
Feb  3 23:36:52 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.26.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.115.53.59
description:
Feb  3 23:37:01 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.115.53.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
description:
2025-02-03 23:37:01 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (hytoptaria) [92.244.126.105]:50319: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.217.255.171
description:
Feb  3 23:36:46 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.217.255.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.179.85.98
description:
2025-02-03 23:36:48 dovecot_plain authenticator failed for ([202.179.85.98]) [202.179.85.98]:54593: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.97.198
description:
2025-02-03 23:36:52 dovecot_plain authenticator failed for ([197.156.97.198]) [197.156.97.198]:48558: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.59.214.64
description:
Feb  3 23:36:58 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.59.214.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.205.48.62
description:
2025-02-03 23:37:01 dovecot_plain authenticator failed for 47-205-48-62.tamp.fl.frontiernet.net [47.205.48.62]:55180: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.138.196.194
description:
Feb  3 23:37:15 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.138.196.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.65.54.204
description:
2025-02-03 23:36:21 dovecot_plain authenticator failed for ([121.65.54.204]) [121.65.54.204]:47146: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.159.145.190
description:
Feb  3 23:36:46 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.159.145.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.179.85.98
description:
Feb  3 23:36:46 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.179.85.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.38.239.52
description:
2025-02-03 23:36:55 dovecot_plain authenticator failed for ([118.38.239.52]) [118.38.239.52]:40360: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.115.211
description:
Feb  3 23:37:03 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.115.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.233
description:
2025-02-03 23:37:06 dovecot_plain authenticator failed for (nsg-corporate-233.227.187.122.airtel.in) [122.187.227.233]:41309: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.240.26.106
description:
2025-02-03 23:37:06 dovecot_plain authenticator failed for ([58.240.26.106]) [58.240.26.106]:24449: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.15.251.33
description:
2025-02-03 23:37:08 dovecot_plain authenticator failed for ([59.15.251.33]) [59.15.251.33]:41404: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.16.161.35
description:
Feb  3 23:36:46 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.16.161.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.186.57
description:
2025-02-03 23:36:48 dovecot_plain authenticator failed for ([91.74.186.57]) [91.74.186.57]:58882: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.33.74.81
description:
2025-02-03 23:36:50 dovecot_plain authenticator failed for (hospitalperpetuosocorro.static.gvt.net.br) [191.33.74.81]:51789: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.34.142
description:
2025-02-03 23:36:51 dovecot_plain authenticator failed for ([119.206.34.142]) [119.206.34.142]:60530: 535 Incorrect authentication data (set_id=jessica1234@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
description:
2025-02-03 23:36:59 dovecot_plain authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:34844: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.227.194
description:
2025-02-03 23:37:03 dovecot_plain authenticator failed for ([196.200.227.194]) [196.200.227.194]:50088: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.65.54.204
description:
Feb  3 23:36:19 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.65.54.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.196.60.13
description:
Feb  3 23:36:46 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.196.60.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.117.144.194
description:
Feb  3 23:36:48 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.117.144.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.129.25.70
description:
Feb  3 23:36:57 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.129.25.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
description:
2025-02-03 23:37:04 dovecot_plain authenticator failed for ([194.31.8.12]) [194.31.8.12]:58496: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.15.101.6
description:
2025-02-03 23:37:15 dovecot_plain authenticator failed for ([190.15.101.6]) [190.15.101.6]:39537: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.14.24.50
description:
Feb  3 23:36:44 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.14.24.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
description:
2025-02-03 23:36:56 dovecot_plain authenticator failed for ([218.98.160.117]) [218.98.160.117]:24602: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.177.38
description:
2025-02-03 23:36:57 dovecot_plain authenticator failed for ([124.115.177.38]) [124.115.177.38]:36171: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.174.45
description:
2025-02-03 23:36:57 dovecot_plain authenticator failed for ([37.204.174.45]) [37.204.174.45]:54946: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.123.175.194
description:
2025-02-03 23:37:03 dovecot_plain authenticator failed for ([183.56.179.201]) [119.123.175.194]:31280: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-02-03 23:37:19 dovecot_plain authenticator failed for ([14.88.228.202]) [14.88.228.202]:43212: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.138.196.194
description:
2025-02-03 23:37:17 dovecot_plain authenticator failed for ([200.138.196.194]) [200.138.196.194]:49172: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.236.145.128
description:
Feb  3 23:37:19 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.236.145.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.196.144.45
description:
2025-02-03 23:37:20 dovecot_plain authenticator failed for ([183.196.144.45]) [183.196.144.45]:50306: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.97.166.63
description:
2025-02-03 23:37:26 dovecot_plain authenticator failed for 172-97-166-63.cpe.distributel.net [172.97.166.63]:56257: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.70.158.32
description:
2025-02-03 23:37:22 dovecot_plain authenticator failed for ([1.70.158.32]) [1.70.158.32]:36901: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.207.132.29
description:
2025-02-03 23:37:34 dovecot_plain authenticator failed for ([218.207.132.29]) [218.207.132.29]:60510: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.12.68.242
description:
2025-02-03 23:37:39 dovecot_login authenticator failed for ([210.12.68.242]) [210.12.68.242]:55563: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.77.213.29
description:
Feb  3 23:37:17 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.77.213.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.151
description:
2025-02-03 23:37:21 dovecot_plain authenticator failed for ([178.178.194.151]) [178.178.194.151]:51786: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.12.68.242
description:
Feb  3 23:37:37 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.12.68.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.151
description:
Feb  3 23:37:19 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
description:
2025-02-03 23:37:21 dovecot_plain authenticator failed for ([104.236.145.128]) [104.236.145.128]:48009: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.196.144.45
description:
Feb  3 23:37:18 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.196.144.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.70.158.32
description:
Feb  3 23:37:20 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.70.158.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.187.146.68
description:
Feb  3 23:37:22 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.187.146.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.253.220
description:
Feb  3 23:37:42 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.253.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.181.181
description:
Feb  3 23:37:48 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.37.181.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
description:
2025-02-03 23:37:50 dovecot_login authenticator failed for ([36.37.181.181]) [36.37.181.181]:34792: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.77.213.29
description:
2025-02-03 23:37:19 dovecot_plain authenticator failed for (host-29.213.77.5.ucom.am) [5.77.213.29]:33498: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.187.146.68
description:
2025-02-03 23:37:24 dovecot_plain authenticator failed for ([38.187.146.68]) [38.187.146.68]:45849: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.97.166.63
description:
Feb  3 23:37:24 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.97.166.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.207.132.29
description:
Feb  3 23:37:32 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.207.132.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.149
description:
Feb  3 23:38:03 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.149 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.230.230.3
description:
[2025-02-03 23:38:36 +0100] info [webmaild] 94.230.230.3 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.7
description:
Feb  3 23:38:41 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.7
description:
2025-02-03 23:38:43 dovecot_login authenticator failed for ([121.202.152.7]) [121.202.152.7]:43540: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.87.103.131
description:
Feb  3 23:38:50 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.87.103.131 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.12.24.13
description:
[2025-02-03 23:38:51 +0100] info [webmaild] 177.12.24.13 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.87.103.131
description:
2025-02-03 23:38:52 dovecot_login authenticator failed for ([77.87.103.131]) [77.87.103.131]:43879: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.149
description:
Feb  3 23:38:18 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.149 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 2.190.55.50
description:
[2025-02-03 23:39:08 +0100] info [webmaild] 2.190.55.50 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.154.90.17
description:
Feb  3 23:39:34 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.154.90.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.220.199.114
description:
[2025-02-03 23:39:43 +0100] info [webmaild] 181.220.199.114 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.4.255.205
description:
2025-02-03 23:39:44 dovecot_plain authenticator failed for ([59.4.255.205]) [59.4.255.205]:55613: 535 Incorrect authentication data (set_id=amadam)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Feb  3 23:39:47 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.196.230
description:
2025-02-03 23:40:11 dovecot_plain authenticator failed for ([118.122.196.230]) [118.122.196.230]:33047: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.245
description:
Feb  3 23:40:14 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.245
description:
2025-02-03 23:40:16 dovecot_plain authenticator failed for (m121-202-152-245.smartone.com) [121.202.152.245]:40793: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.4.255.205
description:
Feb  3 23:39:42 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.4.255.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.105.3.221
description:
Feb  3 23:39:43 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.105.3.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.223.154.170
description:
2025-02-03 23:39:49 dovecot_plain authenticator failed for ([102.223.154.170]) [102.223.154.170]:51664: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.153.13.161
description:
2025-02-03 23:40:05 dovecot_plain authenticator failed for ([219.153.13.161]) [219.153.13.161]:59746: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.109
description:
Feb  3 23:40:08 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.206.76
description:
Feb  3 23:40:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.206.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.124.36.67
description:
Feb  3 23:39:31 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.124.36.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.36.67
description:
2025-02-03 23:39:33 dovecot_plain authenticator failed for ([203.124.36.67]) [203.124.36.67]:37875: 535 Incorrect authentication data (set_id=amadam@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.71.98.202
description:
Feb  3 23:40:05 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.71.98.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.71.98.202
description:
2025-02-03 23:40:07 dovecot_plain authenticator failed for ([223.71.98.202]) [223.71.98.202]:49222: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.196.230
description:
Feb  3 23:40:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.196.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.223.154.170
description:
Feb  3 23:39:47 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.223.154.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.153.13.161
description:
Feb  3 23:40:03 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.153.13.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.109
description:
2025-02-03 23:40:10 dovecot_plain authenticator failed for 111-70-49-109.emome-ip.hinet.net [111.70.49.109]:33810: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.59.8.65
description:
2025-02-03 23:40:33 dovecot_plain authenticator failed for 116-59-8-65.emome-ip.hinet.net [116.59.8.65]:58663: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.243.79.22
description:
2025-02-03 23:40:29 dovecot_plain authenticator failed for 191-243-79-22.telecomconectividade.net.br [191.243.79.22]:34262: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.243.79.22
description:
Feb  3 23:40:27 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.243.79.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.241.61
description:
Feb  3 23:40:29 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.241.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.45.114.161
description:
Feb  3 23:40:47 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.45.114.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.206.76
description:
Feb  3 23:40:18 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.206.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.222
description:
2025-02-03 23:40:21 dovecot_plain authenticator failed for ([121.202.205.222]) [121.202.205.222]:55727: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.59.8.65
description:
Feb  3 23:40:31 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.59.8.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.210.232
description:
2025-02-03 23:40:23 dovecot_plain authenticator failed for ([87.103.210.232]) [87.103.210.232]:36829: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.194.128.158
description:
Feb  3 23:40:26 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.194.128.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
description:
2025-02-03 23:40:28 dovecot_plain authenticator failed for ([14.194.128.158]) [14.194.128.158]:50446: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.45.114.161
description:
2025-02-03 23:40:49 dovecot_plain authenticator failed for 121-45-114-161.tpgi.com.au [121.45.114.161]:48096: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.222
description:
Feb  3 23:40:19 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.210.232
description:
Feb  3 23:40:21 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.210.232 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.185.21.69
description:
[2025-02-03 23:40:53 +0100] info [webmaild] 138.185.21.69 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.233.155.25
description:
Feb  3 23:42:18 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.233.155.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.102.149.88
description:
Feb  3 23:42:27 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.102.149.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.66.153.194
description:
Feb  3 23:42:22 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.66.153.194 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 95.153.119.140
domain: tracker.aitedu.net
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:6.65||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.66.153.194
description:
2025-02-03 23:42:24 dovecot_login authenticator failed for ([95.66.153.194]) [95.66.153.194]:53049: 535 Incorrect authentication data (set_id=wilfri17@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.101.128.156
description:
Feb  3 23:42:25 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.101.128.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.115.19.225
description:
2025-02-03 23:42:39 dovecot_plain authenticator failed for 24.115.19.225.res-cmts.sm3.ptd.net [24.115.19.225]:38710: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.233.155.25
description:
2025-02-03 23:42:20 dovecot_login authenticator failed for 172-233-155-25.ip.linodeusercontent.com (toGHPl) [172.233.155.25]:41188: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.101.128.156
description:
2025-02-03 23:42:27 dovecot_plain authenticator failed for c-73-101-128-156.hsd1.pa.comcast.net [73.101.128.156]:25405: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.128.162.146
description:
2025-02-03 23:42:30 dovecot_plain authenticator failed for ([27.128.162.146]) [27.128.162.146]:43964: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.174.248
description:
2025-02-03 23:42:32 dovecot_login authenticator failed for broadband-77-37-174-248.ip.moscow.rt.ru [77.37.174.248]:50224: 535 Incorrect authentication data (set_id=wilfri17)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.115.19.225
description:
Feb  3 23:42:37 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.115.19.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.128.162.146
description:
Feb  3 23:42:28 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.128.162.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.174.248
description:
Feb  3 23:42:30 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.174.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.149.88
description:
2025-02-03 23:42:29 dovecot_plain authenticator failed for ([82.102.149.88]) [82.102.149.88]:50725: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.249.131
description:
2025-02-03 23:44:00 dovecot_plain authenticator failed for ([60.31.249.131]) [60.31.249.131]:41128: 535 Incorrect authentication data (set_id=7606e1dcc1da@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  3 23:44:15 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.199.147
description:
Feb  3 23:43:34 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.199.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 80.64.26.58
description:
[2025-02-03 23:43:57 +0100] info [webmaild] 80.64.26.58 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.141.102
description:
[2025-02-03 23:43:28 +0100] info [webmaild] 157.100.141.102 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140740
name: IM360 WAF: Twenty shell abuse attempt
abuser: 45.227.254.60
domain: elibrary.aitsmartschool.com
description:
IM360 WAF: Twenty shell abuse attempt||MVN:REQUEST_HEADERS:referer||WPU:||RSV:6.65||T:APACHE||MV:www.google.com||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.224.171.64
description:
[2025-02-03 23:44:24 +0100] info [webmaild] 181.224.171.64 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.122.139.172
description:
2025-02-03 23:44:47 dovecot_login authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:38813: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.32.3.151
description:
[2025-02-03 23:44:59 +0100] info [webmaild] 191.32.3.151 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.44
description:
2025-02-03 23:45:14 dovecot_login authenticator failed for ([207.219.222.44]) [207.219.222.44]:53670: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.80.117
description:
2025-02-03 23:44:24 dovecot_plain authenticator failed for ([178.70.80.117]) [178.70.80.117]:56073: 535 Incorrect authentication data (set_id=7606e1dcc1da)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-44.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.157.169.242
description:
2025-02-03 23:44:47 dovecot_login authenticator failed for (abts-north-dynamic-161.133.176.122.airtelbroadband.in) [103.157.169.242]:51303: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.182.161.206
description:
2025-02-03 23:45:03 dovecot_login authenticator failed for ([103.182.161.206]) [103.182.161.206]:37540: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
description:
2025-02-03 23:45:50 dovecot_login authenticator failed for (18712549.telemar.net.br) [187.76.174.254]:53877: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.22.68.213
description:
2025-02-03 23:46:05 dovecot_plain authenticator failed for ([59.22.68.213]) [59.22.68.213]:47819: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.115.37
description:
2025-02-03 23:45:33 dovecot_login authenticator failed for ([197.156.115.37]) [197.156.115.37]:32784: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
description:
2025-02-03 23:45:42 dovecot_plain authenticator failed for ([218.98.26.226]) [58.216.101.162]:55990: 535 Incorrect authentication data (set_id=eng21a00034y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.172.113.166
description:
2025-02-03 23:45:59 dovecot_login authenticator failed for ([95.172.113.166]) [95.172.113.166]:57718: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 63.143.124.118
description:
[2025-02-03 23:45:59 +0100] info [webmaild] 63.143.124.118 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.81.78.32
description:
2025-02-03 23:45:22 dovecot_login authenticator failed for ([185.81.78.32]) [185.81.78.32]:33795: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.100.230
description:
2025-02-03 23:45:39 dovecot_plain authenticator failed for ([180.168.100.230]) [180.168.100.230]:48304: 535 Incorrect authentication data (set_id=admin@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.67.123.202
description:
2025-02-03 23:45:50 dovecot_login authenticator failed for ([218.67.123.202]) [218.67.123.202]:53987: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.28.128.173
description:
2025-02-03 23:45:53 dovecot_plain authenticator failed for ([112.28.128.173]) [112.28.128.173]:47145: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.86.7.65
description:
2025-02-03 23:45:53 dovecot_plain authenticator failed for ([218.86.7.65]) [218.86.7.65]:47034: 535 Incorrect authentication data (set_id=eng21a00034y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.92.230.86
description:
2025-02-03 23:46:50 dovecot_login authenticator failed for ([218.92.230.86]) [218.92.230.86]:58508: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.112.71.128
description:
2025-02-03 23:47:01 dovecot_login authenticator failed for syn-070-112-071-128.res.spectrum.com [70.112.71.128]:49300: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.0.12.13
description:
[2025-02-03 23:46:31 +0100] info [webmaild] 179.0.12.13 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 165.51.96.21
description:
[2025-02-03 23:47:01 +0100] info [webmaild] 165.51.96.21 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 213.136.78.38
domain: ait.edu.gh
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:23-47.213.136.78.38||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.147
description:
2025-02-03 23:48:02 dovecot_login authenticator failed for ([218.149.228.147]) [218.149.228.147]:39820: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.43.35
description:
2025-02-03 23:47:29 dovecot_login authenticator failed for ([154.127.43.35]) [154.127.43.35]:35430: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.172.232.47
description:
[2025-02-03 23:47:37 +0100] info [webmaild] 105.172.232.47 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 213.136.78.38
domain: ait.edu.gh
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/pwnd.php||WPU:||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.44.221
description:
2025-02-03 23:47:18 dovecot_login authenticator failed for broadband-37-110-44-221.ip.moscow.rt.ru [37.110.44.221]:40876: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 213.136.78.38
domain: ait.edu.gh
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/ait02/public_html/wp-content/uploads/index.php


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.194.206
description:
2025-02-03 23:47:51 dovecot_login authenticator failed for ([65.20.194.206]) [65.20.194.206]:52624: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.153.73
description:
2025-02-03 23:49:12 dovecot_plain authenticator failed for (73.153.212.218.starhub.net.sg) [218.212.153.73]:40838: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.186.94.163
description:
[2025-02-03 23:48:36 +0100] info [webmaild] 45.186.94.163 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.253.174.182
description:
[2025-02-03 23:49:06 +0100] info [webmaild] 212.253.174.182 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  3 23:49:11 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
description:
2025-02-03 23:49:12 dovecot_plain authenticator failed for ([125.139.124.120]) [125.139.124.120]:48846: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.216.5.134
description:
2025-02-03 23:48:42 dovecot_login authenticator failed for ([114.216.5.134]) [114.216.5.134]:42246: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.12
description:
2025-02-03 23:48:50 dovecot_plain authenticator failed for (nsg-corporate-12.229.187.122.airtel.in) [122.187.229.12]:60800: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.78.68
description:
2025-02-03 23:49:06 dovecot_plain authenticator failed for 60-249-78-68.hinet-ip.hinet.net [60.249.78.68]:52610: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.47.211
description:
2025-02-03 23:48:50 dovecot_login authenticator failed for ([188.226.47.211]) [188.226.47.211]:60476: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.47.66
description:
2025-02-03 23:50:13 dovecot_plain authenticator failed for ([197.211.47.66]) [197.211.47.66]:47535: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  3 23:49:28 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.243.95
description:
2025-02-03 23:49:47 dovecot_plain authenticator failed for ([122.187.243.95]) [122.187.243.95]:34476: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.144.187.114
description:
2025-02-03 23:49:48 dovecot_plain authenticator failed for ([89.144.187.114]) [89.144.187.114]:50834: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
description:
2025-02-03 23:49:48 dovecot_plain authenticator failed for ([201.183.225.156]) [201.183.225.156]:49796: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
description:
2025-02-03 23:49:50 dovecot_plain authenticator failed for 89-253-90-113.customers.ownit.se [89.253.90.113]:46509: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.171
description:
2025-02-03 23:49:55 dovecot_plain authenticator failed for ([220.77.182.171]) [220.77.182.171]:35731: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.206.103
description:
2025-02-03 23:50:09 dovecot_plain authenticator failed for ([211.252.206.103]) [211.252.206.103]:58355: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.220.250.167
description:
2025-02-03 23:50:03 dovecot_plain authenticator failed for ([120.220.250.167]) [120.220.250.167]:46184: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.248.104.34
description:
Feb  3 23:49:33 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.248.104.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.174.248
description:
2025-02-03 23:49:47 dovecot_plain authenticator failed for broadband-77-37-174-248.ip.moscow.rt.ru [77.37.174.248]:59704: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.161.68.130
description:
[2025-02-03 23:49:49 +0100] info [webmaild] 131.161.68.130 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.102.11
description:
2025-02-03 23:49:49 dovecot_plain authenticator failed for ([183.6.102.11]) [183.6.102.11]:29656: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.87.43.4
description:
2025-02-03 23:49:50 dovecot_plain authenticator failed for ([222.87.43.4]) [222.87.43.4]:46105: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.19
description:
2025-02-03 23:49:50 dovecot_plain authenticator failed for ([121.202.153.19]) [121.202.153.19]:35072: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
description:
2025-02-03 23:50:13 dovecot_plain authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:55583: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.17.165
description:
2025-02-03 23:49:32 dovecot_plain authenticator failed for (abts-north-static-165.17.160.122.airtelbroadband.in) [122.160.17.165]:47068: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.40.199.139
description:
2025-02-03 23:49:48 dovecot_plain authenticator failed for host139.sub-63-40-199.myvzw.com [63.40.199.139]:42591: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.119.253
description:
2025-02-03 23:50:04 dovecot_plain authenticator failed for ([167.250.119.253]) [167.250.119.253]:60864: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.84.241.94
description:
2025-02-03 23:50:05 dovecot_plain authenticator failed for ([119.84.241.94]) [119.84.241.94]:42696: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.56.11.148
description:
2025-02-03 23:50:05 dovecot_plain authenticator failed for 93-56-11-148.ip287.fastwebnet.it [93.56.11.148]:56177: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 130.195.242.23
description:
[2025-02-03 23:50:07 +0100] info [cpaneld] 130.195.242.23 - ait002 "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.106.198.35
description:
2025-02-03 23:49:25 dovecot_plain authenticator failed for ([222.106.198.35]) [222.106.198.35]:35636: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.222.190.69
description:
2025-02-03 23:49:48 dovecot_plain authenticator failed for (client.fttb.2day.kz) [176.222.190.69]:47356: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.169.151
description:
2025-02-03 23:49:48 dovecot_plain authenticator failed for ([65.20.169.151]) [65.20.169.151]:39796: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.234.165.73
description:
2025-02-03 23:49:54 dovecot_plain authenticator failed for ([58.234.165.73]) [58.234.165.73]:55434: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.242.78
description:
2025-02-03 23:50:12 dovecot_plain authenticator failed for ([120.224.242.78]) [120.224.242.78]:60268: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.25.233.22
description:
2025-02-03 23:50:03 dovecot_plain authenticator failed for ([218.25.233.22]) [218.25.233.22]:55212: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.252.206.103
description:
Feb  3 23:50:07 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.252.206.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.86.7.65
description:
2025-02-03 23:50:09 dovecot_plain authenticator failed for ([218.86.7.65]) [218.86.7.65]:54340: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.156.81.182
description:
Feb  3 23:49:36 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.156.81.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.84.18
description:
2025-02-03 23:49:49 dovecot_plain authenticator failed for ([41.216.84.18]) [41.216.84.18]:56573: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.246.45.57
description:
2025-02-03 23:50:02 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:60418: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.88.96.37
description:
2025-02-03 23:50:10 dovecot_plain authenticator failed for ([58.131.97.5]) [180.88.96.37]:15691: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.174.248
description:
Feb  3 23:49:45 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.174.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.87.43.4
description:
Feb  3 23:49:48 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.87.43.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
description:
2025-02-03 23:49:48 dovecot_plain authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:32362: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.118
description:
2025-02-03 23:49:49 dovecot_plain authenticator failed for (m121-202-155-118.smartone.com) [121.202.155.118]:40743: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.242.86.203
description:
2025-02-03 23:49:50 dovecot_plain authenticator failed for ([58.242.86.203]) [58.242.86.203]:39089: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.178.103.119
description:
2025-02-03 23:50:02 dovecot_plain authenticator failed for syn-076-178-103-119.res.spectrum.com [76.178.103.119]:51180: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.24.210.27
description:
2025-02-03 23:50:05 dovecot_plain authenticator failed for ([1.24.210.27]) [1.24.210.27]:45116: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
description:
2025-02-03 23:50:03 dovecot_plain authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:45007: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.198.129.54
description:
2025-02-03 23:50:15 dovecot_plain authenticator failed for ip54-129-198-217.pool-bba.aruba.it [217.198.129.54]:55402: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
description:
2025-02-03 23:50:32 dovecot_plain authenticator failed for ([14.98.28.43]) [14.98.28.43]:59824: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.71.37.65
description:
[2025-02-03 23:50:22 +0100] info [webmaild] 45.71.37.65 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.168.243
description:
2025-02-03 23:50:22 dovecot_plain authenticator failed for ([120.236.168.243]) [120.236.168.243]:41355: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
description:
2025-02-03 23:50:24 dovecot_plain authenticator failed for ([196.191.212.235]) [213.55.85.202]:23207: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
description:
2025-02-03 23:50:30 dovecot_login authenticator failed for (imparhoteis.static.gvt.net.br) [179.184.218.49]:58182: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.220.235
description:
2025-02-03 23:50:18 dovecot_login authenticator failed for ([118.122.220.235]) [118.122.220.235]:57010: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.225.239.115
description:
2025-02-03 23:50:21 dovecot_plain authenticator failed for ([58.225.239.115]) [58.225.239.115]:59584: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.56.11.148
description:
2025-02-03 23:50:27 dovecot_plain authenticator failed for 93-56-11-148.ip287.fastwebnet.it [93.56.11.148]:56832: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.250
description:
2025-02-03 23:51:02 dovecot_plain authenticator failed for ([103.69.9.250]) [103.69.9.250]:58551: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  3 23:50:42 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
description:
2025-02-03 23:50:18 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.154.175]:60746: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-02-03 23:50:38 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt (eucented) [89.153.62.100]:42090: 535 Incorrect authentication data (set_id=eng20a00070y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
description:
2025-02-03 23:50:52 dovecot_plain authenticator failed for ([58.216.101.162]) [58.216.101.162]:50658: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.10.164
description:
[2025-02-03 23:51:14 +0100] info [webmaild] 169.224.10.164 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  3 23:51:27 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
description:
2025-02-03 23:51:41 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:37460: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.70.20.85
description:
[2025-02-03 23:51:44 +0100] info [webmaild] 189.70.20.85 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.36.24.33
description:
2025-02-03 23:51:51 dovecot_login authenticator failed for ([138.36.24.33]) [138.36.24.33]:40678: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
description:
Feb  3 23:52:01 ait sshd[3789334]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  3 23:52:05 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.251.95
description:
2025-02-03 23:52:13 dovecot_login authenticator failed for ([191.59.251.95]) [191.59.251.95]:47702: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Feb  3 23:52:01 ait sshd[3789334]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.222.171.6
description:
2025-02-03 23:52:43 dovecot_plain authenticator failed for 6.ip-92-222-171.eu [92.222.171.6]:39028: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.83.89
description:
2025-02-03 23:52:52 dovecot_plain authenticator failed for ([119.207.83.89]) [119.207.83.89]:40332: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.97
description:
2025-02-03 23:52:54 dovecot_plain authenticator failed for ([179.185.1.97]) [179.185.1.97]:45228: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.103.142
description:
2025-02-03 23:53:04 dovecot_login authenticator failed for ([58.18.103.142]) [58.18.103.142]:34441: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.74.47
description:
2025-02-03 23:53:08 dovecot_plain authenticator failed for 46-162-74-47.cust.bredband2.com (nacka) [46.162.74.47]:56975: 535 Incorrect authentication data (set_id=ads23b00195y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 69.160.124.214
description:
[2025-02-03 23:52:26 +0100] info [webmaild] 69.160.124.214 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.73.9.250
description:
[2025-02-03 23:53:01 +0100] info [webmaild] 177.73.9.250 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.7.203.177
description:
2025-02-03 23:53:03 dovecot_plain authenticator failed for ([59.7.203.177]) [59.7.203.177]:59912: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.14.180.33
description:
2025-02-03 23:53:04 dovecot_plain authenticator failed for ([218.14.180.33]) [218.14.180.33]:53767: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
description:
2025-02-03 23:52:31 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:47364: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.127.16.197
description:
2025-02-03 23:52:31 dovecot_plain authenticator failed for ip-188-127-16-197.ennet.pl (nozoodene) [188.127.16.197]:53506: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
description:
2025-02-03 23:52:40 dovecot_login authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:58461: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
description:
2025-02-03 23:53:15 dovecot_plain authenticator failed for ([1.30.20.98]) [1.30.20.98]:43152: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.128.209.48
description:
Feb  3 23:52:29 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.128.209.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.167.140.130
description:
2025-02-03 23:54:01 dovecot_plain authenticator failed for (109-167-140-130.westcall.net) [109.167.140.130]:50671: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Feb  3 23:54:15 ait sshd[3790220]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
description:
2025-02-03 23:53:20 dovecot_plain authenticator failed for ([106.51.120.94]) [106.51.220.33]:27626: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.200.216.66
description:
2025-02-03 23:53:56 dovecot_plain authenticator failed for ([113.200.216.66]) [113.200.216.66]:41670: 535 Incorrect authentication data (set_id=ads22a00092y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  3 23:54:11 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Feb  3 23:54:15 ait sshd[3790220]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.134.19.99
description:
2025-02-03 23:53:31 dovecot_plain authenticator failed for (78-134-19-99.static.eolo.it) [78.134.19.99]:58721: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.110.129.14
description:
[2025-02-03 23:53:39 +0100] info [webmaild] 84.110.129.14 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.125.174.202
description:
2025-02-03 23:54:11 dovecot_plain authenticator failed for ([27.125.174.202]) [27.125.174.202]:51015: 535 Incorrect authentication data (set_id=ads22a00092y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.112.45.222
description:
2025-02-03 23:53:31 dovecot_plain authenticator failed for ([124.112.45.222]) [124.112.45.222]:49664: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.229.15.2
description:
[2025-02-03 23:54:10 +0100] info [webmaild] 45.229.15.2 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.125
domain: www.lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:BSCJ20BOSHRM0016Y||WPU:BSCJ20BOSHRM0016Y||RSV:6.65||T:APACHE||MV:23-54.170.205.31.125


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  3 23:54:50 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
description:
2025-02-03 23:54:55 dovecot_login authenticator failed for ([88.87.84.104]) [88.87.84.104]:47461: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.221.130.246
description:
2025-02-03 23:55:05 dovecot_login authenticator failed for ([211.221.130.246]) [211.221.130.246]:57160: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.81.229.145
description:
[2025-02-03 23:55:13 +0100] info [webmaild] 170.81.229.145 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.66.228.194
description:
2025-02-03 23:54:40 dovecot_login authenticator failed for bb115-66-228-194.singnet.com.sg [115.66.228.194]:57041: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.20.134.78
description:
2025-02-03 23:55:42 dovecot_plain authenticator failed for ([115.20.134.78]) [115.20.134.78]:34470: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.97
description:
2025-02-03 23:55:43 dovecot_login authenticator failed for ([179.185.1.97]) [179.185.1.97]:50793: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.100.230
description:
2025-02-03 23:55:53 dovecot_login authenticator failed for ([180.168.100.230]) [180.168.100.230]:52175: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.172.156.150
description:
2025-02-03 23:56:00 dovecot_plain authenticator failed for ([110.172.156.150]) [110.172.156.150]:35947: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.185.162.91
description:
2025-02-03 23:55:17 dovecot_login authenticator failed for ([190.185.162.91]) [190.185.162.91]:48001: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.221.129.227
description:
[2025-02-03 23:55:42 +0100] info [webmaild] 177.221.129.227 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.228.203.168
description:
Feb  3 23:57:03 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.228.203.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.228.203.168
description:
2025-02-03 23:57:05 dovecot_login authenticator failed for (ait.edu.gh) [37.228.203.168]:33733: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.19.81.77
description:
[2025-02-03 23:57:07 +0100] info [webmaild] 187.19.81.77 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.157.105.37
description:
[2025-02-03 23:56:39 +0100] info [webmaild] 177.157.105.37 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  3 23:56:59 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.31.219
description:
2025-02-03 23:57:57 dovecot_login authenticator failed for ([103.115.31.219]) [103.115.31.219]:43832: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.181.33.214
description:
[2025-02-03 23:58:06 +0100] info [webmaild] 45.181.33.214 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.70.94.155
description:
2025-02-03 23:57:47 dovecot_login authenticator failed for ([117.70.94.155]) [117.70.94.155]:47580: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-02-03 23:58:50 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (erres) [91.56.31.167]:64574: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.148.127.142
description:
Feb  3 23:59:03 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.148.127.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.148.127.142
description:
2025-02-03 23:59:05 dovecot_login authenticator failed for ip142.ip-135-148-127.us (baveb5l33s) [135.148.127.142]:57805: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.200.214.209
description:
[2025-02-03 23:58:40 +0100] info [webmaild] 177.200.214.209 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-58.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  3 23:58:50 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.222.217.50
description:
[2025-02-03 23:59:37 +0100] info [webmaild] 191.222.217.50 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.238.200
description:
2025-02-03 23:59:40 dovecot_plain authenticator failed for ([5.11.238.200]) [5.11.238.200]:44570: 535 Incorrect authentication data (set_id=abs20a00063y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.148.127.142
description:
Feb  3 23:59:22 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.148.127.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.148.127.142
description:
2025-02-03 23:59:24 dovecot_login authenticator failed for ip142.ip-135-148-127.us (kVzDKriMms) [135.148.127.142]:53775: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
description:
2025-02-03 23:59:26 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it (unwery) [188.219.104.210]:60941: 535 Incorrect authentication data (set_id=ads76a66686y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.124.66
description:
2025-02-03 23:59:50 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:49865: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.83.242.189
description:
[2025-02-03 23:59:22 +0100] info [webmaild] 170.83.242.189 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
description:
2025-02-03 23:59:28 dovecot_plain authenticator failed for ([1.227.228.136]) [1.227.228.136]:47831: 535 Incorrect authentication data (set_id=abs20a00063y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  3 23:59:28 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.252.62.193
description:
2025-02-04 00:00:13 dovecot_plain authenticator failed for ([117.252.62.193]) [117.252.62.193]:56847: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.35
description:
Feb  4 00:01:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.218
description:
2025-02-04 00:01:36 dovecot_plain authenticator failed for (201-234-106-218.static.impsat.net.ar) [201.234.106.218]:49915: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.142.157
description:
Feb  4 00:02:11 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.142.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.70.28
description:
Feb  4 00:01:15 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.70.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.159.140
description:
2025-02-04 00:00:21 dovecot_login authenticator failed for (abts-north-dynamic-140.159.176.122.airtelbroadband.in) [122.176.159.140]:50290: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.159
description:
2025-02-04 00:00:30 dovecot_login authenticator failed for ([195.133.156.159]) [195.133.156.159]:51404: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.7.123.41
description:
[2025-02-04 00:00:38 +0100] info [webmaild] 200.7.123.41 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.17.165
description:
Feb  4 00:01:31 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.17.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.196.214
description:
Feb  4 00:02:01 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.196.214 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.24.100.184
description:
[2025-02-04 00:02:12 +0100] info [webmaild] 41.24.100.184 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 00:00:23 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.144.38
description:
Feb  4 00:01:04 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.144.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
description:
2025-02-04 00:01:11 dovecot_plain authenticator failed for ([114.242.61.35]) [114.242.61.35]:53466: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
description:
2025-02-04 00:02:13 dovecot_plain authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:42254: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
description:
2025-02-04 00:00:52 dovecot_plain authenticator failed for ([168.167.55.230]) [168.167.55.230]:40752: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.179.144.38
description:
2025-02-04 00:01:06 dovecot_plain authenticator failed for ([45.179.144.38]) [45.179.144.38]:59902: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.234.106.218
description:
Feb  4 00:01:34 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.234.106.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.17.165
description:
2025-02-04 00:01:33 dovecot_plain authenticator failed for (abts-north-static-165.17.160.122.airtelbroadband.in) [122.160.17.165]:50462: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 110.137.36.98
description:
[2025-02-04 00:02:07 +0100] info [cpaneld] 110.137.36.98 - lemassne "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.113.183.120
description:
[2025-02-04 00:01:13 +0100] info [webmaild] 189.113.183.120 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-02-04 00:01:23 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:41577: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Feb  4 00:01:21 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
description:
2025-02-04 00:00:15 dovecot_plain authenticator failed for ([222.120.176.6]) [222.120.176.6]:54928: 535 Incorrect authentication data (set_id=eng19b00204y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.133.156.159
description:
Feb  4 00:00:28 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.133.156.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.167.55.230
description:
Feb  4 00:00:50 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.167.55.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.70.28
description:
2025-02-04 00:01:17 dovecot_plain authenticator failed for ([110.34.70.28]) [110.34.70.28]:48891: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.200.5.5
description:
[2025-02-04 00:01:42 +0100] info [webmaild] 177.200.5.5 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
description:
2025-02-04 00:02:03 dovecot_plain authenticator failed for syn-208-105-196-214.biz.spectrum.com (rrcs-208-105-196-214.nys.biz.rr.com) [208.105.196.214]:42007: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.138.223.214
description:
Feb  4 00:00:33 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.138.223.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.138.223.214
description:
2025-02-04 00:00:35 dovecot_plain authenticator failed for static091138223214.access.hol.gr [91.138.223.214]:37240: 535 Incorrect authentication data (set_id=eng19b00204y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.205.83
description:
2025-02-04 00:00:55 dovecot_plain authenticator failed for ([112.164.205.83]) [112.164.205.83]:44493: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 95.111.246.153
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:daniel_admin||WPU:daniel_admin||RSV:6.65||T:APACHE||MV:00-03.95.111.246.153


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 141.101.249.119
description:
[2025-02-04 00:03:14 +0100] info [webmaild] 141.101.249.119 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.71.161.144
description:
Feb  4 00:02:52 ait sshd[3793645]: pam_imunify(sshd:auth): [IM360_RBL] The IP 167.71.161.144 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.71.161.144
description:
Feb  4 00:02:52 ait sshd[3793645]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.161.144  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.222.90.178
description:
Feb  4 00:04:06 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.222.90.178 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.45.22
description:
47.128.45.22 - - [04/Feb/2025:00:03:21 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=29038640 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/7/?filter_course-category=30&filtering=1&instructor=2&level=intermediate%2Cbeginner" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.45.22


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.65.238.250
description:
Feb  4 00:03:45 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.65.238.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
description:
2025-02-04 00:03:47 dovecot_plain authenticator failed for (brelizerm) [185.65.238.250]:51743: 535 Incorrect authentication data (set_id=eng20a00113y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.227.203
description:
Feb  4 00:03:52 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.227.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Feb  4 00:03:54 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.19.26.129
description:
[2025-02-04 00:03:53 +0100] info [webmaild] 187.19.26.129 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.227.203
description:
2025-02-04 00:03:54 dovecot_plain authenticator failed for ([118.70.227.203]) [118.70.227.203]:60866: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
description:
2025-02-04 00:03:56 dovecot_plain authenticator failed for (matria) [102.53.15.54]:51639: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.222.90.178
description:
2025-02-04 00:04:08 dovecot_plain authenticator failed for ([200.222.80.81]) [200.222.90.178]:50846: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.221.176.84
description:
[2025-02-04 00:04:11 +0100] info [webmaild] 201.221.176.84 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.84.249.251
description:
[2025-02-04 00:04:44 +0100] info [webmaild] 187.84.249.251 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.246.141
description:
Feb  4 00:04:49 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.246.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.246.141
description:
2025-02-04 00:04:51 dovecot_plain authenticator failed for ([94.204.246.141]) [94.204.246.141]:37057: 535 Incorrect authentication data (set_id=ads89b99891y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.174.233.64
description:
Feb  4 00:04:41 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.174.233.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.174.233.64
description:
2025-02-04 00:04:43 dovecot_plain authenticator failed for h-158-174-233-64.a192.priv.bahnhof.se [158.174.233.64]:33967: 535 Incorrect authentication data (set_id=ads89b99891y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.19.130
description:
47.128.19.130 - - [04/Feb/2025:00:05:42 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15507403 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/a4e472?panel=logger" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.19.130


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.28.151.110
description:
[2025-02-04 00:06:06 +0100] info [webmaild] 186.28.151.110 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.80.166
description:
Feb  4 00:06:08 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.80.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.80.166
description:
2025-02-04 00:06:10 dovecot_login authenticator failed for (166.80.156.175.unknown.m1.com.sg) [175.156.80.166]:39534: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.145.113.31
description:
[2025-02-04 00:06:42 +0100] info [webmaild] 103.145.113.31 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.172.225.52
description:
2025-02-04 00:06:39 dovecot_plain authenticator failed for ([178.172.225.52]) [178.172.225.52]:56278: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.244.126.105
description:
Feb  4 00:06:36 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.244.126.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.72.153.14
description:
Feb  4 00:06:37 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.72.153.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.172.225.52
description:
Feb  4 00:06:37 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.172.225.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
description:
2025-02-04 00:06:38 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (ablatively) [92.244.126.105]:38708: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.72.153.14
description:
2025-02-04 00:06:39 dovecot_plain authenticator failed for (epers) [160.72.153.14]:36167: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
description:
Feb  4 00:06:22 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.74.47
description:
2025-02-04 00:06:42 dovecot_plain authenticator failed for 46-162-74-47.cust.bredband2.com (wordia) [46.162.74.47]:64412: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.161.104.111
description:
[2025-02-04 00:06:45 +0100] info [webmaild] 187.161.104.111 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
description:
2025-02-04 00:06:24 dovecot_plain authenticator failed for ([185.255.212.178]) [185.255.212.178]:65529: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.184.119.106
description:
2025-02-04 00:06:22 dovecot_login authenticator failed for ([117.184.119.106]) [117.184.119.106]:56974: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.74.47
description:
Feb  4 00:06:40 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.74.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.184.119.106
description:
Feb  4 00:06:20 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.184.119.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.7.34.168
description:
[2025-02-04 00:07:20 +0100] info [webmaild] 189.7.34.168 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.161.16.240
description:
Feb  4 00:07:24 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.161.16.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.88.26.145
description:
2025-02-04 00:07:32 dovecot_login authenticator failed for (ADMIN) [149.88.26.145]:53992: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
description:
2025-02-04 00:07:38 dovecot_plain authenticator failed for ([45.170.50.2]) [45.170.50.2]:54402: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.62.34.216
description:
Feb  4 00:07:58 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.62.34.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.161.16.240
description:
2025-02-04 00:07:26 dovecot_plain authenticator failed for ([221.161.16.240]) [221.161.16.240]:49097: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.170.50.2
description:
Feb  4 00:07:36 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.170.50.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.252.8.34
description:
Feb  4 00:07:39 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.252.8.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.252.8.34
description:
2025-02-04 00:07:41 dovecot_plain authenticator failed for ([43.252.8.34]) [43.252.8.34]:49792: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
description:
2025-02-04 00:08:00 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:34776: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.196.30.122
description:
2025-02-04 00:09:01 dovecot_plain authenticator failed for ([103.196.30.122]) [103.196.30.122]:54476: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.34.165.114
description:
Feb  4 00:08:29 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.34.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.233.21.109
description:
Feb  4 00:08:32 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.233.21.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
description:
2025-02-04 00:08:34 dovecot_plain authenticator failed for ([109.233.21.109]) [109.233.21.109]:39336: 535 Incorrect authentication data (set_id=7606e1dcc1da)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
description:
2025-02-04 00:08:43 dovecot_plain authenticator failed for (223-197-153-138.static.imsbiz.com) [223.197.153.138]:58130: 535 Incorrect authentication data (set_id=abs20a00063y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.196.30.122
description:
Feb  4 00:08:59 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.196.30.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.190.111.104
description:
2025-02-04 00:08:22 dovecot_plain authenticator failed for 107-190-111-104.cpe.teksavvy.com [107.190.111.104]:50794: 535 Incorrect authentication data (set_id=7606e1dcc1da@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.153.138
description:
Feb  4 00:08:41 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.153.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.255.230.66
description:
[2025-02-04 00:08:48 +0100] info [webmaild] 131.255.230.66 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.222.90.178
description:
Feb  4 00:09:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.222.90.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.222.90.178
description:
2025-02-04 00:09:11 dovecot_plain authenticator failed for ([200.222.90.178]) [200.222.90.178]:56087: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.165.114
description:
2025-02-04 00:08:31 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:34444: 535 Incorrect authentication data (set_id=abs20a00063y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.190.111.104
description:
Feb  4 00:08:20 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.190.111.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.244.39
description:
Feb  4 00:10:11 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 221.156.137.103
description:
Feb  4 00:10:14 ait sshd[3796505]: Invalid user universitypublishing from 221.156.137.103 port 55810


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.103
description:
Feb  4 00:10:14 ait sshd[3796505]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.103


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.223.128.160
description:
[2025-02-04 00:10:06 +0100] info [webmaild] 191.223.128.160 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.103
description:
Feb  4 00:10:14 ait sshd[3796505]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.103 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.104.166.139
description:
[2025-02-04 00:09:24 +0100] info [webmaild] 105.104.166.139 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.111.180.6
description:
[2025-02-04 00:09:32 +0100] info [webmaild] 190.111.180.6 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.170
description:
2025-02-04 00:10:01 dovecot_plain authenticator failed for static-200-105-141-170.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.170]:34700: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.105.141.170
description:
Feb  4 00:09:59 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.105.141.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.72.244.39
description:
2025-02-04 00:10:13 dovecot_plain authenticator failed for 39.244.72.148.host.secureserver.net [148.72.244.39]:51432: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.166.2
description:
2025-02-04 00:10:46 dovecot_plain authenticator failed for ([183.237.166.2]) [183.237.166.2]:48183: 535 Incorrect authentication data (set_id=ads32a00023y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 221.156.137.103
description:
Feb  4 00:10:17 ait sshd[3796505]: Failed password for invalid user universitypublishing from 221.156.137.103 port 55810 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
description:
2025-02-04 00:10:26 dovecot_plain authenticator failed for (70-90-99-29-ma-ne.hfc.comcastbusiness.net) [70.90.99.29]:51297: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Feb  4 00:10:45 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.73.103.221
description:
2025-02-04 00:10:32 dovecot_plain authenticator failed for ([216.73.103.221]) [216.73.103.221]:42087: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-02-04 00:10:47 dovecot_plain authenticator failed for ([14.88.228.202]) [14.88.228.202]:58564: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.11.250.94
description:
Feb  4 00:11:16 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.11.250.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.37.37.166
description:
Feb  4 00:10:30 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.37.37.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.166.2
description:
Feb  4 00:10:44 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.166.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 00:10:46 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Feb  4 00:10:23 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.90.99.29
description:
Feb  4 00:10:24 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.90.99.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.37.166
description:
2025-02-04 00:10:32 dovecot_plain authenticator failed for ([1.7.229.162]) [49.37.37.166]:54180: 535 Incorrect authentication data (set_id=ads32a00023y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-02-04 00:10:25 dovecot_plain authenticator failed for (nsg-static-90.87.76.182-airtel.com) [182.76.87.90]:55598: 535 Incorrect authentication data (set_id=mumuni)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 95.111.246.153
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin@coachingbyan.com||WPU:admin@coachingbyan.com||RSV:6.65||T:APACHE||MV:00-10.95.111.246.153


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.73.103.221
description:
Feb  4 00:10:30 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.73.103.221 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.156.92.107
description:
[2025-02-04 00:11:28 +0100] info [webmaild] 38.156.92.107 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 00:11:36 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.184.86.186
description:
Feb  4 00:11:36 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.184.86.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.105.113
description:
2025-02-04 00:11:37 dovecot_plain authenticator failed for (177-174-105-113.user.vivozap.com.br) [177.174.105.113]:40605: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.103
description:
Feb  4 00:12:16 ait sshd[3797294]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.24
description:
2025-02-04 00:11:29 dovecot_login authenticator failed for (nsg-corporate-24.227.187.122.airtel.in) [122.187.227.24]:54439: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.197.237.177
description:
2025-02-04 00:11:48 dovecot_plain authenticator failed for (177.237.197.116.unknown.m1.com.sg) [116.197.237.177]:45776: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.184.86.186
description:
2025-02-04 00:11:38 dovecot_plain authenticator failed for ([222.184.86.186]) [222.184.86.186]:42441: 535 Incorrect authentication data (set_id=paakow2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.141.105.6
description:
Feb  4 00:12:12 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.141.105.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.103
description:
Feb  4 00:12:16 ait sshd[3797294]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.103  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.189.180.243
description:
Feb  4 00:11:46 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.189.180.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.104.199.251
description:
Feb  4 00:11:54 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.104.199.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.35.109.214
description:
Feb  4 00:11:45 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.35.109.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.189.180.243
description:
2025-02-04 00:11:48 dovecot_plain authenticator failed for ([90.189.180.243]) [90.189.180.243]:49675: 535 Incorrect authentication data (set_id=paakow2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.126.227
description:
Feb  4 00:11:50 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.126.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.199.251
description:
2025-02-04 00:11:56 dovecot_plain authenticator failed for ([190.104.199.251]) [190.104.199.251]:37943: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.11.250.94
description:
2025-02-04 00:11:18 dovecot_login authenticator failed for ([60.11.250.94]) [60.11.250.94]:41352: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.105.113
description:
Feb  4 00:11:35 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.105.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.197.237.177
description:
Feb  4 00:11:46 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.197.237.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.194.38.121
description:
2025-02-04 00:11:41 dovecot_plain authenticator failed for ([2.194.38.121]) [2.194.38.121]:35216: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.141.105.6
description:
2025-02-04 00:12:14 dovecot_plain authenticator failed for (6.105.141.116.adsl-pool.jlccptt.net.cn) [116.141.105.6]:41424: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.108.69.214
description:
[2025-02-04 00:12:13 +0100] info [webmaild] 167.108.69.214 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.24
description:
Feb  4 00:11:27 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.194.38.121
description:
Feb  4 00:11:39 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.194.38.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.35.109.214
description:
2025-02-04 00:11:47 dovecot_plain authenticator failed for ([125.35.109.214]) [125.35.109.214]:37524: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.126.227
description:
2025-02-04 00:11:52 dovecot_plain authenticator failed for ([114.108.126.227]) [114.108.126.227]:54308: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.41.197.8
description:
[2025-02-04 00:12:05 +0100] info [webmaild] 38.41.197.8 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-02-04 00:12:39 dovecot_plain authenticator failed for ([221.209.48.204]) [221.209.48.203]:33898: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.161.217.20
description:
[2025-02-04 00:12:49 +0100] info [webmaild] 131.161.217.20 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.16.44.5
description:
2025-02-04 00:12:55 dovecot_login authenticator failed for ([165.16.44.5]) [165.16.44.5]:42531: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.222
description:
Feb  4 00:13:04 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Feb  4 00:12:37 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.16.44.5
description:
Feb  4 00:12:53 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.16.44.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.30.127.9
description:
Feb  4 00:13:05 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.30.127.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.222
description:
2025-02-04 00:13:06 dovecot_login authenticator failed for ([121.202.205.222]) [121.202.205.222]:65250: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.30.127.9
description:
2025-02-04 00:13:07 dovecot_plain authenticator failed for ([112.29.109.174]) [112.30.127.9]:47748: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.136.176.12
description:
Feb  4 00:13:36 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.136.176.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
description:
2025-02-04 00:13:55 dovecot_plain authenticator failed for ([58.216.101.166]) [58.216.101.162]:53066: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.185.23.242
description:
Feb  4 00:13:45 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.185.23.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.99.210
description:
Feb  4 00:13:47 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.99.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.99.210
description:
2025-02-04 00:13:49 dovecot_login authenticator failed for ([222.160.99.210]) [222.160.99.210]:36605: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Feb  4 00:14:07 ait sshd[3797999]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.164.8
description:
[2025-02-04 00:14:08 +0100] info [webmaild] 179.125.164.8 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
description:
Feb  4 00:13:33 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
description:
2025-02-04 00:13:38 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:36701: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
description:
Feb  4 00:13:53 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.37.37.166
description:
Feb  4 00:13:26 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.37.37.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.37.166
description:
2025-02-04 00:13:28 dovecot_login authenticator failed for ([115.240.6.56]) [49.37.37.166]:42890: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
description:
2025-02-04 00:13:35 dovecot_plain authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:42686: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.185.23.242
description:
2025-02-04 00:13:47 dovecot_login authenticator failed for ([211.185.23.242]) [211.185.23.242]:35873: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  4 00:14:07 ait sshd[3797999]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Feb  4 00:14:51 ait sshd[3798300]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.7.248.50
description:
2025-02-04 00:15:01 dovecot_login authenticator failed for ([116.7.248.50]) [116.7.248.50]:48325: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Feb  4 00:14:19 ait sshd[3798045]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  4 00:14:19 ait sshd[3798045]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.226.255.240
description:
Feb  4 00:14:44 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.226.255.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.226.255.240
description:
2025-02-04 00:14:46 dovecot_plain authenticator failed for ([58.226.255.240]) [58.226.255.240]:2651: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Feb  4 00:14:51 ait sshd[3798300]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.216.120.234
description:
2025-02-04 00:14:50 dovecot_login authenticator failed for 76-216-120-234.lightspeed.tukrga.sbcglobal.net [76.216.120.234]:39200: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.251.30.47
description:
2025-02-04 00:14:56 dovecot_login authenticator failed for ([200.251.30.47]) [200.251.30.47]:33044: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.65.203.82
description:
2025-02-04 00:15:08 dovecot_plain authenticator failed for ([63.65.203.82]) [63.65.203.82]:37371: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.200.216.246
description:
Feb  4 00:14:34 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.200.216.246 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.64.112.98
description:
[2025-02-04 00:14:40 +0100] info [webmaild] 196.64.112.98 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.200.216.246
description:
2025-02-04 00:14:36 dovecot_plain authenticator failed for ([113.200.216.246]) [113.200.216.246]:51596: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.251.30.47
description:
Feb  4 00:14:54 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.251.30.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.65.203.82
description:
Feb  4 00:15:06 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.65.203.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.243.68.66
description:
Feb  4 00:14:41 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.243.68.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.217.195.217
description:
[2025-02-04 00:14:44 +0100] info [webmaild] 45.217.195.217 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.216.120.234
description:
Feb  4 00:14:48 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.216.120.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.7.248.50
description:
Feb  4 00:14:59 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.7.248.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.213.126
description:
Feb  4 00:15:01 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.213.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.213.126
description:
2025-02-04 00:15:03 dovecot_login authenticator failed for ([5.30.213.126]) [5.30.213.126]:48751: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.254.7.41
description:
[2025-02-04 00:15:12 +0100] info [webmaild] 88.254.7.41 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.241.161
description:
Feb  4 00:15:26 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.241.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.245
description:
Feb  4 00:15:43 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.97.166.63
description:
Feb  4 00:15:44 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.97.166.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.245
description:
2025-02-04 00:15:45 dovecot_login authenticator failed for (m121-202-152-245.smartone.com) [121.202.152.245]:36951: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.4.150.142
description:
2025-02-04 00:15:59 dovecot_login authenticator failed for ([112.4.150.142]) [112.4.150.142]:37332: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
description:
2025-02-04 00:16:02 dovecot_plain authenticator failed for ([103.219.154.156]) [103.219.154.156]:59308: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.32.250.174
description:
Feb  4 00:16:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.32.250.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.241.161
description:
2025-02-04 00:15:28 dovecot_plain authenticator failed for ([115.23.241.161]) [115.23.241.161]:59599: 535 Incorrect authentication data (set_id=abs18a00023y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.96.160.36
description:
Feb  4 00:15:43 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.96.160.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.44
description:
Feb  4 00:15:54 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
description:
2025-02-04 00:15:56 dovecot_login authenticator failed for ([103.147.248.44]) [103.147.248.44]:59228: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.4.150.142
description:
Feb  4 00:15:57 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.4.150.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.32.250.174
description:
2025-02-04 00:16:11 dovecot_plain authenticator failed for ([117.32.250.174]) [117.32.250.174]:57861: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.96.160.36
description:
2025-02-04 00:15:45 dovecot_login authenticator failed for ([211.96.160.36]) [211.96.160.36]:33522: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.97.166.63
description:
2025-02-04 00:15:46 dovecot_plain authenticator failed for 172-97-166-63.cpe.distributel.net [172.97.166.63]:63169: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.219.154.156
description:
Feb  4 00:16:00 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.219.154.156 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.54.94.97
description:
[2025-02-04 00:16:49 +0100] info [webmaild] 177.54.94.97 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.122.213
description:
Feb  4 00:16:46 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.122.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.135.188.125
description:
2025-02-04 00:16:33 dovecot_plain authenticator failed for ([121.135.188.125]) [121.135.188.125]:47036: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.146.210.180
description:
2025-02-04 00:16:36 dovecot_login authenticator failed for mail-02.03.perm.ru [46.146.210.180]:34895: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.210.232
description:
Feb  4 00:16:51 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.210.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.210.232
description:
2025-02-04 00:16:53 dovecot_login authenticator failed for ([87.103.210.232]) [87.103.210.232]:35419: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.135.188.125
description:
Feb  4 00:16:31 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.135.188.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.146.210.180
description:
Feb  4 00:16:34 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.146.210.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.122.213
description:
2025-02-04 00:16:48 dovecot_login authenticator failed for (177-174-122-213.user.vivozap.com.br) [177.174.122.213]:53277: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.184.42.105
description:
Feb  4 00:17:03 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.184.42.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.42.105
description:
2025-02-04 00:17:05 dovecot_login authenticator failed for ([112.184.42.105]) [112.184.42.105]:36823: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.88.26.200
description:
2025-02-04 00:17:09 dovecot_login authenticator failed for (ADMIN) [149.88.26.200]:55506: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-17.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.76.57.200
description:
2025-02-04 00:17:37 dovecot_login authenticator failed for ([103.76.57.200]) [103.76.57.200]:51604: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.249.167.45
description:
Feb  4 00:17:41 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.249.167.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.249.167.45
description:
2025-02-04 00:17:43 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:52955: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.160.195
description:
Feb  4 00:17:48 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.160.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.167.55.230
description:
Feb  4 00:17:19 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.167.55.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
description:
2025-02-04 00:17:21 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:33169: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.228.112.90
description:
[2025-02-04 00:17:57 +0100] info [webmaild] 45.228.112.90 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.3.133.47
description:
Feb  4 00:18:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.3.133.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.250.81.177
description:
Feb  4 00:17:50 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.250.81.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.250.81.177
description:
2025-02-04 00:17:52 dovecot_login authenticator failed for ([183.250.81.177]) [183.250.81.177]:33257: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.17.128.7
description:
2025-02-04 00:17:29 dovecot_plain authenticator failed for ([58.17.128.7]) [58.17.128.7]:47565: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.255.164.242
description:
[2025-02-04 00:17:25 +0100] info [webmaild] 143.255.164.242 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.17.128.7
description:
Feb  4 00:17:27 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.17.128.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Feb  4 00:17:37 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-02-04 00:17:39 dovecot_login authenticator failed for ([128.106.196.150]) [128.106.196.150]:4313: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.195
description:
2025-02-04 00:17:50 dovecot_plain authenticator failed for (unquads) [65.20.160.195]:48638: 535 Incorrect authentication data (set_id=eng19b00195y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.3.133.47
description:
2025-02-04 00:18:11 dovecot_plain authenticator failed for ([183.3.133.47]) [183.3.133.47]:48740: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.185.78.246
description:
[2025-02-04 00:17:23 +0100] info [webmaild] 191.185.78.246 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.76.57.200
description:
Feb  4 00:17:35 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.76.57.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 00:19:00 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.229.51.206
description:
2025-02-04 00:19:04 dovecot_plain authenticator failed for ([58.229.51.206]) [58.229.51.206]:37332: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.207.241.168
description:
Feb  4 00:18:20 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.207.241.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.241.168
description:
2025-02-04 00:18:22 dovecot_plain authenticator failed for ([154.65.33.26]) [196.207.241.168]:36714: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 00:18:42 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.2.214.145
description:
Feb  4 00:18:49 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.2.214.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.2.214.145
description:
2025-02-04 00:18:51 dovecot_plain authenticator failed for ([27.2.214.145]) [27.2.214.145]:56082: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.206
description:
Feb  4 00:19:02 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.31.242
description:
Feb  4 00:19:55 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.31.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.21.141.139
description:
[2025-02-04 00:19:55 +0100] info [webmaild] 5.21.141.139 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.31.242
description:
2025-02-04 00:19:57 dovecot_login authenticator failed for ([61.169.31.242]) [61.169.31.242]:52970: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.33.212.26
description:
Feb  4 00:20:01 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.33.212.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.33.212.26
description:
2025-02-04 00:20:03 dovecot_plain authenticator failed for (lacesty) [41.33.212.26]:41304: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 198.12.85.199
description:
Feb  4 00:20:05 ait sshd[3800344]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.12.85.199


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.94.134.87
description:
[2025-02-04 00:19:19 +0100] info [webmaild] 187.94.134.87 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.208.239.198
description:
[2025-02-04 00:19:56 +0100] info [webmaild] 143.208.239.198 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.12.85.199
description:
Feb  4 00:20:05 ait sshd[3800344]: pam_imunify(sshd:auth): [IM360_RBL] The IP 198.12.85.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.149.154.146
description:
2025-02-04 00:19:39 dovecot_login authenticator failed for ([103.149.154.146]) [103.149.154.146]:51459: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.252.204.203
description:
Feb  4 00:20:41 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.252.204.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
description:
Feb  4 00:20:53 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.243.50
description:
Feb  4 00:20:59 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.243.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.108.215.50
description:
[2025-02-04 00:20:38 +0100] info [webmaild] 190.108.215.50 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
description:
Feb  4 00:20:58 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.252.204.203
description:
2025-02-04 00:20:43 dovecot_login authenticator failed for ([1.252.204.203]) [1.252.204.203]:61034: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
description:
2025-02-04 00:21:00 dovecot_login authenticator failed for ([175.206.105.126]) [175.206.105.126]:54042: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.0.53
description:
Feb  4 00:21:12 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.0.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.0.53
description:
2025-02-04 00:21:14 dovecot_login authenticator failed for ([101.13.0.53]) [101.13.0.53]:56292: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
description:
2025-02-04 00:20:55 dovecot_plain authenticator failed for ([186.247.238.25]) [200.149.51.186]:41540: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.243.50
description:
2025-02-04 00:21:01 dovecot_login authenticator failed for ([117.158.243.50]) [117.158.243.50]:39496: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.118.121
description:
Feb  4 00:21:26 ait sshd[3801998]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.118.121 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.232.222.32
description:
[2025-02-04 00:21:58 +0100] info [webmaild] 181.232.222.32 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.124.42.85
description:
Feb  4 00:21:15 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.124.42.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.42.85
description:
2025-02-04 00:21:17 dovecot_plain authenticator failed for ([203.124.42.85]) [203.124.42.85]:57144: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.118.121
description:
Feb  4 00:21:26 ait sshd[3801998]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.118.121


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 41.216.188.18
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-21.41.216.188.18


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.123.76.145
description:
[2025-02-04 00:22:35 +0100] info [webmaild] 181.123.76.145 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.115
description:
2025-02-04 00:22:39 dovecot_login authenticator failed for (m121-202-152-115.smartone.com) [121.202.152.115]:15962: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.30.214
description:
2025-02-04 00:23:11 dovecot_login authenticator failed for ([220.77.30.214]) [220.77.30.214]:38828: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
description:
Feb  4 00:22:30 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
description:
2025-02-04 00:22:32 dovecot_login authenticator failed for ([186.247.238.25]) [200.149.51.186]:53625: 535 Incorrect authentication data (set_id=amadam@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.62
description:
Feb  4 00:22:40 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.174.103.74
description:
Feb  4 00:22:41 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.174.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.62
description:
2025-02-04 00:22:42 dovecot_plain authenticator failed for ([203.189.124.62]) [203.189.124.62]:60807: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 181.170.202.217
description:
Feb  4 00:22:26 ait sshd[3802813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.170.202.217  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.174.103.74
description:
2025-02-04 00:22:43 dovecot_login authenticator failed for 74-103-174-206.gci.net [206.174.103.74]:61800: 535 Incorrect authentication data (set_id=amadam)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.30.214
description:
Feb  4 00:23:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.30.214 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.49.52.100
description:
[2025-02-04 00:22:29 +0100] info [webmaild] 179.49.52.100 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.115
description:
Feb  4 00:22:37 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.115 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.47.8.194
description:
[2025-02-04 00:23:02 +0100] info [webmaild] 186.47.8.194 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.178.158.132
description:
Feb  4 00:22:19 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.178.158.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.178.158.132
description:
2025-02-04 00:22:21 dovecot_plain authenticator failed for ([103.178.158.133]) [103.178.158.132]:41866: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.57.96.109
description:
Feb  4 00:23:27 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.57.96.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.57.96.109
description:
2025-02-04 00:23:29 dovecot_login authenticator failed for ([58.19.13.200]) [113.57.96.109]:14151: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.124.14
description:
Feb  4 00:23:38 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.124.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
description:
2025-02-04 00:23:40 dovecot_plain authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:49143: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 00:23:42 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.5.76.239
description:
Feb  4 00:23:56 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.5.76.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.38.202.60
description:
2025-02-04 00:24:12 dovecot_login authenticator failed for ([136.38.202.60]) [136.38.202.60]:57158: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.154.175
description:
Feb  4 00:23:37 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.154.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
description:
2025-02-04 00:23:39 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.154.175]:39342: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
description:
Feb  4 00:23:42 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
description:
2025-02-04 00:23:44 dovecot_login authenticator failed for 51.174.157.77.rev.sfr.net [77.157.174.51]:36922: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.5.76.239
description:
2025-02-04 00:23:58 dovecot_plain authenticator failed for ([112.5.76.239]) [112.5.76.239]:51331: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.38.202.60
description:
Feb  4 00:24:10 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.38.202.60 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.29.19.69
description:
[2025-02-04 00:24:59 +0100] info [webmaild] 176.29.19.69 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 00:25:14 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.228.254.102
description:
[2025-02-04 00:24:34 +0100] info [webmaild] 45.228.254.102 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
description:
2025-02-04 00:24:47 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:53475: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  4 00:25:06 ait sshd[3804046]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  4 00:25:06 ait sshd[3804046]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.44.165
description:
2025-02-04 00:24:56 dovecot_login authenticator failed for ([49.245.44.165]) [49.245.44.165]:47222: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.65.18.227
description:
[2025-02-04 00:25:09 +0100] info [webmaild] 187.65.18.227 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 198.12.85.199
description:
Feb  4 00:24:30 ait sshd[3803595]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.12.85.199


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.223.176.171
description:
Feb  4 00:24:45 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.223.176.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
description:
Feb  4 00:24:22 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.12.85.199
description:
Feb  4 00:24:30 ait sshd[3803595]: pam_imunify(sshd:auth): [IM360_RBL] The IP 198.12.85.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.44.165
description:
Feb  4 00:24:54 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.44.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.216.117
description:
2025-02-04 00:25:57 dovecot_plain authenticator failed for ([103.148.216.98]) [103.148.216.117]:34544: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
description:
Feb  4 00:25:47 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.148.216.117
description:
Feb  4 00:25:55 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.148.216.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.83
description:
Feb  4 00:25:59 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.72
description:
Feb  4 00:25:31 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.72 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 198.12.85.199
description:
Feb  4 00:25:42 ait sshd[3804311]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.12.85.199


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.83
description:
2025-02-04 00:26:01 dovecot_plain authenticator failed for (m121-202-154-83.smartone.com) [121.202.154.83]:56334: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.164.117.23
description:
Feb  4 00:25:23 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.164.117.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.12.85.199
description:
Feb  4 00:25:42 ait sshd[3804311]: pam_imunify(sshd:auth): [IM360_RBL] The IP 198.12.85.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
description:
2025-02-04 00:25:49 dovecot_plain authenticator failed for ([196.191.212.236]) [213.55.85.202]:23208: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
description:
2025-02-04 00:25:25 dovecot_plain authenticator failed for ([164.164.117.23]) [164.164.117.23]:53486: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.165.161.223
description:
[2025-02-04 00:25:31 +0100] info [webmaild] 45.165.161.223 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.72
description:
2025-02-04 00:25:33 dovecot_plain authenticator failed for ([95.0.252.72]) [95.0.252.72]:47498: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.85.199
description:
Feb  4 00:25:44 ait sshd[3804311]: Failed password for invalid user server from 198.12.85.199 port 53598 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.12.85.199
description:
Feb  4 00:26:51 ait sshd[3804675]: pam_imunify(sshd:auth): [IM360_RBL] The IP 198.12.85.199 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Feb  4 00:26:55 ait sshd[3804699]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.124.4
description:
Feb  4 00:27:14 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.124.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.112.194.160
description:
2025-02-04 00:26:24 dovecot_plain authenticator failed for ([106.112.194.160]) [106.112.194.160]:34437: 535 Incorrect authentication data


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Feb  4 00:26:55 ait sshd[3804699]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.201.59.224
description:
Feb  4 00:27:15 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.201.59.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.94.74.150
description:
Feb  4 00:27:11 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.94.74.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.150
description:
2025-02-04 00:27:13 dovecot_plain authenticator failed for ([180.94.74.150]) [180.94.74.150]:47753: 535 Incorrect authentication data (set_id=eng19b00228y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.124.4
description:
2025-02-04 00:27:16 dovecot_plain authenticator failed for ([112.91.124.4]) [112.91.124.4]:49288: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.5.135
description:
2025-02-04 00:27:04 dovecot_plain authenticator failed for ([46.44.5.135]) [46.44.5.135]:60528: 535 Incorrect authentication data (set_id=eng19b00228y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.57.205.7
description:
Feb  4 00:27:15 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.57.205.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.109
description:
Feb  4 00:26:33 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.109
description:
2025-02-04 00:26:35 dovecot_plain authenticator failed for (m121-202-201-109.smartone.com) [121.202.201.109]:47828: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 198.12.85.199
description:
Feb  4 00:26:51 ait sshd[3804675]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.12.85.199


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.44.5.135
description:
Feb  4 00:27:02 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.44.5.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.252.152.214
description:
Feb  4 00:28:05 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.252.152.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
description:
2025-02-04 00:28:08 dovecot_plain authenticator failed for ([182.76.71.82]) [182.76.71.82]:45440: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Feb  4 00:28:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.148.215.54
description:
2025-02-04 00:28:09 dovecot_plain authenticator failed for (75-148-215-54-Houston.hfc.comcastbusiness.net) [75.148.215.54]:40077: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.42.173.64
description:
2025-02-04 00:27:33 dovecot_plain authenticator failed for ([115.42.173.64]) [115.42.173.64]:39985: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.44.118
description:
Feb  4 00:27:38 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.44.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.50.67.114
description:
Feb  4 00:28:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.50.67.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.222.90.178
description:
2025-02-04 00:28:09 dovecot_plain authenticator failed for ([200.222.90.178]) [200.222.90.178]:41459: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
description:
2025-02-04 00:28:12 dovecot_plain authenticator failed for ([220.93.167.144]) [220.93.167.144]:57162: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.57.71
description:
2025-02-04 00:28:13 dovecot_plain authenticator failed for n220246057071.netvigator.com [220.246.57.71]:58155: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Feb  4 00:27:30 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.49.182.103
description:
2025-02-04 00:27:40 dovecot_plain authenticator failed for ([38.49.182.103]) [38.49.182.103]:50654: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.84.46.57
description:
[2025-02-04 00:27:49 +0100] info [webmaild] 138.84.46.57 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.120.67.149
description:
2025-02-04 00:28:06 dovecot_plain authenticator failed for ([87.120.67.149]) [87.120.67.149]:34753: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
description:
Feb  4 00:28:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
description:
2025-02-04 00:28:11 dovecot_plain authenticator failed for ([186.247.238.25]) [200.149.51.186]:52857: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
description:
2025-02-04 00:27:19 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:49996: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.194.38.121
description:
2025-02-04 00:28:09 dovecot_plain authenticator failed for ([2.194.38.121]) [2.194.38.121]:37512: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.25.140.211
description:
Feb  4 00:27:41 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.25.140.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.26.197
description:
2025-02-04 00:27:43 dovecot_plain authenticator failed for ([61.184.26.197]) [61.184.26.197]:40378: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.136.164.157
description:
Feb  4 00:28:07 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.136.164.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.222.90.178
description:
Feb  4 00:28:07 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.222.90.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.93.167.144
description:
Feb  4 00:28:10 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.93.167.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.208.221
description:
2025-02-04 00:27:29 dovecot_login authenticator failed for ([113.64.208.221]) [113.64.208.221]:51098: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.71.49.171
description:
Feb  4 00:27:52 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.71.49.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.71.49.171
description:
2025-02-04 00:27:54 dovecot_plain authenticator failed for 82-71-49-171.dsl.in-addr.zen.co.uk [82.71.49.171]:41118: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.90
description:
2025-02-04 00:28:09 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:34906: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.75.227.38
description:
Feb  4 00:28:10 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.75.227.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.232.206
description:
2025-02-04 00:28:11 dovecot_plain authenticator failed for ([177.6.232.206]) [177.6.232.206]:55453: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.239.78.124
description:
Feb  4 00:28:13 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.239.78.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.200.230.61
description:
2025-02-04 00:28:13 dovecot_plain authenticator failed for ([12.200.230.61]) [12.200.230.61]:63374: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.146.201.37
description:
2025-02-04 00:27:18 dovecot_plain authenticator failed for ([221.146.201.37]) [221.146.201.37]:57999: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-02-04 00:27:32 dovecot_plain authenticator failed for ([128.106.196.150]) [128.106.196.150]:4576: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.24.80.76
description:
[2025-02-04 00:27:38 +0100] info [webmaild] 186.24.80.76 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
description:
2025-02-04 00:27:40 dovecot_plain authenticator failed for ([103.163.44.118]) [103.163.44.118]:40156: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.134.126.162
description:
2025-02-04 00:28:09 dovecot_plain authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:2521: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.141.105.6
description:
2025-02-04 00:28:09 dovecot_plain authenticator failed for (6.105.141.116.adsl-pool.jlccptt.net.cn) [116.141.105.6]:52594: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.14.83
description:
2025-02-04 00:28:11 dovecot_plain authenticator failed for (187.161.14.83-clientes-izzi.mx) [187.161.14.83]:54514: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.182.32.16
description:
2025-02-04 00:28:11 dovecot_plain authenticator failed for ([118.182.32.16]) [118.182.32.16]:42550: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.210.27.53
description:
2025-02-04 00:28:12 dovecot_plain authenticator failed for ([223.210.27.53]) [223.210.27.53]:21004: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
description:
2025-02-04 00:28:15 dovecot_plain authenticator failed for ([182.239.78.124]) [182.239.78.124]:44396: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.134.209.109
description:
[2025-02-04 00:27:17 +0100] info [webmaild] 186.134.209.109 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.71.82
description:
Feb  4 00:28:06 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.71.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.67.114
description:
2025-02-04 00:28:11 dovecot_plain authenticator failed for (187-93-74-213.customer.tdatabrasil.net.br) [187.50.67.114]:39119: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-02-04 00:28:11 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:36512: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.201.37
description:
Feb  4 00:27:16 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.201.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.49.182.103
description:
Feb  4 00:27:38 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.49.182.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.194.38.121
description:
Feb  4 00:28:07 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.194.38.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.134.126.162
description:
Feb  4 00:28:07 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.134.126.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
description:
2025-02-04 00:28:09 dovecot_plain authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:44377: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.71.109
description:
2025-02-04 00:28:13 dovecot_plain authenticator failed for ([112.168.71.109]) [112.168.71.109]:52760: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.201.59.224
description:
2025-02-04 00:27:17 dovecot_login authenticator failed for ([119.201.59.224]) [119.201.59.224]:54543: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.42.173.64
description:
Feb  4 00:27:31 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.42.173.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.148.215.54
description:
Feb  4 00:28:07 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.148.215.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.252.152.214
description:
2025-02-04 00:28:07 dovecot_plain authenticator failed for ([193.252.152.214]) [193.252.152.214]:42182: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.182.32.16
description:
Feb  4 00:28:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.182.32.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.25.140.211
description:
2025-02-04 00:27:43 dovecot_login authenticator failed for ([112.25.140.211]) [112.25.140.211]:44337: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
description:
2025-02-04 00:28:09 dovecot_plain authenticator failed for ([92.126.223.175]) [92.126.223.175]:52644: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.210.27.53
description:
Feb  4 00:28:10 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.210.27.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.57.205.7
description:
2025-02-04 00:27:17 dovecot_plain authenticator failed for ([117.57.205.7]) [117.57.205.7]:57596: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.85.251.16
description:
Feb  4 00:27:27 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.85.251.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.239.241.198
description:
2025-02-04 00:27:35 dovecot_plain authenticator failed for ([115.239.241.198]) [115.239.241.198]:59902: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.161.14.83
description:
Feb  4 00:28:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.161.14.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.91.172.21
description:
Feb  4 00:28:12 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.91.172.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.91.172.21
description:
2025-02-04 00:28:14 dovecot_plain authenticator failed for ([219.91.172.21]) [219.91.172.21]:57156: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.144.187.114
description:
Feb  4 00:28:14 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.144.187.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.208.221
description:
Feb  4 00:27:27 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.208.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.239.241.198
description:
Feb  4 00:27:33 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.239.241.198 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 207.180.230.127
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:StephenAJnr||WPU:StephenAJnr||RSV:6.65||T:APACHE||MV:00-28.207.180.230.127


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.144.187.114
description:
2025-02-04 00:28:16 dovecot_plain authenticator failed for ([89.144.187.114]) [89.144.187.114]:53475: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.85.251.16
description:
2025-02-04 00:27:29 dovecot_plain authenticator failed for ([220.85.251.16]) [220.85.251.16]:58210: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.126.223.175
description:
Feb  4 00:28:07 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.126.223.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.141.105.6
description:
Feb  4 00:28:07 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.141.105.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.90
description:
Feb  4 00:28:07 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
description:
Feb  4 00:27:17 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.26.197
description:
Feb  4 00:27:41 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.26.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.120.67.149
description:
Feb  4 00:28:04 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.120.67.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.232.206
description:
Feb  4 00:28:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.232.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.57.71
description:
Feb  4 00:28:11 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.57.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.200.230.61
description:
Feb  4 00:28:11 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.200.230.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.75.227.38
description:
2025-02-04 00:28:12 dovecot_plain authenticator failed for 128-75-227-38.broadband.corbina.ru [128.75.227.38]:56133: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.237.108
description:
Feb  4 00:28:21 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.237.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.193.37.116
description:
Feb  4 00:28:27 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.193.37.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.201.78.193
description:
2025-02-04 00:28:39 dovecot_plain authenticator failed for ([175.201.78.193]) [175.201.78.193]:49814: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.129.199
description:
2025-02-04 00:28:22 dovecot_plain authenticator failed for ([203.172.129.199]) [203.172.129.199]:42767: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.179
description:
2025-02-04 00:28:23 dovecot_plain authenticator failed for (m121-202-153-179.smartone.com) [121.202.153.179]:20390: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.192.168
description:
Feb  4 00:28:37 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.192.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-02-04 00:28:39 dovecot_plain authenticator failed for ([112.111.61.231]) [112.111.61.229]:58852: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.117.144.194
description:
2025-02-04 00:28:40 dovecot_plain authenticator failed for ([211.117.144.194]) [211.117.144.194]:56988: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.207.129.246
description:
Feb  4 00:28:45 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.207.129.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.97.236.1
description:
2025-02-04 00:28:31 dovecot_plain authenticator failed for (ip-189-97-236-1.user.vivozap.com.br) [189.97.236.1]:41233: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.202.154.245
description:
Feb  4 00:28:48 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.202.154.245 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.75.101.122
description:
[2025-02-04 00:28:18 +0100] info [webmaild] 105.75.101.122 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.42.85
description:
2025-02-04 00:28:18 dovecot_plain authenticator failed for ([203.124.42.85]) [203.124.42.85]:41793: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.51.222.234
description:
Feb  4 00:28:18 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.51.222.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.190.111.104
description:
2025-02-04 00:28:22 dovecot_plain authenticator failed for 107-190-111-104.cpe.teksavvy.com [107.190.111.104]:41058: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.46.250
description:
2025-02-04 00:28:22 dovecot_plain authenticator failed for ([189.80.46.250]) [189.80.46.250]:44897: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
description:
Feb  4 00:28:31 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.118.229
description:
Feb  4 00:28:20 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.118.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.118.229
description:
2025-02-04 00:28:22 dovecot_plain authenticator failed for ([138.75.118.229]) [138.75.118.229]:58629: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.30.170
description:
Feb  4 00:28:26 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.30.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.97.98
description:
Feb  4 00:28:49 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.97.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.77.137.236
description:
Feb  4 00:28:17 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.77.137.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.166.68.184
description:
Feb  4 00:28:18 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.166.68.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.213.240.6
description:
Feb  4 00:28:27 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.213.240.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.59.125
description:
Feb  4 00:28:32 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.59.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.193.37.116
description:
2025-02-04 00:28:29 dovecot_plain authenticator failed for ([211.193.37.116]) [211.193.37.116]:34802: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.147.25.111
description:
2025-02-04 00:28:34 dovecot_plain authenticator failed for ([121.147.25.111]) [121.147.25.111]:45194: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.213.240.6
description:
2025-02-04 00:28:29 dovecot_plain authenticator failed for (6.240.213.139.adsl-pool.jlccptt.net.cn) [139.213.240.6]:23362: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.207.24
description:
Feb  4 00:28:37 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.207.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.189
description:
Feb  4 00:28:42 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.97.98
description:
2025-02-04 00:28:51 dovecot_plain authenticator failed for (undefined.hostname.localhost) [103.90.97.98]:43078: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.129.201.81
description:
Feb  4 00:28:48 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.129.201.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.12.179
description:
Feb  4 00:28:20 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.12.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.243.43.58
description:
Feb  4 00:28:21 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.243.43.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.196.60.13
description:
Feb  4 00:28:25 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.196.60.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
description:
2025-02-04 00:28:33 dovecot_plain authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:54946: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.147.25.111
description:
Feb  4 00:28:32 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.147.25.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.115
description:
2025-02-04 00:28:22 dovecot_plain authenticator failed for (static.as64098.net) [103.79.175.115]:50392: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.121.69
description:
Feb  4 00:28:38 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.121.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.189
description:
2025-02-04 00:28:44 dovecot_plain authenticator failed for ([60.167.19.189]) [60.167.19.189]:59759: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.129.201.81
description:
2025-02-04 00:28:50 dovecot_plain authenticator failed for ([103.129.201.82]) [103.129.201.81]:34702: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.124.127.56
description:
Feb  4 00:29:00 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.124.127.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.252.204.203
description:
Feb  4 00:28:34 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.252.204.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.196.30.122
description:
2025-02-04 00:28:42 dovecot_plain authenticator failed for ([103.196.30.122]) [103.196.30.122]:39293: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.137.250
description:
2025-02-04 00:28:18 dovecot_plain authenticator failed for ([203.193.137.250]) [203.193.137.250]:59221: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.115
description:
Feb  4 00:28:20 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.139.195
description:
2025-02-04 00:28:28 dovecot_plain authenticator failed for ([175.156.139.195]) [175.156.139.195]:34853: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.30.170
description:
2025-02-04 00:28:28 dovecot_plain authenticator failed for ([61.185.30.170]) [61.185.30.170]:51795: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.121.69
description:
2025-02-04 00:28:40 dovecot_plain authenticator failed for ([183.238.121.69]) [183.238.121.69]:57359: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.196.30.122
description:
Feb  4 00:28:40 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.196.30.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.124.127.56
description:
2025-02-04 00:29:02 dovecot_plain authenticator failed for ([98.124.127.56]) [98.124.127.56]:57288: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
description:
2025-02-04 00:28:28 dovecot_plain authenticator failed for (static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:37810: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.201.78.193
description:
Feb  4 00:28:37 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.201.78.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.193.137.250
description:
Feb  4 00:28:16 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.193.137.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.80.46.250
description:
Feb  4 00:28:20 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.80.46.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
description:
2025-02-04 00:28:26 dovecot_plain authenticator failed for ([209.173.10.75]) [209.173.10.75]:37866: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.42.74
description:
Feb  4 00:28:27 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.42.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
description:
2025-02-04 00:28:25 dovecot_plain authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:10990: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.169.81.36
description:
2025-02-04 00:28:27 dovecot_plain authenticator failed for syn-076-169-081-036.res.spectrum.com [76.169.81.36]:41076: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Feb  4 00:28:37 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.243.43.58
description:
2025-02-04 00:28:23 dovecot_plain authenticator failed for ([211.243.43.58]) [211.243.43.58]:55266: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.166.68.184
description:
2025-02-04 00:28:20 dovecot_plain authenticator failed for (5x166x68x184.dynamic.barnaul.ertelecom.ru) [5.166.68.184]:54692: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.8.143
description:
2025-02-04 00:28:27 dovecot_plain authenticator failed for 111-70-8-143.emome-ip.hinet.net [111.70.8.143]:52782: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.172.129.199
description:
Feb  4 00:28:20 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.172.129.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.179
description:
Feb  4 00:28:21 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.75.30.6
description:
Feb  4 00:28:21 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.75.30.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.8.143
description:
Feb  4 00:28:25 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.8.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.139.195
description:
Feb  4 00:28:26 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.139.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.161.184.58
description:
Feb  4 00:28:28 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.161.184.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.29.121.110
description:
Feb  4 00:28:27 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.29.121.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.252.204.203
description:
2025-02-04 00:28:36 dovecot_plain authenticator failed for ([1.252.204.203]) [1.252.204.203]:61189: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.190.111.104
description:
Feb  4 00:28:20 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.190.111.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.152.225.154
description:
Feb  4 00:28:23 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.152.225.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.21
description:
Feb  4 00:28:46 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.71.8
description:
2025-02-04 00:28:54 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:45399: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.2.44.54
description:
Feb  4 00:28:26 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.2.44.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.195.179
description:
2025-02-04 00:28:35 dovecot_plain authenticator failed for ([183.109.195.179]) [183.109.195.179]:51552: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.124.42.85
description:
Feb  4 00:28:16 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.124.42.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.51.222.234
description:
2025-02-04 00:28:20 dovecot_plain authenticator failed for a109-51-222-234.cpe.netcabo.pt [109.51.222.234]:42616: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.169.81.36
description:
Feb  4 00:28:25 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.169.81.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.95.123.220
description:
Feb  4 00:29:08 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.95.123.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.237.108
description:
2025-02-04 00:28:23 dovecot_plain authenticator failed for ([218.22.237.108]) [218.22.237.108]:60156: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.75.30.6
description:
2025-02-04 00:28:23 dovecot_plain authenticator failed for ([218.75.30.6]) [218.75.30.6]:57520: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.195.179
description:
Feb  4 00:28:33 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.195.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.207.129.246
description:
2025-02-04 00:28:47 dovecot_plain authenticator failed for ([185.207.129.246]) [185.207.129.246]:38706: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.21
description:
2025-02-04 00:28:48 dovecot_plain authenticator failed for (nsg-corporate-21.229.187.122.airtel.in) [122.187.229.21]:35222: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.192.168
description:
2025-02-04 00:28:39 dovecot_plain authenticator failed for ([220.80.192.168]) [220.80.192.168]:54772: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.42.74
description:
2025-02-04 00:28:29 dovecot_plain authenticator failed for ([58.18.42.74]) [58.18.42.74]:41419: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.202.154.245
description:
2025-02-04 00:28:50 dovecot_plain authenticator failed for ([94.202.154.245]) [94.202.154.245]:43584: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
description:
2025-02-04 00:28:22 dovecot_plain authenticator failed for ([128.185.12.179]) [128.185.12.179]:37898: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.60.13
description:
2025-02-04 00:28:27 dovecot_plain authenticator failed for ([112.196.60.13]) [112.196.60.13]:38042: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.225.240
description:
2025-02-04 00:28:33 dovecot_plain authenticator failed for ([94.204.225.240]) [94.204.225.240]:44693: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.207.24
description:
2025-02-04 00:28:39 dovecot_plain authenticator failed for syn-076-176-207-024.res.spectrum.com [76.176.207.24]:64240: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.20.6.2
description:
2025-02-04 00:29:00 dovecot_plain authenticator failed for (189-44-19-161.customer.tdatabrasil.net.br) [189.20.6.2]:35120: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.85.205
description:
Feb  4 00:28:23 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.85.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.225.240
description:
Feb  4 00:28:31 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.225.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.173.10.75
description:
Feb  4 00:28:24 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.173.10.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.20.6.2
description:
Feb  4 00:28:58 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.20.6.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.58
description:
2025-02-04 00:28:30 dovecot_plain authenticator failed for ([131.161.184.58]) [131.161.184.58]:50702: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.85.205
description:
2025-02-04 00:28:25 dovecot_plain authenticator failed for 131-106-85-205.s1483.c3-0.tlg-cbr5.atw-tlg.pa.cable.rcncustomer.com [131.106.85.205]:48938: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.151.71.8
description:
Feb  4 00:28:52 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.151.71.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.95.123.220
description:
2025-02-04 00:29:10 dovecot_plain authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:50021: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
description:
2025-02-04 00:28:19 dovecot_plain authenticator failed for ([110.77.137.236]) [110.77.137.236]:52168: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.97.236.1
description:
Feb  4 00:28:29 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.97.236.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.29.121.110
description:
2025-02-04 00:28:29 dovecot_plain authenticator failed for ([46.29.121.110]) [46.29.121.110]:41244: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.59.125
description:
2025-02-04 00:28:34 dovecot_plain authenticator failed for ([103.171.59.125]) [103.171.59.125]:42902: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.117.144.194
description:
Feb  4 00:28:38 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.117.144.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
description:
Feb  4 00:29:52 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.54.106.83
description:
2025-02-04 00:29:58 dovecot_plain authenticator failed for 83.106.54.198.in-addr.arpa [198.54.106.83]:61672: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.202.206.163
description:
Feb  4 00:30:05 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.202.206.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.202.206.163
description:
2025-02-04 00:30:07 dovecot_plain authenticator failed for 163.189-202-206.bestelclientes.com.mx [189.202.206.163]:38170: 535 Incorrect authentication data (set_id=awadzie)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.148.10.90
domain: www.afaccra.u3l.us
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/s3cmd.ini||User:titlemas||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.252.8.34
description:
Feb  4 00:29:43 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.252.8.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.231.247.210
description:
2025-02-04 00:30:10 dovecot_plain authenticator failed for ([101.231.247.210]) [101.231.247.210]:46358: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.40.72.101
description:
2025-02-04 00:30:10 dovecot_plain authenticator failed for ([89.40.72.101]) [89.40.72.101]:43380: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
description:
2025-02-04 00:29:54 dovecot_plain authenticator failed for ([185.255.212.178]) [185.255.212.178]:47730: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.54.106.83
description:
Feb  4 00:29:56 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.54.106.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.87.38
description:
Feb  4 00:30:00 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.87.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.87.38
description:
2025-02-04 00:30:02 dovecot_plain authenticator failed for ([1.28.87.38]) [1.28.87.38]:35920: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.109.5.227
description:
[2025-02-04 00:30:10 +0100] info [webmaild] 176.109.5.227 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.44.171
description:
Feb  4 00:29:55 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.44.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.44.171
description:
2025-02-04 00:29:57 dovecot_plain authenticator failed for ([222.128.44.171]) [222.128.44.171]:2220: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.231.247.210
description:
Feb  4 00:30:08 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.231.247.210 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.131.242.68
description:
[2025-02-04 00:29:45 +0100] info [webmaild] 190.131.242.68 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.252.8.34
description:
2025-02-04 00:29:45 dovecot_plain authenticator failed for ([43.252.8.34]) [43.252.8.34]:46880: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.40.72.101
description:
Feb  4 00:30:08 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.40.72.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.124.94
description:
2025-02-04 00:31:00 dovecot_plain authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:35930: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.158.248.248
description:
2025-02-04 00:31:02 dovecot_plain authenticator failed for ([193.158.248.248]) [193.158.248.248]:40612: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
description:
2025-02-04 00:31:15 dovecot_plain authenticator failed for (089-101-036159.ntlworld.ie) [89.101.36.159]:40529: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
description:
Feb  4 00:30:22 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
description:
2025-02-04 00:30:24 dovecot_plain authenticator failed for (mitrowdys) [65.20.205.197]:39322: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Feb  4 00:30:26 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.45.216.101
description:
Feb  4 00:31:06 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.45.216.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.124.208.27
description:
Feb  4 00:30:50 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.124.208.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.102.48.217
description:
Feb  4 00:30:50 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.102.48.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.124.94
description:
Feb  4 00:30:58 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.124.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.134.243.37
description:
2025-02-04 00:31:02 dovecot_plain authenticator failed for ([31.134.243.37]) [31.134.243.37]:45446: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.246.43
description:
Feb  4 00:31:03 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.246.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.45.216.101
description:
2025-02-04 00:31:08 dovecot_plain authenticator failed for c-73-45-216-101.hsd1.il.comcast.net [73.45.216.101]:42925: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.99.64
description:
2025-02-04 00:30:21 dovecot_plain authenticator failed for ([116.86.99.64]) [116.86.99.64]:58090: 535 Incorrect authentication data (set_id=eng19b00159y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.148.248.251
description:
Feb  4 00:30:34 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.148.248.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.148.248.251
description:
2025-02-04 00:30:36 dovecot_plain authenticator failed for c188-148-248-251.bredband.tele2.se (opsycnes) [188.148.248.251]:57654: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.48.217
description:
2025-02-04 00:30:52 dovecot_plain authenticator failed for ([112.102.48.217]) [112.102.48.217]:43111: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.243.37
description:
Feb  4 00:31:00 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.243.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.83.26.200
description:
Feb  4 00:31:14 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.83.26.200 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.154.131.115
description:
[2025-02-04 00:30:20 +0100] info [webmaild] 179.154.131.115 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.141.211.58
description:
Feb  4 00:30:40 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.141.211.58 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.73.145.129
description:
[2025-02-04 00:30:41 +0100] info [webmaild] 186.73.145.129 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.102.76.10
description:
2025-02-04 00:30:40 dovecot_login authenticator failed for ([148.102.73.4]) [148.102.76.10]:52630: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
description:
2025-02-04 00:30:42 dovecot_plain authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:58743: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
description:
2025-02-04 00:31:05 dovecot_login authenticator failed for ([220.178.246.43]) [220.178.246.43]:48861: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.101.36.159
description:
Feb  4 00:31:13 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.101.36.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.99.64
description:
Feb  4 00:30:19 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.99.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
description:
2025-02-04 00:30:28 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (perntedism) [94.45.76.149]:35988: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.104
description:
Feb  4 00:30:34 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.158.248.248
description:
Feb  4 00:31:00 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.158.248.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.130.173.74
description:
Feb  4 00:30:34 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.130.173.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.104
description:
2025-02-04 00:30:36 dovecot_plain authenticator failed for 111-70-49-104.emome-ip.hinet.net [111.70.49.104]:55380: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.102.76.10
description:
Feb  4 00:30:38 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.102.76.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.124.208.27
description:
2025-02-04 00:30:52 dovecot_plain authenticator failed for ([220.124.208.27]) [220.124.208.27]:59332: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.83.26.200
description:
2025-02-04 00:31:16 dovecot_plain authenticator failed for ([80.83.26.200]) [80.83.26.200]:37110: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.253.178
description:
Feb  4 00:30:28 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.253.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.178
description:
2025-02-04 00:30:30 dovecot_login authenticator failed for ([116.113.253.178]) [116.113.253.178]:50839: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.130.173.74
description:
2025-02-04 00:30:36 dovecot_plain authenticator failed for (l5-130-173-74.novotelecom.ru) [5.130.173.74]:36268: 535 Incorrect authentication data (set_id=eng19b00159y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.204.13
description:
Feb  4 00:32:14 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.204.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.204.13
description:
2025-02-04 00:32:16 dovecot_plain authenticator failed for vps-45cb66f2.vps.ovh.net [135.125.204.13]:57146: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.113.240.28
description:
Feb  4 00:31:41 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.113.240.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.113.240.28
description:
2025-02-04 00:31:43 dovecot_plain authenticator failed for p169029-obmd01.osaka.ocn.ne.jp [61.113.240.28]:54680: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.216.98
description:
2025-02-04 00:31:50 dovecot_plain authenticator failed for ([61.185.216.98]) [61.185.216.98]:49401: 535 Incorrect authentication data (set_id=ds18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
description:
2025-02-04 00:31:56 dovecot_plain authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:39249: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.132.43.94
description:
Feb  4 00:31:59 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.132.43.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.132.43.94
description:
2025-02-04 00:32:01 dovecot_plain authenticator failed for ([116.132.43.94]) [116.132.43.94]:10996: 535 Incorrect authentication data (set_id=ds18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.45.217.249
description:
Feb  4 00:31:25 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.45.217.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.45.217.249
description:
2025-02-04 00:31:27 dovecot_login authenticator failed for ([14.45.217.249]) [14.45.217.249]:41412: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.216.98
description:
Feb  4 00:31:48 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.216.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.97.253.246
description:
Feb  4 00:31:54 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.97.253.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.73
description:
2025-02-04 00:33:14 dovecot_login authenticator failed for (ADMIN) [156.146.60.73]:51712: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.203.67.146
description:
Feb  4 00:32:20 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.203.67.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.203.67.146
description:
2025-02-04 00:32:22 dovecot_login authenticator failed for ([154.203.67.146]) [154.203.67.146]:54611: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 79.126.115.4
description:
[2025-02-04 00:32:28 +0100] info [webmaild] 79.126.115.4 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.114.180.50
description:
Feb  4 00:32:32 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.114.180.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.180.50
description:
2025-02-04 00:32:34 dovecot_login authenticator failed for ([124.114.180.50]) [124.114.180.50]:34092: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.185.219.67
description:
[2025-02-04 00:32:46 +0100] info [webmaild] 200.185.219.67 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.182.140.127
description:
[2025-02-04 00:33:03 +0100] info [webmaild] 45.182.140.127 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.73.16.145
description:
2025-02-04 00:33:54 dovecot_plain authenticator failed for (adsl.viettel.vn) [115.73.16.145]:45910: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.51.0.170
description:
Feb  4 00:34:03 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.51.0.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.0.170
description:
2025-02-04 00:34:05 dovecot_login authenticator failed for ([179.51.0.170]) [179.51.0.170]:57274: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.51.118.254
description:
[2025-02-04 00:33:17 +0100] info [webmaild] 189.51.118.254 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.228.195.251
description:
Feb  4 00:33:32 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.228.195.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.228.195.251
description:
2025-02-04 00:33:34 dovecot_plain authenticator failed for ([116.228.195.251]) [116.228.195.251]:33496: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 41.216.188.18
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-34.41.216.188.18


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.73.16.145
description:
Feb  4 00:33:52 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.73.16.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.123.33
description:
Feb  4 00:33:54 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.123.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.123.33
description:
2025-02-04 00:33:56 dovecot_login authenticator failed for ([117.176.123.33]) [117.176.123.33]:47656: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.223.192.254
description:
Feb  4 00:35:07 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.223.192.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.192.168
description:
Feb  4 00:35:12 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.192.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
description:
2025-02-04 00:35:16 dovecot_plain authenticator failed for ([90.173.78.90]) [90.173.78.90]:53129: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.124.241.138
description:
Feb  4 00:35:10 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.124.241.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.80.158
description:
Feb  4 00:35:13 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.80.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.151.51.223
description:
2025-02-04 00:35:03 dovecot_plain authenticator failed for customer-ip-193-151-51-223.ipv.net.pl [193.151.51.223]:58582: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.204.108.172
description:
Feb  4 00:35:05 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.204.108.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.10.228
description:
2025-02-04 00:35:06 dovecot_plain authenticator failed for (228.10.245.49.unknown.m1.com.sg) [49.245.10.228]:47116: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.192.168
description:
2025-02-04 00:35:14 dovecot_plain authenticator failed for ([220.80.192.168]) [220.80.192.168]:41146: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.62.67.73
description:
Feb  4 00:34:29 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.62.67.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.246.45.57
description:
Feb  4 00:34:39 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.246.45.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.137
description:
2025-02-04 00:35:11 dovecot_plain authenticator failed for ([178.178.194.137]) [178.178.194.137]:38986: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
description:
Feb  4 00:35:06 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.137
description:
Feb  4 00:35:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.62.67.73
description:
2025-02-04 00:34:31 dovecot_login authenticator failed for ([85.62.67.73]) [85.62.67.73]:39780: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.205.242
description:
Feb  4 00:35:05 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.205.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.39.187.16
description:
2025-02-04 00:35:05 dovecot_plain authenticator failed for ([189.39.187.16]) [189.39.187.16]:44050: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.192.254
description:
2025-02-04 00:35:09 dovecot_plain authenticator failed for ([200.223.193.9]) [200.223.192.254]:47141: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.241.61
description:
Feb  4 00:35:05 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.241.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.241.61
description:
2025-02-04 00:35:07 dovecot_plain authenticator failed for (nsg-corporate-61.241.187.122.airtel.in) [122.187.241.61]:59947: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.10.79.34
description:
Feb  4 00:35:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.10.79.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.173.78.90
description:
Feb  4 00:35:14 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.173.78.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.80.158
description:
2025-02-04 00:35:15 dovecot_plain authenticator failed for ([222.114.80.158]) [222.114.80.158]:42002: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.10.79.34
description:
2025-02-04 00:35:11 dovecot_plain authenticator failed for ([59.10.79.34]) [59.10.79.34]:56334: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.124.241.138
description:
2025-02-04 00:35:12 dovecot_plain authenticator failed for ([116.124.241.138]) [116.124.241.138]:56698: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.245.246.26
description:
Feb  4 00:35:16 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.245.246.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.246.45.57
description:
2025-02-04 00:34:41 dovecot_login authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:49950: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.151.51.223
description:
Feb  4 00:35:01 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.151.51.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
description:
2025-02-04 00:35:08 dovecot_plain authenticator failed for ([121.179.93.147]) [121.179.93.147]:53022: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.204.108.172
description:
2025-02-04 00:35:07 dovecot_plain authenticator failed for ([129.204.108.172]) [129.204.108.172]:41000: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.205.242
description:
2025-02-04 00:35:07 dovecot_plain authenticator failed for ([218.4.205.242]) [218.4.205.242]:51809: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.237.242.224
description:
[2025-02-04 00:34:56 +0100] info [webmaild] 186.237.242.224 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-34.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.10.228
description:
Feb  4 00:35:04 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.10.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.192.17
description:
2025-02-04 00:35:22 dovecot_plain authenticator failed for ([191.59.192.17]) [191.59.192.17]:49312: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.84.241.94
description:
Feb  4 00:35:25 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.84.241.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.70.142
description:
2025-02-04 00:35:26 dovecot_plain authenticator failed for ([218.149.70.142]) [218.149.70.142]:39142: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
description:
2025-02-04 00:35:27 dovecot_plain authenticator failed for ([92.126.223.175]) [92.126.223.175]:42058: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.35.109.214
description:
2025-02-04 00:35:44 dovecot_plain authenticator failed for ([125.35.109.214]) [125.35.109.214]:43359: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.28.66.78
description:
Feb  4 00:35:17 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.28.66.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
description:
2025-02-04 00:35:18 dovecot_plain authenticator failed for ([106.245.246.26]) [106.245.246.26]:48838: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.62.34.216
description:
Feb  4 00:35:29 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.62.34.216 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.45.154.243
description:
[2025-02-04 00:35:31 +0100] info [webmaild] 181.45.154.243 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.118.95.78
description:
Feb  4 00:35:33 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.118.95.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.95.78
description:
2025-02-04 00:35:35 dovecot_plain authenticator failed for ([220.118.95.78]) [220.118.95.78]:44040: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.165.222.12
description:
[2025-02-04 00:35:20 +0100] info [webmaild] 45.165.222.12 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.126.223.175
description:
Feb  4 00:35:25 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.126.223.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
description:
2025-02-04 00:35:25 dovecot_plain authenticator failed for (74-95-13-185-SFBA.hfc.comcastbusiness.net) [74.95.13.185]:58390: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.109
description:
2025-02-04 00:35:25 dovecot_plain authenticator failed for (m121-202-201-109.smartone.com) [121.202.201.109]:48813: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.78.68
description:
Feb  4 00:35:17 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.78.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.244.39
description:
Feb  4 00:35:22 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 44.211.191.117
description:
Feb  4 00:35:22 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 44.211.191.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
description:
2025-02-04 00:35:31 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:54262: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.7.179.219
description:
[2025-02-04 00:35:50 +0100] info [webmaild] 45.7.179.219 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.78.68
description:
2025-02-04 00:35:19 dovecot_plain authenticator failed for 60-249-78-68.hinet-ip.hinet.net [60.249.78.68]:54966: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.192.17
description:
Feb  4 00:35:20 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.192.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 44.211.191.117
description:
2025-02-04 00:35:24 dovecot_plain authenticator failed for ec2-44-211-191-117.compute-1.amazonaws.com [44.211.191.117]:50772: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.147.231
description:
2025-02-04 00:35:35 dovecot_plain authenticator failed for ([191.59.147.231]) [191.59.147.231]:35196: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.109
description:
Feb  4 00:35:23 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.72.244.39
description:
2025-02-04 00:35:24 dovecot_plain authenticator failed for 39.244.72.148.host.secureserver.net [148.72.244.39]:34092: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.28.66.78
description:
2025-02-04 00:35:19 dovecot_plain authenticator failed for ([62.28.66.78]) [62.28.66.78]:52653: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
description:
2025-02-04 00:35:20 dovecot_plain authenticator failed for ([14.54.22.11]) [14.54.22.11]:24858: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.147.231
description:
Feb  4 00:35:33 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.147.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.35.109.214
description:
Feb  4 00:35:42 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.35.109.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.70.142
description:
Feb  4 00:35:24 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.70.142 has been locked due to Imunify RBL


