# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 134.0.179.193
country_id: 286963
description:
[2025-02-06 09:45:44 +0100] info [webmaild] 134.0.179.193 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2025-02-06 09:45:46 dovecot_login authenticator failed for ([182.42.113.10]) [182.42.113.10]:35821: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.4.120.19
country_id: 1814991
description:
2025-02-06 09:45:03 dovecot_plain authenticator failed for ([111.4.120.19]) [111.4.120.19]:50285: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.161.197.130
country_id: 1562822
description:
Feb  6 09:45:07 ait sshd[1086494]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.161.197.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.161.197.130
country_id: 1562822
description:
Feb  6 09:45:07 ait sshd[1086494]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.197.130


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.99.18.192
country_id: 3658394
description:
[2025-02-06 09:46:43 +0100] info [webmaild] 191.99.18.192 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.123.27.87
country_id: 1835841
description:
2025-02-06 09:46:54 dovecot_plain authenticator failed for ([183.123.27.87]) [183.123.27.87]:38248: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.197.236.134
country_id: 3469034
description:
[2025-02-06 09:46:12 +0100] info [webmaild] 179.197.236.134 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.237.54.73
country_id: 3932488
description:
[2025-02-06 09:46:21 +0100] info [webmaild] 190.237.54.73 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.123.27.87
country_id: 1835841
description:
Feb  6 09:46:52 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.123.27.87 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.96.43.215
country_id: 1562822
description:
Feb  6 09:46:21 ait sshd[1087029]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.43.215


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.35
country_id: 1814991
description:
Feb  6 09:46:34 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.242.78
country_id: 1814991
description:
2025-02-06 09:46:40 dovecot_plain authenticator failed for ([120.224.242.78]) [120.224.242.78]:50609: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.29.139
country_id: 1668284
description:
Feb  6 09:46:34 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.29.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.139
country_id: 1668284
description:
2025-02-06 09:46:36 dovecot_plain authenticator failed for 111-70-29-139.emome-ip.hinet.net [111.70.29.139]:54348: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
country_id: 1814991
description:
2025-02-06 09:46:36 dovecot_plain authenticator failed for ([114.242.61.35]) [114.242.61.35]:49596: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.242.78
country_id: 1814991
description:
Feb  6 09:46:38 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.242.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.72.92.174
country_id: 1814991
description:
Feb  6 09:46:50 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.72.92.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
country_id: 1814991
description:
2025-02-06 09:46:52 dovecot_plain authenticator failed for ([125.72.92.174]) [125.72.92.174]:60621: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.96.43.215
country_id: 1562822
description:
Feb  6 09:46:21 ait sshd[1087029]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.96.43.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.219.112.193
country_id: 1814991
description:
Feb  6 09:46:34 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.219.112.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.219.112.193
country_id: 1814991
description:
2025-02-06 09:46:36 dovecot_plain authenticator failed for ([60.219.112.193]) [60.219.112.193]:42737: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.98.10.109
country_id: 690791
description:
2025-02-06 09:47:33 dovecot_plain authenticator failed for ([46.98.10.109]) [46.98.10.109]:60496: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.34.254
country_id: 2017370
description:
2025-02-06 09:47:43 dovecot_plain authenticator failed for broadband-5-228-34-254.ip.moscow.rt.ru [5.228.34.254]:51296: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.248.75.102
country_id: 1861060
description:
Feb  6 09:47:44 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.248.75.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
country_id: 2077456
description:
2025-02-06 09:47:54 dovecot_plain authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:52725: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.245.145.251
country_id: 1814991
description:
2025-02-06 09:46:57 dovecot_plain authenticator failed for ([183.245.145.251]) [183.245.145.251]:37089: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.106.83.59
country_id: 1814991
description:
Feb  6 09:47:29 ait sshd[1087346]: pam_imunify(sshd:auth): [IM360_RBL] The IP 180.106.83.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.45.216.101
country_id: 6252001
description:
Feb  6 09:47:34 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.45.216.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.34.244.190
country_id: 1814991
description:
Feb  6 09:47:36 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.34.244.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
country_id: 2017370
description:
2025-02-06 09:47:36 dovecot_plain authenticator failed for (occurred) [88.87.84.104]:45453: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.59.141.152
country_id: 2017370
description:
2025-02-06 09:47:51 dovecot_plain authenticator failed for ([5.59.141.152]) [5.59.141.152]:51700: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.159.176
country_id: 6252001
description:
2025-02-06 09:47:49 dovecot_plain authenticator failed for (192-3-159-176-host.colocrossing.com) [192.3.159.176]:52180: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.235.246
country_id: 2661886
description:
2025-02-06 09:47:34 dovecot_plain authenticator failed for h77-53-235-246.cust.bredband2.com [77.53.235.246]:37796: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.246.94.219
country_id: 1880251
description:
Feb  6 09:47:36 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.246.94.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
country_id: 1814991
description:
Feb  6 09:47:38 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
country_id: 614540
description:
Feb  6 09:47:45 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.179.123.60
country_id: 1814991
description:
Feb  6 09:47:47 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.179.123.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-02-06 09:47:48 dovecot_plain authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:45342: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.234.219
country_id: 1269750
description:
Feb  6 09:47:35 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.234.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.132.61.213
country_id: 1814991
description:
Feb  6 09:47:36 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.132.61.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.189.211.114
country_id: 1814991
description:
2025-02-06 09:47:44 dovecot_plain authenticator failed for ([222.189.211.114]) [222.189.211.114]:38340: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.127.188
country_id: 1835841
description:
2025-02-06 09:47:49 dovecot_plain authenticator failed for ([114.108.127.188]) [114.108.127.188]:41028: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.98.10.109
country_id: 690791
description:
Feb  6 09:47:31 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.98.10.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.47.20.229
country_id: 1861060
description:
Feb  6 09:47:39 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.47.20.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
country_id: 1814991
description:
2025-02-06 09:47:40 dovecot_plain authenticator failed for ([60.166.31.198]) [60.166.31.198]:46934: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.147.184
country_id: 3469034
description:
2025-02-06 09:47:38 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.147.184]:49691: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.34
country_id: 617790
description:
2025-02-06 09:47:45 dovecot_plain authenticator failed for ([185.167.56.34]) [185.167.56.34]:53906: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.248.75.102
country_id: 1861060
description:
2025-02-06 09:47:46 dovecot_plain authenticator failed for st7014.mas4401.y-tokyo.nttpc.ne.jp [160.248.75.102]:39126: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2025-02-06 09:47:53 dovecot_plain authenticator failed for ([213.230.127.217]) [213.230.127.217]:39298: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.235.246
country_id: 2661886
description:
Feb  6 09:47:32 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.235.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.4.153.7
country_id: 1814991
description:
2025-02-06 09:47:36 dovecot_plain authenticator failed for ([221.4.153.7]) [221.4.153.7]:38418: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.132.61.213
country_id: 1814991
description:
2025-02-06 09:47:38 dovecot_plain authenticator failed for ([124.132.61.213]) [124.132.61.213]:59550: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.117.91.67
country_id: 1835841
description:
Feb  6 09:47:38 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.117.91.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.234.219
country_id: 1269750
description:
2025-02-06 09:47:37 dovecot_plain authenticator failed for (estointernet.in) [103.123.234.219]:53282: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-02-06 09:47:43 dovecot_plain authenticator failed for ([128.106.196.150]) [128.106.196.150]:58035: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
country_id: 614540
description:
2025-02-06 09:47:47 dovecot_plain authenticator failed for (host-80-241-253-238.customer.magticom.ge) [2.57.219.2]:44198: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.126.227
country_id: 1835841
description:
2025-02-06 09:47:47 dovecot_plain authenticator failed for ([114.108.126.227]) [114.108.126.227]:46638: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.35
country_id: 1819730
description:
Feb  6 09:47:06 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
country_id: 2510769
description:
Feb  6 09:47:10 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.45.216.101
country_id: 6252001
description:
2025-02-06 09:47:36 dovecot_plain authenticator failed for c-73-45-216-101.hsd1.il.comcast.net [73.45.216.101]:52852: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.40.10
country_id: 1814991
description:
Feb  6 09:47:50 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.40.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-06 09:47:42 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-176.static.tpgi.com.au) [110.175.220.250]:46853: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.127.188
country_id: 1835841
description:
Feb  6 09:47:47 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.127.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
country_id: 1814991
description:
2025-02-06 09:47:50 dovecot_plain authenticator failed for ([58.216.101.166]) [58.216.101.162]:41104: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.227
country_id: 3469034
description:
Feb  6 09:47:50 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.230.86
country_id: 1814991
description:
Feb  6 09:47:51 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.92.230.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.205.218
country_id: 1269750
description:
2025-02-06 09:47:07 dovecot_plain authenticator failed for ([122.169.205.218]) [122.169.205.218]:41749: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 180.106.83.59
country_id: 1814991
description:
Feb  6 09:47:29 ait sshd[1087346]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.106.83.59


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  6 09:47:40 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.195.73.38
country_id: 1835841
description:
2025-02-06 09:47:51 dovecot_plain authenticator failed for ([175.195.73.38]) [175.195.73.38]:37588: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.54.14
country_id: 3469034
description:
Feb  6 09:47:53 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.227
country_id: 3469034
description:
2025-02-06 09:47:52 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.227]:34692: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.91.74.187
country_id: 1269750
description:
Feb  6 09:47:54 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.91.74.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
country_id: 2017370
description:
Feb  6 09:47:34 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.20.229
country_id: 1861060
description:
2025-02-06 09:47:41 dovecot_plain authenticator failed for ([92.202.82.102]) [154.47.20.229]:41434: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-02-06 09:47:52 dovecot_plain authenticator failed for ([194.31.8.12]) [194.31.8.12]:60506: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.144.187.114
country_id: 130758
description:
Feb  6 09:47:40 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.144.187.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.146.186.122
country_id: 1835841
description:
2025-02-06 09:47:49 dovecot_plain authenticator failed for ([221.146.186.122]) [221.146.186.122]:59444: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.92.230.86
country_id: 1814991
description:
2025-02-06 09:47:53 dovecot_plain authenticator failed for ([218.92.230.86]) [218.92.230.86]:57042: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.245.145.251
country_id: 1814991
description:
Feb  6 09:46:55 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.245.145.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2025-02-06 09:47:37 dovecot_plain authenticator failed for ([121.202.138.181]) [121.202.138.181]:53466: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.94.219
country_id: 1880251
description:
2025-02-06 09:47:38 dovecot_plain authenticator failed for ([124.246.94.219]) [124.246.94.219]:54925: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.34.254
country_id: 2017370
description:
Feb  6 09:47:41 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.34.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.189.211.114
country_id: 1814991
description:
Feb  6 09:47:42 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.189.211.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.126.227
country_id: 1835841
description:
Feb  6 09:47:45 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.126.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.63
country_id: 1819730
description:
2025-02-06 09:47:48 dovecot_plain authenticator failed for (m121-202-154-63.smartone.com) [121.202.154.63]:56022: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
country_id: 2510769
description:
2025-02-06 09:47:12 dovecot_plain authenticator failed for (reated) [91.116.42.218]:56814: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
country_id: 1835841
description:
Feb  6 09:47:38 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.247.88
country_id: 1814991
description:
2025-02-06 09:47:39 dovecot_plain authenticator failed for ([183.220.247.88]) [183.220.247.88]:46486: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.4.153.7
country_id: 1814991
description:
Feb  6 09:47:34 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.4.153.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
country_id: 2077456
description:
Feb  6 09:47:52 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.205.218
country_id: 1269750
description:
Feb  6 09:47:05 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.205.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.8.11.36
country_id: 1835841
description:
Feb  6 09:47:17 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.8.11.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.69.178.104
country_id: 3017382
description:
Feb  6 09:47:32 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.69.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.144.187.114
country_id: 130758
description:
2025-02-06 09:47:42 dovecot_plain authenticator failed for ([89.144.187.114]) [89.144.187.114]:54280: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
country_id: 102358
description:
Feb  6 09:47:53 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.247.88
country_id: 1814991
description:
Feb  6 09:47:37 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.247.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.117.91.67
country_id: 1835841
description:
2025-02-06 09:47:40 dovecot_plain authenticator failed for ([220.117.91.67]) [220.117.91.67]:46564: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
country_id: 1835841
description:
2025-02-06 09:47:40 dovecot_plain authenticator failed for ([61.81.151.97]) [61.81.151.97]:60680: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.63
country_id: 1819730
description:
Feb  6 09:47:46 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
country_id: 3144096
description:
Feb  6 09:47:46 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.3.159.176
country_id: 6252001
description:
Feb  6 09:47:47 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.3.159.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.59.141.152
country_id: 2017370
description:
Feb  6 09:47:49 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.59.141.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.35
country_id: 1819730
description:
2025-02-06 09:47:08 dovecot_plain authenticator failed for (m121-202-152-35.smartone.com) [121.202.152.35]:49363: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.11.36
country_id: 1835841
description:
2025-02-06 09:47:19 dovecot_plain authenticator failed for ([59.8.11.36]) [59.8.11.36]:50758: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.201.37.210
country_id: 6252001
description:
2025-02-06 09:47:36 dovecot_plain authenticator failed for ([50.201.37.210]) [50.201.37.210]:58288: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.195.73.38
country_id: 1835841
description:
Feb  6 09:47:49 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.195.73.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
country_id: 226074
description:
Feb  6 09:47:52 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-02-06 09:47:54 dovecot_plain authenticator failed for ([41.220.3.113]) [41.220.3.101]:35573: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.186.122
country_id: 1835841
description:
Feb  6 09:47:47 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.186.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
country_id: 1814991
description:
Feb  6 09:47:48 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.127.217
country_id: 1512440
description:
Feb  6 09:47:51 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.127.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.40.10
country_id: 1814991
description:
2025-02-06 09:47:52 dovecot_plain authenticator failed for ([112.6.73.140]) [221.2.40.10]:35840: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.201.37.210
country_id: 6252001
description:
Feb  6 09:47:34 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.201.37.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
country_id: 3017382
description:
2025-02-06 09:47:34 dovecot_plain authenticator failed for 104.178.69.85.rev.sfr.net [85.69.178.104]:55622: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.147.184
country_id: 3469034
description:
Feb  6 09:47:36 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.147.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.31.8.12
country_id: 614540
description:
Feb  6 09:47:50 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.31.8.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.179.123.60
country_id: 1814991
description:
2025-02-06 09:47:49 dovecot_plain authenticator failed for ([163.179.123.60]) [163.179.123.60]:46280: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.34.244.190
country_id: 1814991
description:
2025-02-06 09:47:38 dovecot_plain authenticator failed for ([36.34.244.190]) [36.34.244.190]:57685: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
country_id: 1880251
description:
Feb  6 09:47:41 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.34
country_id: 617790
description:
Feb  6 09:47:43 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.34 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.131.107.122
country_id: 290291
description:
[2025-02-06 09:48:15 +0100] info [webmaild] 37.131.107.122 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2025-02-06 09:48:42 dovecot_plain authenticator failed for ([61.72.59.106]) [61.72.59.106]:36941: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
country_id: 3469034
description:
Feb  6 09:47:55 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.173.10.75
country_id: 6252001
description:
Feb  6 09:47:55 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.173.10.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.127.197.89
country_id: 3469034
description:
Feb  6 09:48:12 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.127.197.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.71.106
country_id: 1269750
description:
Feb  6 09:48:14 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.71.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.115.125
country_id: 6252001
description:
Feb  6 09:48:16 ait sshd[1087642]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.115.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.170.76
country_id: 1835841
description:
2025-02-06 09:47:57 dovecot_plain authenticator failed for ([218.149.170.76]) [218.149.170.76]:40367: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.28.18
country_id: 1168579
description:
2025-02-06 09:48:07 dovecot_plain authenticator failed for ([210.56.28.18]) [210.56.28.18]:59078: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.47.48.178
country_id: 1814991
description:
2025-02-06 09:48:07 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:43659: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.109.127.195
country_id: 1819730
description:
2025-02-06 09:48:07 dovecot_plain authenticator failed for ([39.109.127.195]) [39.109.127.195]:45958: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 39.62.176.44
country_id: 1168579
description:
[2025-02-06 09:48:40 +0100] info [webmaild] 39.62.176.44 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.54.14
country_id: 3469034
description:
2025-02-06 09:47:55 dovecot_plain authenticator failed for ([200.141.225.73]) [200.149.54.14]:46627: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.49.250
country_id: 1814991
description:
Feb  6 09:47:57 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
country_id: 3469034
description:
2025-02-06 09:47:57 dovecot_plain authenticator failed for (18712549.telemar.net.br) [187.76.174.254]:35519: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.69.115.74
country_id: 1814991
description:
2025-02-06 09:48:18 dovecot_plain authenticator failed for ([218.69.115.74]) [218.69.115.74]:42793: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.59.99
country_id: 1880251
description:
47.128.59.99 - - [06/Feb/2025:09:48:26 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17059174 HTTP/1.1" 302 0 jaster.us "http://jaster.us/index.php?option=com_content&view=article&id=184&Itemid=217&showall=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.59.99


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
country_id: 1835841
description:
Feb  6 09:48:40 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.91.74.187
country_id: 1269750
description:
2025-02-06 09:47:56 dovecot_plain authenticator failed for ([103.91.74.187]) [103.91.74.187]:38493: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.197.40
country_id: 1819730
description:
Feb  6 09:48:01 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.197.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.197.40
country_id: 1819730
description:
2025-02-06 09:48:03 dovecot_plain authenticator failed for (m121-202-197-40.smartone.com) [121.202.197.40]:11078: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.252.225
country_id: 6252001
description:
2025-02-06 09:48:08 dovecot_plain authenticator failed for syn-076-176-252-225.res.spectrum.com [76.176.252.225]:55730: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.127.197.89
country_id: 3469034
description:
2025-02-06 09:48:14 dovecot_plain authenticator failed for (179.127.197.89.afinet.com.br) [179.127.197.89]:55285: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.175.251.119
country_id: 3469034
description:
[2025-02-06 09:48:50 +0100] info [webmaild] 45.175.251.119 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
country_id: 6252001
description:
Feb  6 09:47:58 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.49.250
country_id: 1814991
description:
2025-02-06 09:47:59 dovecot_plain authenticator failed for ([58.16.49.250]) [58.16.49.250]:40635: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-02-06 09:48:00 dovecot_plain authenticator failed for ([216.194.174.80]) [216.194.174.27]:13559: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.56.28.18
country_id: 1168579
description:
Feb  6 09:48:05 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.56.28.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.109.127.195
country_id: 1819730
description:
Feb  6 09:48:05 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.109.127.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2025-02-06 09:47:57 dovecot_plain authenticator failed for ([209.173.10.75]) [209.173.10.75]:55274: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.115.125
country_id: 6252001
description:
Feb  6 09:48:16 ait sshd[1087642]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.115.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
country_id: 102358
description:
2025-02-06 09:47:55 dovecot_plain authenticator failed for ([37.224.119.19]) [37.224.119.19]:55408: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.47.48.178
country_id: 1814991
description:
Feb  6 09:48:05 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.47.48.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.252.225
country_id: 6252001
description:
Feb  6 09:48:06 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.252.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.71.106
country_id: 1269750
description:
2025-02-06 09:48:16 dovecot_plain authenticator failed for (abts-kk-static-106.71.166.122.airtelbroadband.in) [122.166.71.106]:58504: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.69.115.74
country_id: 1814991
description:
Feb  6 09:48:16 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.69.115.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.254
country_id: 1269750
description:
2025-02-06 09:49:22 dovecot_plain authenticator failed for (nsg-corporate-254.230.187.122.airtel.in) [122.187.230.254]:55720: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.31.219
country_id: 1643084
description:
Feb  6 09:49:30 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.31.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.31.219
country_id: 1643084
description:
2025-02-06 09:49:32 dovecot_plain authenticator failed for ([103.115.31.219]) [103.115.31.219]:33412: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.118.112.230
country_id: 6252001
description:
Feb  6 09:49:39 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.118.112.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
country_id: 6252001
description:
2025-02-06 09:49:41 dovecot_plain authenticator failed for syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:54627: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 2.134.31.58
country_id: 1522867
description:
[2025-02-06 09:49:14 +0100] info [webmaild] 2.134.31.58 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.254
country_id: 1269750
description:
Feb  6 09:49:20 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.145.221.21
country_id: 1814991
description:
2025-02-06 09:50:00 dovecot_plain authenticator failed for ([219.145.221.21]) [219.145.221.21]:41946: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.110.77
country_id: 6252001
description:
Feb  6 09:50:39 ait sshd[1088586]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.110.77 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.110.77
country_id: 6252001
description:
Feb  6 09:50:39 ait sshd[1088586]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.110.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-02-06 09:50:06 dovecot_login authenticator failed for (62-73-121-209.btc-net.bg) [62.73.121.209]:45436: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.192.79.179
country_id: 3865483
description:
2025-02-06 09:50:18 dovecot_login authenticator failed for (pppoe-179.79.192.181.in-addr.arpa) [181.192.79.179]:52676: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.51.222.234
country_id: 2264397
description:
2025-02-06 09:50:18 dovecot_plain authenticator failed for a109-51-222-234.cpe.netcabo.pt [109.51.222.234]:44136: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.99.89.74
country_id: 1835841
description:
Feb  6 09:50:22 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.99.89.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.206.153
country_id: 6252001
description:
Feb  6 09:50:23 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.206.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2025-02-06 09:50:24 dovecot_plain authenticator failed for ([183.99.89.74]) [183.99.89.74]:44742: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 09:50:32 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.69.142.186
country_id: 2077456
description:
2025-02-06 09:50:09 dovecot_plain authenticator failed for 61-69-142-186.tpgi.com.au [61.69.142.186]:56365: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.10.228
country_id: 1880251
description:
Feb  6 09:50:26 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.10.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.10.228
country_id: 1880251
description:
2025-02-06 09:50:28 dovecot_plain authenticator failed for (228.10.245.49.unknown.m1.com.sg) [49.245.10.228]:52418: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.201.140.227
country_id: 1831722
description:
2025-02-06 09:50:31 dovecot_plain authenticator failed for ([45.201.140.227]) [45.201.140.227]:12562: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.232.19.79
country_id: 2750405
description:
Feb  6 09:50:46 ait sshd[1088592]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.232.19.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
country_id: 1562822
description:
2025-02-06 09:50:02 dovecot_plain authenticator failed for ([171.244.63.170]) [171.244.63.170]:8414: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.192.79.179
country_id: 3865483
description:
Feb  6 09:50:16 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.192.79.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.206.153
country_id: 6252001
description:
2025-02-06 09:50:25 dovecot_plain authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:48259: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
country_id: 2077456
description:
Feb  6 09:50:34 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.201.140.227
country_id: 1831722
description:
Feb  6 09:50:29 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.201.140.227 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.57.217.38
country_id: 1643084
description:
Feb  6 09:50:30 ait sshd[1088300]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.57.217.38


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.69.142.186
country_id: 2077456
description:
Feb  6 09:50:07 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.69.142.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.57.217.38
country_id: 1643084
description:
Feb  6 09:50:30 ait sshd[1088300]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.57.217.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
country_id: 2077456
description:
2025-02-06 09:50:36 dovecot_plain authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:36258: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.145.221.21
country_id: 1814991
description:
Feb  6 09:49:58 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.145.221.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
country_id: 1562822
description:
Feb  6 09:50:00 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.51.222.234
country_id: 2264397
description:
Feb  6 09:50:16 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.51.222.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.232.19.79
country_id: 2750405
description:
Feb  6 09:50:46 ait sshd[1088592]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.232.19.79


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.25
country_id: 1819730
description:
2025-02-06 09:51:17 dovecot_plain authenticator failed for ([121.202.154.25]) [121.202.154.25]:27037: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.174.3.182
country_id: 2658434
description:
Feb  6 09:51:01 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.174.3.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.153.68.238
country_id: 1562822
description:
Feb  6 09:51:02 ait sshd[1088711]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.153.68.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.174.3.182
country_id: 2658434
description:
2025-02-06 09:51:03 dovecot_plain authenticator failed for 182.3.174.178.static.wline.lns.sme.cust.swisscom.ch [178.174.3.182]:38720: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
country_id: 1269750
description:
2025-02-06 09:51:29 dovecot_plain authenticator failed for ([49.249.76.221]) [49.249.76.221]:54070: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.220.168.116
country_id: 2017370
description:
Feb  6 09:51:38 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.220.168.116 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.209.62.18
country_id: 3469034
description:
[2025-02-06 09:51:37 +0100] info [webmaild] 186.209.62.18 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.220.168.116
country_id: 2017370
description:
2025-02-06 09:51:40 dovecot_plain authenticator failed for ([31.220.168.116]) [31.220.168.116]:60418: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.153.68.238
country_id: 1562822
description:
Feb  6 09:51:02 ait sshd[1088711]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.153.68.238


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.184.216.253
country_id: 3469034
description:
[2025-02-06 09:51:07 +0100] info [webmaild] 45.184.216.253 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.249.76.221
country_id: 1269750
description:
Feb  6 09:51:27 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.249.76.221 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.191.222.89
country_id: 3469034
description:
[2025-02-06 09:50:57 +0100] info [webmaild] 179.191.222.89 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.25
country_id: 1819730
description:
Feb  6 09:51:15 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.25 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.205.243.27
country_id: 3469034
description:
[2025-02-06 09:51:31 +0100] info [webmaild] 168.205.243.27 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 180.106.83.59
country_id: 1814991
description:
Feb  6 09:52:19 ait sshd[1089088]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.106.83.59


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.21.36.111
country_id: 1814991
description:
Feb  6 09:52:07 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.21.36.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.106.83.59
country_id: 1814991
description:
Feb  6 09:52:19 ait sshd[1089088]: pam_imunify(sshd:auth): [IM360_RBL] The IP 180.106.83.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-02-06 09:51:58 dovecot_plain authenticator failed for ([196.191.212.226]) [213.55.85.202]:2949: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 09:52:21 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.97.219.60
country_id: 1269750
description:
Feb  6 09:52:32 ait sshd[1089125]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.97.219.60


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
country_id: 337996
description:
Feb  6 09:51:56 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
country_id: 2017370
description:
Feb  6 09:52:06 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
country_id: 2017370
description:
2025-02-06 09:52:08 dovecot_plain authenticator failed for (noilbele) [77.51.214.170]:55900: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.97.219.60
country_id: 1269750
description:
Feb  6 09:52:32 ait sshd[1089125]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.97.219.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.21.36.111
country_id: 1814991
description:
2025-02-06 09:52:09 dovecot_plain authenticator failed for ([14.21.36.111]) [14.21.36.111]:55806: 535 Incorrect authentication data (set_id=abs1)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 101.132.192.230
country_id: 1814991
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:09-52.101.132.192.230


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2025-02-06 09:53:40 dovecot_login authenticator failed for ([46.161.196.5]) [46.161.196.5]:36846: 535 Incorrect authentication data (set_id=ixlqnabzu@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.4.255.205
country_id: 1835841
description:
2025-02-06 09:53:05 dovecot_plain authenticator failed for ([59.4.255.205]) [59.4.255.205]:54787: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.106.83.59
country_id: 1814991
description:
Feb  6 09:53:32 ait sshd[1089556]: pam_imunify(sshd:auth): [IM360_RBL] The IP 180.106.83.59 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 180.106.83.59
country_id: 1814991
description:
Feb  6 09:53:34 ait sshd[1089556]: Failed password for invalid user user1 from 180.106.83.59 port 59125 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.161.196.5
country_id: 99237
description:
Feb  6 09:53:38 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.161.196.5 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.126.14.159
country_id: 3895114
description:
[2025-02-06 09:53:43 +0100] info [webmaild] 191.126.14.159 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.4.255.205
country_id: 1835841
description:
Feb  6 09:53:03 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.4.255.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.205.188.80
country_id: 1835841
description:
2025-02-06 09:53:21 dovecot_plain authenticator failed for ([119.205.188.80]) [119.205.188.80]:50696: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 180.106.83.59
country_id: 1814991
description:
Feb  6 09:53:32 ait sshd[1089556]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.106.83.59


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.188.80
country_id: 1835841
description:
Feb  6 09:53:19 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.205.188.80 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 147.236.230.39
country_id: 294640
description:
[2025-02-06 09:53:38 +0100] info [webmaild] 147.236.230.39 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.126.21.209
country_id: 1814991
description:
Feb  6 09:54:19 ait sshd[1089939]: pam_imunify(sshd:auth): [IM360_RBL] The IP 101.126.21.209 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.21.209
country_id: 1814991
description:
Feb  6 09:54:19 ait sshd[1089939]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.21.209


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.82
country_id: 1835841
description:
Feb  6 09:53:55 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.82
country_id: 1835841
description:
2025-02-06 09:53:57 dovecot_login authenticator failed for ([58.230.236.82]) [58.230.236.82]:44522: 535 Incorrect authentication data (set_id=ixlqnabzu)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.199.54.59
country_id: 3658394
description:
[2025-02-06 09:54:07 +0100] info [webmaild] 181.199.54.59 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.243.72.253
country_id: 298795
description:
[2025-02-06 09:54:15 +0100] info [webmaild] 88.243.72.253 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.246.52.218
country_id: 3144096
description:
Feb  6 09:55:45 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.246.52.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.246.52.218
country_id: 3144096
description:
2025-02-06 09:55:47 dovecot_plain authenticator failed for 94-246-52.218.3p.ntebredband.no (dequity) [94.246.52.218]:55310: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.50.120.215
country_id: 1814991
description:
Feb  6 09:55:47 ait sshd[1090821]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.50.120.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.50.120.215
country_id: 1814991
description:
Feb  6 09:55:47 ait sshd[1090821]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.120.215


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.109.4.133
country_id: 2017370
description:
Feb  6 09:56:39 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.109.4.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
country_id: 1512440
description:
2025-02-06 09:56:41 dovecot_plain authenticator failed for ([213.230.65.53]) [213.230.65.53]:39060: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.127.143.140
country_id: 1835841
description:
2025-02-06 09:56:45 dovecot_plain authenticator failed for ([116.127.143.140]) [116.127.143.140]:53434: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2025-02-06 09:56:28 dovecot_plain authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:37473: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
country_id: 2510769
description:
2025-02-06 09:56:40 dovecot_plain authenticator failed for ([77.211.31.222]) [77.211.31.222]:57726: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.100
country_id: 1819730
description:
Feb  6 09:56:48 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.100
country_id: 1819730
description:
2025-02-06 09:56:50 dovecot_plain authenticator failed for (m121-202-154-100.smartone.com) [121.202.154.100]:24959: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.4.133
country_id: 2017370
description:
2025-02-06 09:56:41 dovecot_plain authenticator failed for 89-109-4-133.dynamic.mts-nn.ru [89.109.4.133]:47627: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
country_id: 3469034
description:
Feb  6 09:56:53 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.152.225.154
country_id: 6251999
description:
Feb  6 09:56:26 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.152.225.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.26.101.77
country_id: 1814991
description:
Feb  6 09:56:43 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.26.101.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.46.45.121
country_id: 290557
description:
Feb  6 09:56:13 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.46.45.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.87.122.207
country_id: 1880251
description:
2025-02-06 09:56:44 dovecot_plain authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:53270: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 09:56:02 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.172.46.10
country_id: 6252001
description:
Feb  6 09:56:26 ait sshd[1090926]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.172.46.10


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.186.17.150
country_id: 6252001
description:
Feb  6 09:56:40 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.186.17.150 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.95.170.164
country_id: 3469034
description:
[2025-02-06 09:56:46 +0100] info [webmaild] 179.95.170.164 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.117.144.194
country_id: 1835841
description:
Feb  6 09:56:42 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.117.144.194 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.206.62.8
country_id: 1512440
description:
[2025-02-06 09:56:18 +0100] info [webmaild] 213.206.62.8 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.211.31.222
country_id: 2510769
description:
Feb  6 09:56:38 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.211.31.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.219.112.193
country_id: 1814991
description:
Feb  6 09:56:54 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.219.112.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.248.1.199
country_id: 3144096
description:
Feb  6 09:56:45 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.248.1.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.248.1.199
country_id: 3144096
description:
2025-02-06 09:56:47 dovecot_plain authenticator failed for ([87.248.1.199]) [87.248.1.199]:51686: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
country_id: 3469034
description:
2025-02-06 09:56:55 dovecot_plain authenticator failed for ([200.205.133.193]) [187.8.163.70]:51156: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.65.53
country_id: 1512440
description:
Feb  6 09:56:39 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.65.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
country_id: 1835841
description:
2025-02-06 09:56:47 dovecot_plain authenticator failed for ([211.104.166.110]) [211.104.166.110]:59340: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.227.118
country_id: 1835841
description:
2025-02-06 09:56:55 dovecot_plain authenticator failed for ([14.48.227.118]) [14.48.227.118]:37676: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2025-02-06 09:56:15 dovecot_plain authenticator failed for ([20.46.45.121]) [20.46.45.121]:55218: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.172.46.10
country_id: 6252001
description:
Feb  6 09:56:26 ait sshd[1090926]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.172.46.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.227.56.119
country_id: 3469034
description:
[2025-02-06 09:56:48 +0100] info [webmaild] 45.227.56.119 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.153.143
country_id: 1819730
description:
Feb  6 09:56:41 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.153.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.87.122.207
country_id: 1880251
description:
Feb  6 09:56:42 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.87.122.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.186.17.150
country_id: 6252001
description:
2025-02-06 09:56:42 dovecot_plain authenticator failed for ([162.186.17.150]) [162.186.17.150]:52154: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.117.144.194
country_id: 1835841
description:
2025-02-06 09:56:44 dovecot_plain authenticator failed for ([211.117.144.194]) [211.117.144.194]:48358: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.104.166.110
country_id: 1835841
description:
Feb  6 09:56:45 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.104.166.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.227.118
country_id: 1835841
description:
Feb  6 09:56:53 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.227.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.93.197.8
country_id: 3865483
description:
[2025-02-06 09:56:13 +0100] info [webmaild] 190.93.197.8 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.127.143.140
country_id: 1835841
description:
Feb  6 09:56:43 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.127.143.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.26.101.77
country_id: 1814991
description:
2025-02-06 09:56:45 dovecot_plain authenticator failed for ([112.26.101.77]) [112.26.101.77]:40570: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2025-02-06 09:56:43 dovecot_plain authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:50764: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.219.112.193
country_id: 1814991
description:
2025-02-06 09:56:56 dovecot_plain authenticator failed for ([60.219.112.193]) [60.219.112.193]:48180: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.144.187.114
country_id: 130758
description:
2025-02-06 09:57:11 dovecot_plain authenticator failed for ([89.144.187.114]) [89.144.187.114]:57819: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.136.29.20
country_id: 1835841
description:
2025-02-06 09:57:03 dovecot_plain authenticator failed for ([124.136.29.20]) [124.136.29.20]:38187: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.41.103
country_id: 1814991
description:
Feb  6 09:57:30 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.41.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.89.60.158
country_id: 1814991
description:
2025-02-06 09:56:59 dovecot_plain authenticator failed for ([124.89.60.158]) [124.89.60.158]:53409: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.85.137
country_id: 3469034
description:
Feb  6 09:56:59 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.85.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.144.187.114
country_id: 130758
description:
Feb  6 09:57:09 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.144.187.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.45.45.69
country_id: 1861060
description:
2025-02-06 09:57:15 dovecot_plain authenticator failed for p385070-obmd01.tokyo.ocn.ne.jp [60.45.45.69]:34805: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.175.8.140
country_id: 1835841
description:
2025-02-06 09:57:05 dovecot_plain authenticator failed for ([121.175.8.140]) [121.175.8.140]:49566: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.239.187.13
country_id: 1819730
description:
2025-02-06 09:57:08 dovecot_plain authenticator failed for ([20.239.187.13]) [20.239.187.13]:33508: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 196.11.86.151
country_id: 927384
description:
Feb  6 09:57:18 ait sshd[1091297]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.11.86.151  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 09:57:37 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.175.8.140
country_id: 1835841
description:
Feb  6 09:57:03 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.175.8.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.151.71.8
country_id: 1522867
description:
Feb  6 09:57:08 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.151.71.8 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.57.182
country_id: 1880251
description:
47.128.57.182 - - [06/Feb/2025:09:57:09 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11982513 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/2/?duration=short%2Clong&filter_course-language=79&filtering=1&instructor=2&level=beginner%2Cintermediate" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.57.182


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.71.8
country_id: 1522867
description:
2025-02-06 09:57:10 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:55831: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.121.199.203
country_id: 6252001
description:
Feb  6 09:56:57 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.121.199.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.65.68
country_id: 1835841
description:
2025-02-06 09:57:03 dovecot_plain authenticator failed for ([59.8.65.68]) [59.8.65.68]:58141: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 09:57:54 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 09:56:56 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.189
country_id: 1814991
description:
2025-02-06 09:57:02 dovecot_plain authenticator failed for ([60.167.19.189]) [60.167.19.189]:57919: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.85.137
country_id: 3469034
description:
2025-02-06 09:57:01 dovecot_plain authenticator failed for ([177.174.85.129]) [177.174.85.137]:51341: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.136.29.20
country_id: 1835841
description:
Feb  6 09:57:01 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.136.29.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.41.103
country_id: 1814991
description:
2025-02-06 09:57:32 dovecot_plain authenticator failed for ([60.172.41.103]) [60.172.41.103]:51603: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.239.222
country_id: 1835841
description:
2025-02-06 09:56:59 dovecot_plain authenticator failed for ([175.207.239.222]) [175.207.239.222]:58019: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.189
country_id: 1814991
description:
Feb  6 09:57:00 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.207.239.222
country_id: 1835841
description:
Feb  6 09:56:57 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.207.239.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.202.206.163
country_id: 3996063
description:
2025-02-06 09:56:59 dovecot_plain authenticator failed for 163.189-202-206.bestelclientes.com.mx [189.202.206.163]:58242: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
country_id: 6252001
description:
2025-02-06 09:56:59 dovecot_plain authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:55738: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.8.65.68
country_id: 1835841
description:
Feb  6 09:57:01 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.8.65.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.239.187.13
country_id: 1819730
description:
Feb  6 09:57:06 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.239.187.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.89.60.158
country_id: 1814991
description:
Feb  6 09:56:57 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.89.60.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.202.206.163
country_id: 3996063
description:
Feb  6 09:56:57 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.202.206.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.35.199.239
country_id: 2635167
description:
Feb  6 09:58:36 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.35.199.239 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-58.80.76.51.123


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
country_id: 6252001
description:
Feb  6 09:58:44 ait sshd[1091923]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
country_id: 6252001
description:
Feb  6 09:58:44 ait sshd[1091923]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.10.69
country_id: 1880251
description:
Feb  6 09:58:03 ait sshd[1091678]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.10.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.35.199.239
country_id: 2635167
description:
2025-02-06 09:58:38 dovecot_plain authenticator failed for ([89.35.199.239]) [89.35.199.239]:50642: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.109.10.69
country_id: 1880251
description:
Feb  6 09:58:03 ait sshd[1091678]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.109.10.69 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.97.124.176
country_id: 290557
description:
[2025-02-06 09:58:57 +0100] info [webmaild] 92.97.124.176 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.18.64.181
country_id: 587116
description:
[2025-02-06 09:58:59 +0100] info [webmaild] 46.18.64.181 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.127.188
country_id: 1835841
description:
2025-02-06 09:58:58 dovecot_plain authenticator failed for ([114.108.127.188]) [114.108.127.188]:33208: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.40.10
country_id: 1814991
description:
2025-02-06 09:59:41 dovecot_plain authenticator failed for ([112.6.73.140]) [221.2.40.10]:52494: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.127.188
country_id: 1835841
description:
Feb  6 09:58:56 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.127.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2025-02-06 09:59:27 dovecot_plain authenticator failed for ([175.206.113.91]) [175.206.113.91]:35036: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
country_id: 99237
description:
Feb  6 09:59:35 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.40.10
country_id: 1814991
description:
Feb  6 09:59:39 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.40.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.47
country_id: 2017370
description:
2025-02-06 09:59:27 dovecot_plain authenticator failed for ([178.178.222.47]) [178.178.222.47]:47892: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.139.73.227
country_id: 3996063
description:
[2025-02-06 09:59:32 +0100] info [webmaild] 187.139.73.227 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-02-06 09:59:37 dovecot_plain authenticator failed for ([65.20.205.197]) [65.20.205.197]:38713: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.113.91
country_id: 1835841
description:
Feb  6 09:59:25 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.113.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.47
country_id: 2017370
description:
Feb  6 09:59:25 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.47 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.90.35.41
country_id: 192950
description:
[2025-02-06 09:59:26 +0100] info [webmaild] 41.90.35.41 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.236.46.74
country_id: 1835841
description:
Feb  6 10:00:50 ait sshd[1093108]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.236.46.74


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.204.204.78
country_id: 1522867
description:
2025-02-06 10:00:04 dovecot_plain authenticator failed for ([88.204.204.78]) [88.204.204.78]:39359: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.28.145
country_id: 1668284
description:
Feb  6 10:00:17 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.28.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.236.46.74
country_id: 1835841
description:
Feb  6 10:00:50 ait sshd[1093108]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.236.46.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.145
country_id: 1668284
description:
2025-02-06 10:00:19 dovecot_plain authenticator failed for 111-70-28-145.emome-ip.hinet.net [111.70.28.145]:43038: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.238.48.138
country_id: 3469034
description:
[2025-02-06 10:01:33 +0100] info [webmaild] 170.238.48.138 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.152.174.155
country_id: 3469034
description:
[2025-02-06 10:01:47 +0100] info [webmaild] 179.152.174.155 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 10:01:27 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.13.21.246
country_id: 1210997
description:
Feb  6 10:01:40 ait sshd[1093425]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.13.21.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.13.21.246
country_id: 1210997
description:
Feb  6 10:01:40 ait sshd[1093425]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.13.21.246


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.225.55.98
country_id: 1814991
description:
Feb  6 10:02:35 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.225.55.98 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.39.54
country_id: 6252001
description:
Feb  6 10:02:31 ait sshd[1094024]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.39.54


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.209.131.193
country_id: 3625428
description:
[2025-02-06 10:02:21 +0100] info [webmaild] 201.209.131.193 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.172.129.199
country_id: 1605651
description:
Feb  6 10:02:21 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.172.129.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.129.199
country_id: 1605651
description:
2025-02-06 10:02:23 dovecot_plain authenticator failed for ([203.172.129.199]) [203.172.129.199]:47313: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.239.165.120
country_id: 1643084
description:
Feb  6 10:02:25 ait sshd[1093951]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.239.165.120 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.239.165.120
country_id: 1643084
description:
Feb  6 10:02:25 ait sshd[1093951]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.239.165.120


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.196.84.42
country_id: 2017370
description:
[2025-02-06 10:02:00 +0100] info [webmaild] 91.196.84.42 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.109.39.54
country_id: 6252001
description:
Feb  6 10:02:31 ait sshd[1094024]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.109.39.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.55.98
country_id: 1814991
description:
2025-02-06 10:02:37 dovecot_plain authenticator failed for ([122.225.55.98]) [122.225.55.98]:37610: 535 Incorrect authentication data (set_id=efreeman)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.148.43
country_id: 1835841
description:
Feb  6 10:03:48 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.148.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.148.43
country_id: 1835841
description:
2025-02-06 10:03:50 dovecot_login authenticator failed for ([183.109.148.43]) [183.109.148.43]:37666: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.17.122
country_id: 1814991
description:
2025-02-06 10:04:34 dovecot_plain authenticator failed for ([220.182.17.122]) [220.182.17.122]:59714: 535 Incorrect authentication data (set_id=wilfri17)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.182.71.73
country_id: 3017382
description:
Feb  6 10:04:37 ait sshd[1094752]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.182.71.73 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.182.71.73
country_id: 3017382
description:
Feb  6 10:04:37 ait sshd[1094752]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.182.71.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.3.252
country_id: 6252001
description:
2025-02-06 10:04:38 dovecot_login authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:59182: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.72.153.14
country_id: 6252001
description:
Feb  6 10:04:07 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.72.153.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.28.75.227
country_id: 3923057
description:
[2025-02-06 10:04:23 +0100] info [webmaild] 189.28.75.227 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.196.43.147
country_id: 3469034
description:
[2025-02-06 10:04:34 +0100] info [webmaild] 131.196.43.147 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.114.61.50
country_id: 2750405
description:
Feb  6 10:04:38 ait sshd[1094756]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.114.61.50 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.124.148
country_id: 1880251
description:
47.128.124.148 - - [06/Feb/2025:10:04:26 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10760076 HTTP/1.1" 302 0 jaster.us "http://jaster.us/index.php?option=com_content&view=article&id=184&Itemid=222&showall=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.124.148


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.17.122
country_id: 1814991
description:
Feb  6 10:04:32 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.17.122 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.114.61.50
country_id: 2750405
description:
Feb  6 10:04:38 ait sshd[1094756]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.114.61.50


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.72.209
country_id: 1512440
description:
[2025-02-06 10:04:04 +0100] info [webmaild] 84.54.72.209 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.253.178
country_id: 1814991
description:
Feb  6 10:04:21 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.253.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.178
country_id: 1814991
description:
2025-02-06 10:04:23 dovecot_plain authenticator failed for ([116.113.253.178]) [116.113.253.178]:47941: 535 Incorrect authentication data (set_id=wilfri17@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.134.3.252
country_id: 6252001
description:
Feb  6 10:04:36 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.134.3.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.72.153.14
country_id: 6252001
description:
2025-02-06 10:04:09 dovecot_login authenticator failed for (160.72.153.14.lightower.net) [160.72.153.14]:52891: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.91.178.253
country_id: 1835841
description:
Feb  6 10:04:52 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.91.178.253 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.235.100.188
country_id: 3469034
description:
[2025-02-06 10:04:55 +0100] info [webmaild] 186.235.100.188 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.91.178.253
country_id: 1835841
description:
2025-02-06 10:04:54 dovecot_login authenticator failed for ([111.91.178.253]) [111.91.178.253]:54506: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.137.215.57
country_id: 3469034
description:
[2025-02-06 10:06:33 +0100] info [webmaild] 177.137.215.57 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 10:06:10 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.194.181.238
country_id: 1835841
description:
Feb  6 10:06:58 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.194.181.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.194.181.238
country_id: 1835841
description:
2025-02-06 10:07:00 dovecot_login authenticator failed for ([175.194.181.238]) [175.194.181.238]:53096: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.85.191.132
country_id: 3469034
description:
[2025-02-06 10:07:33 +0100] info [webmaild] 177.85.191.132 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.207.112.45
country_id: 1835841
description:
Feb  6 10:07:29 ait sshd[1096037]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.207.112.45


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 10:07:32 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.148.113.95
country_id: 3469034
description:
[2025-02-06 10:06:59 +0100] info [webmaild] 201.148.113.95 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.26.84.115
country_id: 2464461
description:
[2025-02-06 10:07:00 +0100] info [webmaild] 197.26.84.115 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.38.100.151
country_id: 2750405
description:
2025-02-06 10:07:07 dovecot_login authenticator failed for ([209.38.100.151]) [209.38.100.151]:44706: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.100.151
country_id: 2750405
description:
Feb  6 10:07:05 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.38.100.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.207.112.45
country_id: 1835841
description:
Feb  6 10:07:29 ait sshd[1096037]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.207.112.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 10:07:45 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.183.167.41
country_id: 1605651
description:
Feb  6 10:08:52 ait sshd[1096466]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.183.167.41


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.159.152.6
country_id: 798544
description:
Feb  6 10:08:12 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.159.152.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.159.152.6
country_id: 798544
description:
2025-02-06 10:08:14 dovecot_plain authenticator failed for (schic) [93.159.152.6]:47352: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.6.16.137
country_id: 1835841
description:
Feb  6 10:08:29 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.6.16.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.6.16.137
country_id: 1835841
description:
2025-02-06 10:08:31 dovecot_plain authenticator failed for ([14.6.16.137]) [14.6.16.137]:40580: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.183.167.41
country_id: 1605651
description:
Feb  6 10:08:52 ait sshd[1096466]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.183.167.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
country_id: 2017370
description:
2025-02-06 10:09:08 dovecot_plain authenticator failed for ([212.120.163.110]) [212.120.163.110]:39938: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 10:09:20 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.217.2.45
country_id: 597427
description:
2025-02-06 10:09:41 dovecot_plain authenticator failed for static-193-217-2-45.cust.tele2.lt [193.217.2.45]:44349: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.183.167.41
country_id: 1605651
description:
Feb  6 10:08:54 ait sshd[1096466]: Failed password for invalid user monika from 202.183.167.41 port 54510 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.120.163.110
country_id: 2017370
description:
Feb  6 10:09:06 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.120.163.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.6.29.211
country_id: 3469034
description:
[2025-02-06 10:09:31 +0100] info [webmaild] 45.6.29.211 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.217.2.45
country_id: 597427
description:
Feb  6 10:09:39 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.217.2.45 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.159.88.67
country_id: 2464461
description:
[2025-02-06 10:09:41 +0100] info [webmaild] 102.159.88.67 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.203.122.112
country_id: 6252001
description:
2025-02-06 10:08:59 dovecot_plain authenticator failed for syn-069-203-122-112.res.spectrum.com [69.203.122.112]:58084: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.42.162
country_id: 6252001
description:
Feb  6 10:09:54 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.42.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.191.88.29
country_id: 1562822
description:
Feb  6 10:09:58 ait sshd[1096834]: pam_imunify(sshd:auth): [IM360_RBL] The IP 160.191.88.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.42.162
country_id: 6252001
description:
2025-02-06 10:09:56 dovecot_plain authenticator failed for c-73-95-42-162.hsd1.co.comcast.net [73.95.42.162]:41526: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 160.191.88.29
country_id: 1562822
description:
Feb  6 10:09:58 ait sshd[1096834]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.191.88.29


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 192.109.219.241
country_id: 783754
description:
[2025-02-06 10:10:03 +0100] info [webmaild] 192.109.219.241 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.150.22.184
country_id: 3508796
description:
[2025-02-06 10:10:12 +0100] info [webmaild] 186.150.22.184 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 178.175.140.185
country_id: 617790
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:10-10.178.175.140.185


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
country_id: 1814991
description:
2025-02-06 10:11:47 dovecot_login authenticator failed for ([218.22.187.70]) [218.22.187.66]:47054: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.205.203.246
country_id: 2750405
description:
Feb  6 10:11:48 ait sshd[1097642]: pam_imunify(sshd:auth): [IM360_RBL] The IP 172.205.203.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.126.114.239
country_id: 1880251
description:
2025-02-06 10:11:19 dovecot_plain authenticator failed for 239.114.126.34.bc.googleusercontent.com [34.126.114.239]:36918: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 172.205.203.246
country_id: 2750405
description:
Feb  6 10:11:48 ait sshd[1097642]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.205.203.246


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.134.109.253
country_id: 1814991
description:
2025-02-06 10:11:11 dovecot_plain authenticator failed for ([124.134.109.253]) [124.134.109.253]:50446: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-02-06 10:11:23 dovecot_plain authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:59248: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 10:11:49 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.243
country_id: 1668284
description:
Feb  6 10:11:03 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.243
country_id: 1668284
description:
2025-02-06 10:11:05 dovecot_plain authenticator failed for 111-70-23-243.emome-ip.hinet.net [111.70.23.243]:36438: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
country_id: 6252001
description:
2025-02-06 10:12:19 dovecot_plain authenticator failed for ([96.79.174.131]) [96.79.174.131]:39768: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.177.120.165
country_id: 1814991
description:
2025-02-06 10:12:34 dovecot_plain authenticator failed for ([61.177.120.165]) [61.177.120.165]:57218: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.200.247.78
country_id: 6290252
description:
[2025-02-06 10:12:47 +0100] info [webmaild] 212.200.247.78 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.196.174.235
country_id: 1814991
description:
2025-02-06 10:12:50 dovecot_plain authenticator failed for ([183.196.174.235]) [183.196.174.235]:39456: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
country_id: 1835841
description:
2025-02-06 10:11:58 dovecot_login authenticator failed for ([106.245.246.26]) [106.245.246.26]:44130: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.125.174.202
country_id: 1880251
description:
2025-02-06 10:12:42 dovecot_plain authenticator failed for ([27.125.174.202]) [27.125.174.202]:49903: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
country_id: 1269750
description:
2025-02-06 10:12:30 dovecot_plain authenticator failed for ([59.98.150.190]) [122.160.68.46]:51742: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.59.121.254
country_id: 3469034
description:
[2025-02-06 10:12:32 +0100] info [webmaild] 138.59.121.254 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.68.252.56
country_id: 2542007
description:
[2025-02-06 10:12:18 +0100] info [webmaild] 105.68.252.56 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-02-06 10:12:08 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:47256: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.231.251
country_id: 6252001
description:
2025-02-06 10:12:45 dovecot_plain authenticator failed for ([47.149.231.251]) [47.149.231.251]:42788: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.247.245.61
country_id: 1835841
description:
2025-02-06 10:11:58 dovecot_login authenticator failed for ([1.247.245.61]) [1.247.245.61]:36954: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.187.22.206
country_id: 1880251
description:
Feb  6 10:13:50 ait sshd[1098355]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.187.22.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.187.22.206
country_id: 1880251
description:
Feb  6 10:13:50 ait sshd[1098355]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.22.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 10:13:23 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.253.37
country_id: 1814991
description:
2025-02-06 10:13:37 dovecot_plain authenticator failed for ([218.22.253.37]) [218.22.253.37]:45912: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.41.103
country_id: 1814991
description:
2025-02-06 10:13:53 dovecot_plain authenticator failed for ([60.172.41.103]) [60.172.41.103]:44154: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.0.186.121
country_id: 1814991
description:
2025-02-06 10:13:03 dovecot_plain authenticator failed for ([153.0.186.121]) [153.0.186.121]:49052: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 185.94.29.109
country_id: 2921044
domain: afaccra.u3l.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:10-13.185.94.29.109||RSV:6.65||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.224.137.214
country_id: 3469034
description:
[2025-02-06 10:13:05 +0100] info [webmaild] 186.224.137.214 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.236.162.125
country_id: 2077456
description:
Feb  6 10:12:57 ait sshd[1098028]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.236.162.125 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.236.162.125
country_id: 2077456
description:
Feb  6 10:12:57 ait sshd[1098028]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.236.162.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
country_id: 3469034
description:
2025-02-06 10:12:57 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.154.175]:42316: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:10-13.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.42.116.173
country_id: 2750405
description:
Feb  6 10:14:04 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.42.116.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 10:14:35 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.222.111.154
country_id: 2017370
description:
[2025-02-06 10:14:45 +0100] info [webmaild] 77.222.111.154 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.86.73
country_id: 1512440
description:
[2025-02-06 10:14:57 +0100] info [webmaild] 213.230.86.73 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.35
country_id: 1835841
description:
Feb  6 10:15:09 ait sshd[1098949]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.208.186.206
country_id: 1835841
description:
2025-02-06 10:15:32 dovecot_plain authenticator failed for ([175.208.186.206]) [175.208.186.206]:37670: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 10:15:37 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.11.25.195
country_id: 6252001
description:
2025-02-06 10:15:44 dovecot_plain authenticator failed for ([66.11.25.195]) [66.11.25.195]:56170: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.169.209.141
country_id: 6252001
description:
2025-02-06 10:15:36 dovecot_plain authenticator failed for 141.sub-166-169-209.myvzw.com [166.169.209.141]:10033: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.23.95.14
country_id: 1814991
description:
2025-02-06 10:15:38 dovecot_login authenticator failed for ([218.23.95.14]) [218.23.95.14]:55388: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
country_id: 1880251
description:
Feb  6 10:15:39 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2025-02-06 10:15:20 dovecot_plain authenticator failed for (imparhoteis.static.gvt.net.br) [179.184.218.49]:47526: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.39.63.46
country_id: 1814991
description:
2025-02-06 10:15:28 dovecot_plain authenticator failed for ([117.39.63.46]) [117.39.63.46]:49928: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.106.237.2
country_id: 3469034
description:
[2025-02-06 10:15:30 +0100] info [webmaild] 190.106.237.2 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
country_id: 1880251
description:
2025-02-06 10:15:41 dovecot_plain authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:4043: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.176.170.160
country_id: 2510769
description:
Feb  6 10:15:46 ait sshd[1099228]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.176.170.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.13.2
country_id: 1814991
description:
Feb  6 10:15:52 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.13.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.13.2
country_id: 1814991
description:
2025-02-06 10:15:54 dovecot_login authenticator failed for ([183.236.13.2]) [183.236.13.2]:49204: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.35
country_id: 1835841
description:
Feb  6 10:15:09 ait sshd[1098949]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.35


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2025-02-06 10:15:09 dovecot_plain authenticator failed for ([196.28.226.66]) [196.28.226.66]:60832: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.37.77.183
country_id: 3469034
description:
[2025-02-06 10:15:15 +0100] info [webmaild] 189.37.77.183 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.76.69.221
country_id: 617790
description:
2025-02-06 10:15:16 dovecot_plain authenticator failed for (wcdma.178-76-69-221.moldcell.md) [178.76.69.221]:39704: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.176.170.160
country_id: 2510769
description:
Feb  6 10:15:46 ait sshd[1099228]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.176.170.160


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
country_id: 3469034
description:
2025-02-06 10:15:16 dovecot_plain authenticator failed for ([187.51.234.239]) [189.108.147.210]:49716: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.12.33
country_id: 1269750
description:
2025-02-06 10:16:27 dovecot_plain authenticator failed for ([122.175.12.33]) [122.175.12.33]:54360: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
country_id: 1819730
description:
2025-02-06 10:15:58 dovecot_plain authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:27746: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.223.115.159
country_id: 1814991
description:
2025-02-06 10:16:13 dovecot_plain authenticator failed for ([222.223.115.159]) [222.223.115.159]:36538: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.23
country_id: 1819730
description:
2025-02-06 10:16:24 dovecot_plain authenticator failed for ([121.202.152.23]) [121.202.152.23]:19695: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.223.115.159
country_id: 1814991
description:
Feb  6 10:16:11 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.223.115.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2025-02-06 10:16:38 dovecot_plain authenticator failed for ([223.75.231.193]) [58.49.113.138]:15625: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2025-02-06 10:17:00 dovecot_plain authenticator failed for (ertinned) [41.248.243.181]:60032: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.91.178.253
country_id: 1835841
description:
2025-02-06 10:17:13 dovecot_login authenticator failed for ([111.91.178.253]) [111.91.178.253]:54000: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.238.77.144
country_id: 3469034
description:
[2025-02-06 10:17:51 +0100] info [webmaild] 170.238.77.144 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.109.211.44
country_id: 1821275
description:
2025-02-06 10:17:07 dovecot_plain authenticator failed for nz211l44.bb27109.ctm.net [27.109.211.44]:58220: 535 Incorrect authentication data (set_id=eng21a00034y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.128.40
country_id: 1668284
description:
2025-02-06 10:17:08 dovecot_plain authenticator failed for 1-34-128-40.hinet-ip.hinet.net [1.34.128.40]:51446: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.151.154.196
country_id: 2921044
description:
2025-02-06 10:17:26 dovecot_plain authenticator failed for p50979ac4.dip0.t-ipconnect.de [80.151.154.196]:34716: 535 Incorrect authentication data (set_id=eng21a00034y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.192.242
country_id: 290557
description:
2025-02-06 10:16:58 dovecot_plain authenticator failed for ([94.204.192.242]) [94.204.192.242]:37779: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.0.11.107
country_id: 192950
description:
[2025-02-06 10:17:22 +0100] info [webmaild] 102.0.11.107 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.82.218.253
country_id: 732800
description:
[2025-02-06 10:17:38 +0100] info [webmaild] 185.82.218.253 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.123.208.246
country_id: 6252001
description:
2025-02-06 10:16:56 dovecot_login authenticator failed for 246.208.123.34.bc.googleusercontent.com [34.123.208.246]:33294: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.45.135.234
country_id: 3573591
description:
2025-02-06 10:18:12 dovecot_plain authenticator failed for 186-45-135-234.dynamic.tstt.net.tt [186.45.135.234]:51619: 535 Incorrect authentication data (set_id=adsby@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.227.2.181
country_id: 1814991
description:
Feb  6 10:18:42 ait sshd[1100384]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.227.2.181


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.3.132
country_id: 2510769
description:
Feb  6 10:17:59 ait sshd[1100125]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.143.3.132 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.143.3.132
country_id: 2510769
description:
Feb  6 10:17:59 ait sshd[1100125]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.143.3.132


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
country_id: 1269750
description:
2025-02-06 10:18:40 dovecot_plain authenticator failed for (nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:53782: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.227.2.181
country_id: 1814991
description:
Feb  6 10:18:42 ait sshd[1100384]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.227.2.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.137.159
country_id: 1269750
description:
Feb  6 10:18:54 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.137.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.236.96
country_id: 2921044
description:
2025-02-06 10:18:02 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:53245: 535 Incorrect authentication data (set_id=eng20a00037y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.176.233.7
country_id: 2542007
description:
[2025-02-06 10:18:04 +0100] info [webmaild] 160.176.233.7 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.42.74
country_id: 1814991
description:
2025-02-06 10:18:22 dovecot_plain authenticator failed for ([58.18.42.74]) [58.18.42.74]:34133: 535 Incorrect authentication data (set_id=adsby)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.21
country_id: 1269750
description:
2025-02-06 10:18:40 dovecot_plain authenticator failed for (nsg-corporate-21.229.187.122.airtel.in) [122.187.229.21]:57116: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.137.159
country_id: 1269750
description:
2025-02-06 10:18:56 dovecot_plain authenticator failed for ([103.109.44.163]) [122.165.137.159]:40090: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
country_id: 933860
description:
2025-02-06 10:19:07 dovecot_plain authenticator failed for ([168.167.55.230]) [168.167.55.230]:44085: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.0.180
country_id: 1819730
description:
2025-02-06 10:19:52 dovecot_login authenticator failed for 110-4-0-180.static.pccw-hkt.com [110.4.0.180]:52604: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.112.159
country_id: 2661886
description:
2025-02-06 10:19:54 dovecot_plain authenticator failed for 46-162-112-159.cust.bredband2.com [46.162.112.159]:36374: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.222
country_id: 1819730
description:
2025-02-06 10:19:05 dovecot_login authenticator failed for (m121-202-205-222.smartone.com) [121.202.205.222]:30827: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.192.79.179
country_id: 3865483
description:
2025-02-06 10:19:19 dovecot_login authenticator failed for (pppoe-179.79.192.181.in-addr.arpa) [181.192.79.179]:38110: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.213.68
country_id: 3865483
description:
2025-02-06 10:19:33 dovecot_login authenticator failed for (red.138.118.213.068.ssservicios.com.ar) [138.118.213.68]:34551: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.249.131
country_id: 1814991
description:
2025-02-06 10:19:38 dovecot_login authenticator failed for ([60.31.249.131]) [60.31.249.131]:51055: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.44.221
country_id: 2017370
description:
2025-02-06 10:19:48 dovecot_login authenticator failed for broadband-37-110-44-221.ip.moscow.rt.ru [37.110.44.221]:9758: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
country_id: 2077456
description:
2025-02-06 10:20:26 dovecot_login authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:53968: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.171.195.70
country_id: 6252001
description:
2025-02-06 10:20:26 dovecot_plain authenticator failed for ([216.171.195.70]) [216.171.195.70]:42879: 535 Incorrect authentication data (set_id=ds18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.31.8.202
country_id: 1210997
description:
2025-02-06 10:20:31 dovecot_login authenticator failed for (113-11-34-221-smile.com.bd) [114.31.8.202]:43530: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.227.214.33
country_id: 1835841
description:
2025-02-06 10:20:41 dovecot_login authenticator failed for ([182.227.214.33]) [182.227.214.33]:48188: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.196.29.246
country_id: 3469034
description:
[2025-02-06 10:20:43 +0100] info [webmaild] 131.196.29.246 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.35.63.27
country_id: 1835841
description:
2025-02-06 10:20:13 dovecot_login authenticator failed for ([110.35.63.27]) [110.35.63.27]:45912: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.10.151.234
country_id: 3469034
description:
[2025-02-06 10:20:10 +0100] info [webmaild] 187.10.151.234 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.251.251
country_id: 1814991
description:
2025-02-06 10:20:10 dovecot_plain authenticator failed for (251.251.223.60.adsl-pool.sx.cn) [60.223.251.251]:52149: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2025-02-06 10:20:00 dovecot_login authenticator failed for ([209.173.10.75]) [209.173.10.75]:46080: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.89.53.247
country_id: 3469034
description:
[2025-02-06 10:20:33 +0100] info [webmaild] 190.89.53.247 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.42.79.74
country_id: 203312
description:
2025-02-06 10:20:48 dovecot_login authenticator failed for ([206.42.79.74]) [206.42.79.74]:39360: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
country_id: 1269750
description:
2025-02-06 10:20:22 dovecot_login authenticator failed for ([115.245.172.214]) [115.245.172.214]:34232: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.207.76
country_id: 6252001
description:
2025-02-06 10:20:09 dovecot_login authenticator failed for wsip-70-166-207-76.ph.ph.cox.net (wsip-70-166-207-65.ph.ph.cox.net) [70.166.207.76]:52900: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.194.180.241
country_id: 2017370
description:
[2025-02-06 10:20:00 +0100] info [webmaild] 37.194.180.241 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.29.235.66
country_id: 1605651
description:
Feb  6 10:21:56 ait sshd[1101827]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.29.235.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 10:21:57 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
country_id: 1269750
description:
Feb  6 10:21:59 ait sshd[1101848]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.183.225.227
country_id: 3469034
description:
[2025-02-06 10:22:32 +0100] info [webmaild] 45.183.225.227 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.40.72.101
country_id: 798549
description:
2025-02-06 10:22:53 dovecot_plain authenticator failed for ([89.40.72.101]) [89.40.72.101]:48952: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.29.235.66
country_id: 1605651
description:
Feb  6 10:21:56 ait sshd[1101827]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.29.235.66


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
country_id: 1269750
description:
Feb  6 10:21:59 ait sshd[1101848]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.249.234.242
country_id: 6252001
description:
2025-02-06 10:22:42 dovecot_plain authenticator failed for pool-96-249-234-242.nrflva.fios.verizon.net [96.249.234.242]:41285: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.77.201.73
country_id: 3469034
description:
[2025-02-06 10:22:47 +0100] info [webmaild] 189.77.201.73 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.10.84.207
country_id: 3469034
description:
[2025-02-06 10:23:03 +0100] info [webmaild] 201.10.84.207 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.177.247.242
country_id: 1269750
description:
2025-02-06 10:23:19 dovecot_login authenticator failed for (host-247342.fivenetwork.com) [202.177.247.242]:53748: 535 Incorrect authentication data (set_id=eng38b22452y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.18.199.118
country_id: 3469034
description:
[2025-02-06 10:23:19 +0100] info [webmaild] 187.18.199.118 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.128
country_id: 2017370
description:
2025-02-06 10:23:26 dovecot_plain authenticator failed for ([178.178.194.128]) [178.178.194.128]:38340: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.90.89.66
country_id: 3686110
description:
2025-02-06 10:23:00 dovecot_login authenticator failed for ([66.90.89.66]) [66.90.89.66]:41904: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.114.254
country_id: 1814991
description:
2025-02-06 10:23:12 dovecot_plain authenticator failed for ([60.173.114.254]) [60.173.114.254]:42097: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 10:23:33 ait sshd[1102659]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.241.252
country_id: 1814991
description:
2025-02-06 10:23:36 dovecot_login authenticator failed for ([183.220.241.252]) [183.220.241.252]:52280: 535 Incorrect authentication data (set_id=eng38b22452y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.121
country_id: 617790
description:
2025-02-06 10:23:12 dovecot_login authenticator failed for ([185.167.58.121]) [185.167.58.121]:47004: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.34
country_id: 1819730
description:
2025-02-06 10:23:12 dovecot_plain authenticator failed for (m121-202-152-34.smartone.com) [121.202.152.34]:44854: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
country_id: 3175395
description:
2025-02-06 10:23:20 dovecot_plain authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:53936: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 10:23:33 ait sshd[1102659]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.72.4.98
country_id: 2029969
description:
2025-02-06 10:23:56 dovecot_login authenticator failed for ([112.72.4.98]) [112.72.4.98]:11060: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.86.167.42
country_id: 1605651
description:
2025-02-06 10:24:19 dovecot_login authenticator failed for ppp-210-86-167-42.revip.asianet.co.th [210.86.167.42]:51642: 535 Incorrect authentication data (set_id=eng19b00195y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.14.192.20
country_id: 1835841
description:
2025-02-06 10:24:19 dovecot_login authenticator failed for ([110.14.192.20]) [110.14.192.20]:34072: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.151.131.211
country_id: 2077456
description:
2025-02-06 10:24:42 dovecot_plain authenticator failed for 122-151-131-211.sta.wbroadband.net.au [122.151.131.211]:53751: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.60.194.189
country_id: 2510769
description:
2025-02-06 10:24:27 dovecot_plain authenticator failed for 81.60.194.189.dyn.user.ono.com [81.60.194.189]:50526: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.221.130.246
country_id: 1835841
description:
2025-02-06 10:24:31 dovecot_plain authenticator failed for ([211.221.130.246]) [211.221.130.246]:36130: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.158.148
country_id: 1814991
description:
2025-02-06 10:24:36 dovecot_plain authenticator failed for ([60.166.158.148]) [60.166.158.148]:54062: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.129.201.81
country_id: 1210997
description:
2025-02-06 10:24:40 dovecot_login authenticator failed for ([103.129.201.82]) [103.129.201.81]:39060: 535 Incorrect authentication data (set_id=ads76a66686y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.231.159
country_id: 2921044
description:
Feb  6 10:24:09 ait sshd[1102950]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.205.231.159 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.231.159
country_id: 2921044
description:
Feb  6 10:24:09 ait sshd[1102950]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.231.159


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.86.167.42
country_id: 1605651
description:
Feb  6 10:24:17 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.86.167.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2025-02-06 10:24:17 dovecot_plain authenticator failed for (imparhoteis.static.gvt.net.br) [179.184.218.49]:39282: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.168.78
country_id: 3469034
description:
2025-02-06 10:24:33 dovecot_plain authenticator failed for (78-168-168-45.weblinknet.com.br) [45.168.168.78]:36354: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.178.158.132
country_id: 1269750
description:
2025-02-06 10:24:46 dovecot_login authenticator failed for ([103.178.158.133]) [103.178.158.132]:59028: 535 Incorrect authentication data (set_id=abs65b11556y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.204.162.116
country_id: 2017370
description:
2025-02-06 10:24:36 dovecot_login authenticator failed for ([82.204.162.116]) [82.204.162.116]:54174: 535 Incorrect authentication data (set_id=ads39a22282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.242.86.203
country_id: 1814991
description:
2025-02-06 10:24:18 dovecot_plain authenticator failed for ([58.242.86.203]) [58.242.86.203]:59596: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
country_id: 1835841
description:
2025-02-06 10:24:37 dovecot_login authenticator failed for ([14.88.228.202]) [14.88.228.202]:32794: 535 Incorrect authentication data (set_id=eng19b00195y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.143.231.208
country_id: 1814991
description:
2025-02-06 10:24:18 dovecot_plain authenticator failed for ([43.143.231.208]) [43.143.231.208]:41450: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.236.156.129
country_id: 1835841
description:
2025-02-06 10:24:30 dovecot_plain authenticator failed for ([1.236.156.129]) [1.236.156.129]:60240: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
country_id: 1814991
description:
2025-02-06 10:24:20 dovecot_login authenticator failed for ([220.178.246.43]) [220.178.246.43]:37673: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.158.148
country_id: 1814991
description:
Feb  6 10:24:34 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.158.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.146.210
country_id: 1814991
description:
2025-02-06 10:24:34 dovecot_login authenticator failed for ([122.227.146.210]) [122.227.146.210]:63315: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.181.210.98
country_id: 1814991
description:
2025-02-06 10:24:03 dovecot_login authenticator failed for ([221.181.210.98]) [221.181.210.98]:45367: 535 Incorrect authentication data (set_id=ads39a22282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.94.206.187
country_id: 3469034
description:
2025-02-06 10:24:16 dovecot_plain authenticator failed for (177-94-206-187.dsl.telesp.net.br) [177.94.206.187]:43592: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.166.85.53
country_id: 1835841
description:
2025-02-06 10:25:29 dovecot_plain authenticator failed for ([121.166.85.53]) [121.166.85.53]:53194: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.80.172.44
country_id: 1835841
description:
2025-02-06 10:25:38 dovecot_plain authenticator failed for ([61.80.172.44]) [61.80.172.44]:49916: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.132.232
country_id: 6252001
description:
2025-02-06 10:25:21 dovecot_plain authenticator failed for ([75.110.132.232]) [75.110.132.232]:64464: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.85.12.142
country_id: 1835841
description:
2025-02-06 10:25:48 dovecot_plain authenticator failed for ([61.85.12.142]) [61.85.12.142]:39615: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.56.89.91
country_id: 3439705
description:
[2025-02-06 10:25:28 +0100] info [webmaild] 167.56.89.91 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.220.235.237
country_id: 1835841
description:
2025-02-06 10:25:42 dovecot_plain authenticator failed for ([112.220.235.237]) [112.220.235.237]:41936: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.127.143.140
country_id: 1835841
description:
2025-02-06 10:25:46 dovecot_plain authenticator failed for ([116.127.143.140]) [116.127.143.140]:43017: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.42
country_id: 1149361
description:
2025-02-06 10:25:19 dovecot_plain authenticator failed for ([180.94.75.42]) [180.94.75.42]:57005: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.184.194
country_id: 1814991
description:
2025-02-06 10:25:23 dovecot_plain authenticator failed for ([114.242.172.76]) [61.51.184.194]:54116: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.94.56.139
country_id: 6252001
description:
Feb  6 10:25:32 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.94.56.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.194.173.186
country_id: 1835841
description:
Feb  6 10:25:32 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.194.173.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.80.172.44
country_id: 1835841
description:
Feb  6 10:25:36 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.80.172.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.90.150.51
country_id: 2921044
description:
2025-02-06 10:25:42 dovecot_plain authenticator failed for ip-109-090-150-051.um36.pools.vodafone-ip.de [109.90.150.51]:48944: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.89.237.199
country_id: 6252001
description:
Feb  6 10:25:25 ait sshd[1103568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.237.199


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.47.74.210
country_id: 1269750
description:
2025-02-06 10:25:24 dovecot_plain authenticator failed for ([103.47.74.210]) [103.47.74.210]:59118: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.207.24
country_id: 6252001
description:
2025-02-06 10:25:52 dovecot_plain authenticator failed for syn-076-176-207-024.res.spectrum.com [76.176.207.24]:57555: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.24.103.42
country_id: 1814991
description:
2025-02-06 10:25:33 dovecot_plain authenticator failed for ([183.24.103.42]) [183.24.103.42]:46462: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.118.229
country_id: 1880251
description:
2025-02-06 10:25:44 dovecot_plain authenticator failed for ([138.75.118.229]) [138.75.118.229]:49366: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.38.70.172
country_id: 1168579
description:
2025-02-06 10:25:30 dovecot_plain authenticator failed for ([180.149.214.193]) [110.38.70.172]:50975: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
country_id: 614540
description:
2025-02-06 10:25:32 dovecot_plain authenticator failed for ([2.57.219.14]) [2.57.219.2]:53754: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.194.173.186
country_id: 1835841
description:
2025-02-06 10:25:34 dovecot_plain authenticator failed for ([211.194.173.186]) [211.194.173.186]:50932: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.11.246.91
country_id: 1835841
description:
2025-02-06 10:25:40 dovecot_plain authenticator failed for ([59.11.246.91]) [59.11.246.91]:41459: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
country_id: 1168579
description:
2025-02-06 10:25:49 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:51886: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.210.10
country_id: 1814991
description:
2025-02-06 10:25:19 dovecot_plain authenticator failed for ([27.45.210.10]) [27.45.210.10]:41078: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.153.166
country_id: 3469034
description:
2025-02-06 10:25:22 dovecot_plain authenticator failed for (200-205-223-1.customer.tdatabrasil.net.br) [187.93.153.166]:33091: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.11.246.91
country_id: 1835841
description:
Feb  6 10:25:38 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.11.246.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.245.67
country_id: 1814991
description:
2025-02-06 10:25:47 dovecot_plain authenticator failed for ([120.238.245.67]) [120.238.245.67]:50291: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2025-02-06 10:25:51 dovecot_plain authenticator failed for ([112.194.142.167]) [112.194.142.167]:40928: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.125
country_id: 294640
description:
2025-02-06 10:25:53 dovecot_plain authenticator failed for ([130.185.96.125]) [130.185.96.125]:55179: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.20.179.98
country_id: 3469034
description:
[2025-02-06 10:25:00 +0100] info [webmaild] 177.20.179.98 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.16.156.103
country_id: 6252001
description:
2025-02-06 10:25:23 dovecot_plain authenticator failed for (173-16-156-103.client.mchsi.com) [173.16.156.103]:59860: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.187.146.68
country_id: 6252001
description:
2025-02-06 10:25:27 dovecot_plain authenticator failed for ([38.187.146.68]) [38.187.146.68]:53951: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.94.56.139
country_id: 6252001
description:
2025-02-06 10:25:34 dovecot_plain authenticator failed for (74-94-56-139-philadelphia.hfc.comcastbusiness.net) [74.94.56.139]:36066: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.19.149
country_id: 1668284
description:
2025-02-06 10:25:37 dovecot_plain authenticator failed for 111-70-19-149.emome-ip.hinet.net [111.70.19.149]:59611: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.186.136.36
country_id: 1814991
description:
2025-02-06 10:25:43 dovecot_plain authenticator failed for ([61.186.136.36]) [61.186.136.36]:40663: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.233.216.122
country_id: 3469034
description:
[2025-02-06 10:25:21 +0100] info [webmaild] 45.233.216.122 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.174.189.52
country_id: 1835841
description:
2025-02-06 10:25:25 dovecot_plain authenticator failed for ([121.174.189.52]) [121.174.189.52]:43799: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
country_id: 1814991
description:
2025-02-06 10:25:21 dovecot_plain authenticator failed for ([112.111.61.231]) [112.111.61.229]:38584: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.40.10
country_id: 1814991
description:
2025-02-06 10:25:23 dovecot_plain authenticator failed for ([112.6.73.140]) [221.2.40.10]:51846: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.108.186.10
country_id: 3077311
description:
2025-02-06 10:25:16 dovecot_plain authenticator failed for ([78.108.186.10]) [78.108.186.10]:39596: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.71.106
country_id: 1269750
description:
2025-02-06 10:25:19 dovecot_plain authenticator failed for (abts-kk-static-106.71.166.122.airtelbroadband.in) [122.166.71.106]:55234: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.142
country_id: 1835841
description:
2025-02-06 10:25:46 dovecot_plain authenticator failed for ([218.149.228.142]) [218.149.228.142]:34510: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.227.87.29
country_id: 1814991
description:
2025-02-06 10:25:22 dovecot_plain authenticator failed for ([106.227.87.29]) [106.227.87.29]:42900: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.233.4.50
country_id: 1814991
description:
2025-02-06 10:25:22 dovecot_plain authenticator failed for ([61.233.4.50]) [61.233.4.50]:42633: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.171.150
country_id: 1814991
description:
Feb  6 10:25:51 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.171.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.198.60
country_id: 1835841
description:
2025-02-06 10:25:00 dovecot_login authenticator failed for ([121.189.198.60]) [121.189.198.60]:47628: 535 Incorrect authentication data (set_id=abs65b11556y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2025-02-06 10:25:36 dovecot_plain authenticator failed for ([182.42.113.10]) [182.42.113.10]:44670: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.226.81
country_id: 1835841
description:
2025-02-06 10:25:22 dovecot_plain authenticator failed for ([121.189.226.81]) [121.189.226.81]:56236: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
country_id: 3469034
description:
2025-02-06 10:25:22 dovecot_plain authenticator failed for (189-56-79-105.customer.tdatabrasil.net.br) [186.200.249.162]:44620: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.252.152.214
country_id: 3017382
description:
2025-02-06 10:25:45 dovecot_plain authenticator failed for ([193.252.152.214]) [193.252.152.214]:37532: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
country_id: 1835841
description:
2025-02-06 10:25:49 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:44492: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.171.150
country_id: 1814991
description:
2025-02-06 10:25:53 dovecot_plain authenticator failed for ([221.0.171.150]) [221.0.171.150]:42430: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
country_id: 2510769
description:
2025-02-06 10:25:18 dovecot_plain authenticator failed for ([91.116.42.218]) [91.116.42.218]:35958: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.117.144.158
country_id: 1835841
description:
2025-02-06 10:25:20 dovecot_plain authenticator failed for ([175.117.144.158]) [175.117.144.158]:51782: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-02-06 10:25:22 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:43242: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.237.199
country_id: 6252001
description:
Feb  6 10:25:25 ait sshd[1103568]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.89.237.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
country_id: 1814991
description:
2025-02-06 10:25:27 dovecot_plain authenticator failed for ([58.216.101.166]) [58.216.101.162]:35897: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2025-02-06 10:25:31 dovecot_plain authenticator failed for ([211.53.58.1]) [211.169.212.206]:54983: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.134.126.162
country_id: 6252001
description:
2025-02-06 10:25:34 dovecot_plain authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:1218: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.43.137.90
country_id: 1835841
description:
2025-02-06 10:25:21 dovecot_plain authenticator failed for ([14.43.137.90]) [14.43.137.90]:41346: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.5
country_id: 1668284
description:
2025-02-06 10:25:23 dovecot_plain authenticator failed for 111-70-32-5.emome-ip.hinet.net [111.70.32.5]:40831: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.69.30.93
country_id: 1835841
description:
2025-02-06 10:25:42 dovecot_plain authenticator failed for ([180.69.30.93]) [180.69.30.93]:50098: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.142
country_id: 1835841
description:
Feb  6 10:25:44 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.199.251
country_id: 3865483
description:
2025-02-06 10:25:23 dovecot_plain authenticator failed for ([190.104.199.251]) [190.104.199.251]:57708: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.0.186.121
country_id: 1814991
description:
2025-02-06 10:25:37 dovecot_plain authenticator failed for ([153.0.186.121]) [153.0.186.121]:54016: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.3.252
country_id: 6252001
description:
2025-02-06 10:25:33 dovecot_plain authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:50592: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.146.121.12
country_id: 1814991
description:
2025-02-06 10:25:36 dovecot_plain authenticator failed for ([61.146.121.12]) [61.146.121.12]:37564: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.2.113
country_id: 99237
description:
[2025-02-06 10:25:49 +0100] info [webmaild] 169.224.2.113 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2025-02-06 10:25:02 dovecot_login authenticator failed for ([213.230.127.217]) [213.230.127.217]:46110: 535 Incorrect authentication data (set_id=ads76a66686y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.38.70.172
country_id: 1168579
description:
Feb  6 10:25:28 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.38.70.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.195.251.41
country_id: 3573591
description:
Feb  6 10:26:33 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.195.251.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.103.74
country_id: 1562822
description:
2025-02-06 10:26:42 dovecot_plain authenticator failed for ([27.72.103.74]) [27.72.103.74]:49432: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.205.112.156
country_id: 3625428
description:
2025-02-06 10:26:19 dovecot_login authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:20450: 535 Incorrect authentication data (set_id=ads22a00155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.175
country_id: 1269750
description:
2025-02-06 10:26:32 dovecot_login authenticator failed for (nsg-corporate-175.229.187.122.airtel.in) [122.187.229.175]:43001: 535 Incorrect authentication data (set_id=eng19b00195y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.107.146.186
country_id: 1814991
description:
2025-02-06 10:26:04 dovecot_plain authenticator failed for ([223.107.146.186]) [223.107.146.186]:54016: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.163
country_id: 1269750
description:
Feb  6 10:26:13 ait sshd[1103975]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.89.60.158
country_id: 1814991
description:
2025-02-06 10:26:16 dovecot_login authenticator failed for ([124.89.60.158]) [124.89.60.158]:35256: 535 Incorrect authentication data (set_id=eng19b00195y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.228.105.192
country_id: 1835841
description:
Feb  6 10:26:12 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.228.105.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
country_id: 1694008
description:
2025-02-06 10:26:46 dovecot_plain authenticator failed for ([58.69.17.18]) [58.69.17.18]:57808: 535 Incorrect authentication data (set_id=baah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.212.68
country_id: 1814991
description:
2025-02-06 10:26:05 dovecot_login authenticator failed for ([111.39.212.68]) [111.39.212.68]:49056: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.78.68
country_id: 1668284
description:
2025-02-06 10:26:45 dovecot_login authenticator failed for 60-249-78-68.hinet-ip.hinet.net [60.249.78.68]:38264: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.163
country_id: 1269750
description:
Feb  6 10:26:13 ait sshd[1103975]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.163


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.175
country_id: 1269750
description:
Feb  6 10:26:30 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.99.148.149
country_id: 1269750
description:
Feb  6 10:26:50 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.99.148.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.228.105.192
country_id: 1835841
description:
2025-02-06 10:26:14 dovecot_plain authenticator failed for ([58.228.105.192]) [58.228.105.192]:46853: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.32.19.205
country_id: 1668284
description:
2025-02-06 10:26:16 dovecot_plain authenticator failed for 114-32-19-205.hinet-ip.hinet.net [114.32.19.205]:50592: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.188.169
country_id: 1861060
description:
2025-02-06 10:25:56 dovecot_plain authenticator failed for ([180.7.188.169]) [180.7.188.169]:49717: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
country_id: 6252001
description:
2025-02-06 10:25:57 dovecot_plain authenticator failed for syn-208-105-196-214.biz.spectrum.com (rrcs-208-105-196-214.nys.biz.rr.com) [208.105.196.214]:46714: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.111.59.146
country_id: 6252001
description:
2025-02-06 10:26:06 dovecot_plain authenticator failed for ([75.111.59.146]) [75.111.59.146]:45660: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.99.148.149
country_id: 1269750
description:
2025-02-06 10:26:52 dovecot_plain authenticator failed for (as135139-cbe.skylinkfibernet.com) [103.99.148.149]:35577: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 10:25:57 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2025-02-06 10:26:06 dovecot_plain authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:50958: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-02-06 10:26:07 dovecot_plain authenticator failed for ([50.217.255.171]) [50.217.255.171]:36449: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.195.251.41
country_id: 3573591
description:
2025-02-06 10:26:35 dovecot_plain authenticator failed for ([186.195.251.41]) [186.195.251.41]:62481: 535 Incorrect authentication data (set_id=baah@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.40.46
country_id: 1880251
description:
47.128.40.46 - - [06/Feb/2025:10:27:06 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9770191 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/03994e/search/results?limit=10&method=GET&ip=40.77.167.21" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.40.46


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.252.38.24
country_id: 2215636
description:
Feb  6 10:27:14 ait sshd[1104477]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.252.38.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.218
country_id: 1819730
description:
2025-02-06 10:27:17 dovecot_login authenticator failed for ([121.202.200.218]) [121.202.200.218]:29959: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.35.122.10
country_id: 2510769
description:
2025-02-06 10:27:43 dovecot_login authenticator failed for ([46.35.122.10]) [46.35.122.10]:36575: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.94.238.64
country_id: 1835841
description:
Feb  6 10:27:45 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.94.238.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.94.238.64
country_id: 1835841
description:
2025-02-06 10:27:47 dovecot_plain authenticator failed for ([220.94.238.64]) [220.94.238.64]:60369: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.122.255.2
country_id: 1835841
description:
2025-02-06 10:27:06 dovecot_login authenticator failed for ([58.122.255.2]) [58.122.255.2]:51658: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.54.49
country_id: 1668284
description:
2025-02-06 10:27:51 dovecot_plain authenticator failed for (58-115-54-49.twt1.com.tw) [58.115.54.49]:45512: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.187.97.200
country_id: 3469034
description:
[2025-02-06 10:27:32 +0100] info [webmaild] 200.187.97.200 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.47
country_id: 1835841
description:
2025-02-06 10:27:36 dovecot_login authenticator failed for ([121.154.90.47]) [121.154.90.47]:43578: 535 Incorrect authentication data (set_id=ads23b00195y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.113.122.243
country_id: 1835841
description:
2025-02-06 10:27:45 dovecot_plain authenticator failed for ([210.113.122.243]) [210.113.122.243]:50964: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.252.38.24
country_id: 2215636
description:
Feb  6 10:27:14 ait sshd[1104477]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.252.38.24


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.250.208.249
country_id: 3865483
description:
[2025-02-06 10:27:59 +0100] info [webmaild] 167.250.208.249 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.208.108.52
country_id: 1814991
description:
2025-02-06 10:28:04 dovecot_login authenticator failed for ([60.208.108.52]) [60.208.108.52]:34478: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
country_id: 3469034
description:
2025-02-06 10:28:06 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.154.175]:34123: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.130
country_id: 1835841
description:
2025-02-06 10:28:11 dovecot_login authenticator failed for ([119.198.191.130]) [119.198.191.130]:34139: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2025-02-06 10:28:17 dovecot_login authenticator failed for ([62.201.228.210]) [62.201.228.210]:57622: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.232.72.247
country_id: 2661886
description:
2025-02-06 10:28:21 dovecot_login authenticator failed for 81-232-72-247-no600.tbcn.telia.com [81.232.72.247]:53868: 535 Incorrect authentication data (set_id=dhdvn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.218
country_id: 3865483
description:
2025-02-06 10:28:28 dovecot_login authenticator failed for (201-234-106-218.static.impsat.net.ar) [201.234.106.218]:42999: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:10-28.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.238.81.152
country_id: 3469034
description:
[2025-02-06 10:28:01 +0100] info [webmaild] 170.238.81.152 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.171.237.143
country_id: 1814991
description:
2025-02-06 10:28:09 dovecot_plain authenticator failed for ([60.171.237.143]) [60.171.237.143]:34848: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.22.37.184
country_id: 3144096
description:
2025-02-06 10:28:50 dovecot_plain authenticator failed for ([217.22.37.184]) [217.22.37.184]:55054: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.23.42.49
country_id: 1814991
description:
2025-02-06 10:28:51 dovecot_login authenticator failed for ([111.23.42.49]) [111.23.42.49]:48088: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.92.25.206
country_id: 1835841
description:
2025-02-06 10:27:54 dovecot_login authenticator failed for ([220.92.25.206]) [220.92.25.206]:40184: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2025-02-06 10:27:58 dovecot_login authenticator failed for wsip-64-207-225-55.tu.ok.cox.net (wsip-64-207-241-177.tu.ok.cox.net) [64.207.225.55]:51356: 535 Incorrect authentication data (set_id=ads23b00195y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-02-06 10:28:02 dovecot_plain authenticator failed for ([196.191.212.226]) [213.55.85.202]:23290: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.170.76
country_id: 1835841
description:
Feb  6 10:28:03 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.170.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.170.76
country_id: 1835841
description:
2025-02-06 10:28:05 dovecot_plain authenticator failed for ([218.149.170.76]) [218.149.170.76]:56079: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.169.139.173
country_id: 3469034
description:
[2025-02-06 10:28:17 +0100] info [webmaild] 45.169.139.173 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.43.231.186
country_id: 3175395
description:
2025-02-06 10:29:13 dovecot_plain authenticator failed for host-88-43-231-186.business.telecomitalia.it ([88.43.231.188]) [88.43.231.186]:54896: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.233.29.157
country_id: 3865483
description:
Feb  6 10:29:31 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.233.29.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.13
country_id: 2328926
description:
2025-02-06 10:29:40 dovecot_plain authenticator failed for ([41.216.169.13]) [41.216.169.13]:59778: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.29.232.113
country_id: 1605651
description:
Feb  6 10:28:56 ait sshd[1105120]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.29.232.113 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.29.232.113
country_id: 1605651
description:
Feb  6 10:28:56 ait sshd[1105120]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.29.232.113


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.183.178
country_id: 2017370
description:
2025-02-06 10:29:21 dovecot_plain authenticator failed for broadband-5-228-183-178.ip.moscow.rt.ru [5.228.183.178]:55906: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2025-02-06 10:29:33 dovecot_login authenticator failed for ([170.233.29.157]) [170.233.29.157]:43152: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
country_id: 294640
description:
2025-02-06 10:29:43 dovecot_login authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:40266: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.0.112
country_id: 1668284
description:
2025-02-06 10:30:53 dovecot_login authenticator failed for 111-70-0-112.emome-ip.hinet.net [111.70.0.112]:57447: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.22.214.214
country_id: 1269750
description:
Feb  6 10:29:54 ait sshd[1105465]: pam_imunify(sshd:auth): [IM360_RBL] The IP 165.22.214.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.219.113.61
country_id: 1814991
description:
2025-02-06 10:30:05 dovecot_plain authenticator failed for ([60.219.113.61]) [60.219.113.61]:56921: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.243.136.120
country_id: 1814991
description:
2025-02-06 10:30:15 dovecot_plain authenticator failed for ([114.243.136.120]) [114.243.136.120]:34298: 535 Incorrect authentication data (set_id=jessica1234@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.142
country_id: 1814991
description:
2025-02-06 10:30:27 dovecot_plain authenticator failed for ([61.185.226.142]) [61.185.226.142]:44092: 535 Incorrect authentication data (set_id=jessica1234)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.241.150
country_id: 1814991
description:
2025-02-06 10:30:30 dovecot_login authenticator failed for ([61.143.241.150]) [61.143.241.150]:59582: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.166.214
country_id: 1814991
description:
2025-02-06 10:30:11 dovecot_plain authenticator failed for ([220.180.166.214]) [220.180.166.214]:59972: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.186.158.160
country_id: 3469034
description:
[2025-02-06 10:30:22 +0100] info [webmaild] 45.186.158.160 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.66.243.165
country_id: 3469034
description:
[2025-02-06 10:30:35 +0100] info [webmaild] 177.66.243.165 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.124.241.142
country_id: 1835841
description:
2025-02-06 10:29:57 dovecot_plain authenticator failed for ([116.124.241.142]) [116.124.241.142]:32976: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.227.137.55
country_id: 3469034
description:
[2025-02-06 10:30:05 +0100] info [webmaild] 168.227.137.55 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
country_id: 6252001
description:
2025-02-06 10:30:16 dovecot_plain authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:60718: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.22.214.214
country_id: 1269750
description:
Feb  6 10:29:54 ait sshd[1105465]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.214.214


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 10:30:09 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
country_id: 294640
description:
2025-02-06 10:30:32 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (nopreired) [109.67.154.24]:62276: 535 Incorrect authentication data (set_id=abs65b11556y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.15.87.64
country_id: 3469034
description:
[2025-02-06 10:30:56 +0100] info [webmaild] 187.15.87.64 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.98.215.147
country_id: 1835841
description:
Feb  6 10:31:29 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.98.215.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.215.147
country_id: 1835841
description:
2025-02-06 10:31:31 dovecot_login authenticator failed for ([183.98.215.147]) [183.98.215.147]:2376: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.86.7.65
country_id: 1814991
description:
2025-02-06 10:31:50 dovecot_plain authenticator failed for ([218.86.7.65]) [218.86.7.65]:54884: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.227.194
country_id: 149590
description:
2025-02-06 10:31:31 dovecot_login authenticator failed for ([196.200.227.194]) [196.200.227.194]:34714: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.175
country_id: 1819730
description:
2025-02-06 10:31:02 dovecot_login authenticator failed for ([121.202.153.175]) [121.202.153.175]:18047: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.178.175
country_id: 2661886
description:
2025-02-06 10:31:41 dovecot_login authenticator failed for 94-255-178-175.cust.bredband2.com [94.255.178.175]:54718: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.168.26.166
country_id: 6252001
description:
2025-02-06 10:31:47 dovecot_login authenticator failed for syn-024-168-026-166.res.spectrum.com [24.168.26.166]:44884: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 10:31:18 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.115.37
country_id: 338010
description:
2025-02-06 10:31:59 dovecot_plain authenticator failed for ([197.156.115.37]) [197.156.115.37]:36028: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.158.42
country_id: 3469034
description:
2025-02-06 10:32:13 dovecot_login authenticator failed for ([186.200.158.42]) [186.200.158.42]:49925: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2025-02-06 10:32:28 dovecot_login authenticator failed for ([123.129.245.249]) [123.129.245.249]:45998: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 10:32:46 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 209.14.117.78
country_id: 3686110
description:
[2025-02-06 10:32:49 +0100] info [webmaild] 209.14.117.78 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.10.252.174
country_id: 1643084
description:
Feb  6 10:33:20 ait sshd[1107188]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.10.252.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 10:33:43 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.209.213.248
country_id: 3658394
description:
[2025-02-06 10:33:17 +0100] info [webmaild] 186.209.213.248 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.10.252.174
country_id: 1643084
description:
Feb  6 10:33:20 ait sshd[1107188]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.10.252.174


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.190.204.36
country_id: 1210997
description:
[2025-02-06 10:33:37 +0100] info [webmaild] 103.190.204.36 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 162.216.161.76
country_id: 3489940
description:
[2025-02-06 10:33:03 +0100] info [webmaild] 162.216.161.76 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.0.170
country_id: 3585968
description:
2025-02-06 10:34:37 dovecot_plain authenticator failed for ([179.51.0.170]) [179.51.0.170]:58880: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
country_id: 3469034
description:
2025-02-06 10:34:39 dovecot_plain authenticator failed for ([186.200.249.162]) [186.200.249.162]:60059: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.239.241.198
country_id: 1814991
description:
2025-02-06 10:34:41 dovecot_plain authenticator failed for ([115.239.241.198]) [115.239.241.198]:57712: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.224.22.135
country_id: 6252001
description:
2025-02-06 10:34:49 dovecot_plain authenticator failed for ([50.224.22.135]) [50.224.22.135]:38802: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.198.31
country_id: 1814991
description:
2025-02-06 10:34:11 dovecot_plain authenticator failed for ([183.167.198.31]) [183.167.198.31]:39840: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.43.232.65
country_id: 2017370
description:
2025-02-06 10:34:37 dovecot_plain authenticator failed for (DGV-gw.transtelecom.net) [188.43.232.65]:33514: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.171.137.226
country_id: 1814991
description:
2025-02-06 10:34:17 dovecot_plain authenticator failed for ([60.171.137.226]) [60.171.137.226]:39124: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.184
country_id: 1269750
description:
2025-02-06 10:34:45 dovecot_plain authenticator failed for (nsg-corporate-184.230.187.122.airtel.in) [122.187.230.184]:36959: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.170.20
country_id: 2017370
description:
2025-02-06 10:34:00 dovecot_plain authenticator failed for broadband-188-32-170-20.ip.moscow.rt.ru [188.32.170.20]:49450: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.195.155
country_id: 6252001
description:
2025-02-06 10:34:38 dovecot_plain authenticator failed for ([166.195.195.155]) [166.195.195.155]:41899: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.184
country_id: 1668284
description:
2025-02-06 10:34:42 dovecot_plain authenticator failed for 111-70-49-184.emome-ip.hinet.net [111.70.49.184]:57405: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.11.160.60
country_id: 1814991
description:
2025-02-06 10:34:42 dovecot_plain authenticator failed for ([121.11.160.60]) [121.11.160.60]:57220: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.243.62
country_id: 1814991
description:
2025-02-06 10:34:41 dovecot_plain authenticator failed for ([183.220.243.62]) [183.220.243.62]:47304: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.246.141
country_id: 290557
description:
2025-02-06 10:34:52 dovecot_plain authenticator failed for ([94.204.246.141]) [94.204.246.141]:60556: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.175
country_id: 1269750
description:
Feb  6 10:34:53 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.19.149
country_id: 1668284
description:
2025-02-06 10:34:30 dovecot_plain authenticator failed for 111-70-19-149.emome-ip.hinet.net [111.70.19.149]:52185: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.0.245.186
country_id: 3469034
description:
2025-02-06 10:34:38 dovecot_plain authenticator failed for 131.0.245.186.core3.com.br [131.0.245.186]:41696: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.140.89.82
country_id: 1835841
description:
2025-02-06 10:34:57 dovecot_plain authenticator failed for ([115.140.89.82]) [115.140.89.82]:46772: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.253.10.61
country_id: 1835841
description:
2025-02-06 10:35:03 dovecot_plain authenticator failed for ([211.253.10.61]) [211.253.10.61]:39322: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
country_id: 3895114
description:
2025-02-06 10:35:08 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:37543: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.190.129.68
country_id: 1835841
description:
2025-02-06 10:35:18 dovecot_plain authenticator failed for ([121.190.129.68]) [121.190.129.68]:40975: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.216.131.225
country_id: 3469034
description:
[2025-02-06 10:35:25 +0100] info [webmaild] 186.216.131.225 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.163.72.16
country_id: 690791
description:
[2025-02-06 10:35:53 +0100] info [webmaild] 188.163.72.16 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.124.42
country_id: 1835841
description:
2025-02-06 10:35:00 dovecot_plain authenticator failed for ([121.189.124.42]) [121.189.124.42]:36484: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.219.117.186
country_id: 1814991
description:
2025-02-06 10:35:05 dovecot_plain authenticator failed for ([60.219.117.186]) [60.219.117.186]:44137: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 10:35:33 ait sshd[1108141]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
country_id: 1835841
description:
2025-02-06 10:34:59 dovecot_plain authenticator failed for ([14.88.228.202]) [14.88.228.202]:60608: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 10:35:33 ait sshd[1108141]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.56.18.8
country_id: 1814991
description:
Feb  6 10:35:46 ait sshd[1108251]: pam_imunify(sshd:auth): [IM360_RBL] The IP 59.56.18.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.119.126.81
country_id: 1835841
description:
2025-02-06 10:34:59 dovecot_plain authenticator failed for ([220.119.126.81]) [220.119.126.81]:58042: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.72.121.10
country_id: 1814991
description:
Feb  6 10:35:19 ait sshd[1108086]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.72.121.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.72.121.10
country_id: 1814991
description:
Feb  6 10:35:19 ait sshd[1108086]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.72.121.10


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.23.189.9
country_id: 2017370
description:
[2025-02-06 10:35:35 +0100] info [webmaild] 37.23.189.9 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.157.107.67
country_id: 2921044
description:
Feb  6 10:34:54 ait sshd[1107695]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.157.107.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.81.78
country_id: 1814991
description:
2025-02-06 10:34:55 dovecot_plain authenticator failed for ([61.51.81.78]) [61.51.81.78]:42492: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.175
country_id: 1269750
description:
2025-02-06 10:34:55 dovecot_plain authenticator failed for (nsg-corporate-175.229.187.122.airtel.in) [122.187.229.175]:50196: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.91.74.187
country_id: 1269750
description:
2025-02-06 10:34:58 dovecot_plain authenticator failed for ([103.91.74.187]) [103.91.74.187]:60824: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.112
country_id: 1880251
description:
2025-02-06 10:35:07 dovecot_plain authenticator failed for (122.11.169-112.unknown.starhub.net.sg) [122.11.169.112]:1370: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 10:35:17 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.77.206
country_id: 1814991
description:
2025-02-06 10:35:34 dovecot_login authenticator failed for (pc0.zz.ha.cn) [218.28.77.206]:56449: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 59.56.18.8
country_id: 1814991
description:
Feb  6 10:35:46 ait sshd[1108251]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.56.18.8


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.148.43
country_id: 1835841
description:
2025-02-06 10:34:59 dovecot_plain authenticator failed for ([183.109.148.43]) [183.109.148.43]:44314: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.157.107.67
country_id: 2921044
description:
Feb  6 10:34:54 ait sshd[1107695]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.157.107.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.247
country_id: 1819730
description:
2025-02-06 10:34:55 dovecot_plain authenticator failed for (m121-202-153-247.smartone.com) [121.202.153.247]:61407: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.112
country_id: 1880251
description:
Feb  6 10:35:05 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.4.133
country_id: 2017370
description:
2025-02-06 10:35:16 dovecot_plain authenticator failed for 89-109-4-133.dynamic.mts-nn.ru [89.109.4.133]:56964: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2025-02-06 10:35:43 dovecot_login authenticator failed for ([196.190.43.138]) [196.190.41.137]:23802: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 10:36:27 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 10:36:37 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.29.184
country_id: 3017382
description:
Feb  6 10:36:42 ait sshd[1108690]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.29.184


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.243.2
country_id: 1814991
description:
2025-02-06 10:35:55 dovecot_plain authenticator failed for ([183.220.243.2]) [183.220.243.2]:45938: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 10:35:59 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.37.205.138
country_id: 3469034
description:
[2025-02-06 10:36:10 +0100] info [webmaild] 191.37.205.138 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.70.158
country_id: 3469034
description:
2025-02-06 10:36:16 dovecot_plain authenticator failed for ([200.151.70.158]) [200.151.70.158]:46632: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.29.184
country_id: 3017382
description:
Feb  6 10:36:42 ait sshd[1108690]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.205.29.184 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 10:37:04 ait sshd[1108757]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.2.234.106
country_id: 2921044
description:
Feb  6 10:37:47 ait sshd[1109060]: pam_imunify(sshd:auth): [IM360_RBL] The IP 212.2.234.106 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 212.2.234.106
country_id: 2921044
description:
Feb  6 10:37:47 ait sshd[1109060]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.2.234.106


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 10:36:58 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 10:37:04 ait sshd[1108757]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.146.123.214
country_id: 1562822
description:
2025-02-06 10:37:39 dovecot_plain authenticator failed for (WIN-5C5TQLCJHF1) [115.146.123.214]:63437: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.240.121.228
country_id: 1819730
description:
Feb  6 10:38:05 ait sshd[1109161]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.240.121.228


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 84.22.115.60
country_id: 2750405
description:
Feb  6 10:38:40 ait sshd[1109408]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.22.115.60


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.98.160.6
country_id: 3469034
description:
[2025-02-06 10:38:41 +0100] info [webmaild] 177.98.160.6 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 216.98.214.102
country_id: 3469034
description:
[2025-02-06 10:37:56 +0100] info [webmaild] 216.98.214.102 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.185.156.25
country_id: 3469034
description:
[2025-02-06 10:38:25 +0100] info [webmaild] 45.185.156.25 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.240.121.228
country_id: 1819730
description:
Feb  6 10:38:05 ait sshd[1109161]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.240.121.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.119.253
country_id: 3865483
description:
2025-02-06 10:38:20 dovecot_login authenticator failed for ([167.250.119.253]) [167.250.119.253]:41363: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.48.152.219
country_id: 3469034
description:
[2025-02-06 10:38:07 +0100] info [webmaild] 179.48.152.219 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.189.61.189
country_id: 3469034
description:
2025-02-06 10:38:29 dovecot_login authenticator failed for (181-189-61-189.ndtelecompb.com.br) [181.189.61.189]:43125: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.22.115.60
country_id: 2750405
description:
Feb  6 10:38:40 ait sshd[1109408]: pam_imunify(sshd:auth): [IM360_RBL] The IP 84.22.115.60 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.63.225
country_id: 1880251
description:
Feb  6 10:39:16 ait sshd[1109600]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.63.225


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.240.49.222
country_id: 6252001
description:
Feb  6 10:39:23 ait sshd[1109749]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.240.49.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.115.211
country_id: 1880251
description:
2025-02-06 10:39:27 dovecot_login authenticator failed for (211.115.156.175.unknown.m1.com.sg) [175.156.115.211]:59822: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.199.11
country_id: 895949
description:
Feb  6 10:39:32 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.199.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.237.178.130
country_id: 3996063
description:
Feb  6 10:38:56 ait sshd[1109446]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.237.178.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.63.225
country_id: 1880251
description:
Feb  6 10:39:16 ait sshd[1109600]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.63.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.199.11
country_id: 895949
description:
2025-02-06 10:39:34 dovecot_plain authenticator failed for (ppp11-lumwana.zamnet.zm) [196.46.199.11]:59923: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.237.178.130
country_id: 3996063
description:
Feb  6 10:38:56 ait sshd[1109446]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.237.178.130


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.99.242.32
country_id: 1269750
description:
2025-02-06 10:39:16 dovecot_login authenticator failed for ([103.98.21.22]) [125.99.242.32]:33688: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.240.49.222
country_id: 6252001
description:
Feb  6 10:39:23 ait sshd[1109749]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.240.49.222


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.110.120.96
country_id: 3469034
description:
2025-02-06 10:39:52 dovecot_plain authenticator failed for ([189.110.120.96]) [189.110.120.96]:59112: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.24.162.217
country_id: 1835841
description:
2025-02-06 10:40:13 dovecot_plain authenticator failed for ([59.24.162.217]) [59.24.162.217]:50267: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.97.198
country_id: 337996
description:
2025-02-06 10:40:15 dovecot_login authenticator failed for ([197.156.97.198]) [197.156.97.198]:50228: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
country_id: 2017370
description:
2025-02-06 10:40:24 dovecot_login authenticator failed for ([92.126.223.175]) [92.126.223.175]:40902: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.173.142.152
country_id: 3865483
description:
[2025-02-06 10:40:32 +0100] info [webmaild] 190.173.142.152 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.106.172.226
country_id: 6252001
description:
2025-02-06 10:39:59 dovecot_plain authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:53288: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.35.160.173
country_id: 3469034
description:
[2025-02-06 10:41:00 +0100] info [webmaild] 189.35.160.173 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.80.166
country_id: 1880251
description:
2025-02-06 10:41:09 dovecot_login authenticator failed for (166.80.156.175.unknown.m1.com.sg) [175.156.80.166]:57050: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 59.92.123.104
country_id: 1269750
description:
Feb  6 10:41:01 ait sshd[1110530]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.92.123.104


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.148.230.157
country_id: 3469034
description:
[2025-02-06 10:41:49 +0100] info [webmaild] 201.148.230.157 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.146.123.214
country_id: 1562822
description:
2025-02-06 10:40:57 dovecot_plain authenticator failed for (WIN-5C5TQLCJHF1) [115.146.123.214]:51073: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.92.123.104
country_id: 1269750
description:
Feb  6 10:41:01 ait sshd[1110530]: pam_imunify(sshd:auth): [IM360_RBL] The IP 59.92.123.104 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.114.136
country_id: 1512440
description:
[2025-02-06 10:41:15 +0100] info [webmaild] 84.54.114.136 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.134
country_id: 1819730
description:
2025-02-06 10:41:20 dovecot_login authenticator failed for ([121.202.152.134]) [121.202.152.134]:29715: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.116.92
country_id: 1880251
description:
47.128.116.92 - - [06/Feb/2025:10:41:53 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21149987 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/main/index.php?option=com_content&view=article&id=132&Itemid=186" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.116.92


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.200.80.226
country_id: 290557
description:
Feb  6 10:42:43 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.200.80.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.80.226
country_id: 290557
description:
2025-02-06 10:42:45 dovecot_login authenticator failed for ([94.200.80.226]) [94.200.80.226]:49885: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.86.212.108
country_id: 6252001
description:
Feb  6 10:42:57 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.86.212.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.86.212.108
country_id: 6252001
description:
2025-02-06 10:42:59 dovecot_login authenticator failed for ([96.86.212.108]) [96.86.212.108]:35180: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.210.174.254
country_id: 1522867
description:
[2025-02-06 10:43:03 +0100] info [webmaild] 91.210.174.254 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.177.152.110
country_id: 290557
description:
[2025-02-06 10:43:34 +0100] info [webmaild] 109.177.152.110 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:10-43.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.36.246.70
country_id: 3469034
description:
[2025-02-06 10:43:54 +0100] info [webmaild] 191.36.246.70 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.115.42.62
country_id: 1814991
description:
Feb  6 10:44:42 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.115.42.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.84.34.55
country_id: 3895114
description:
[2025-02-06 10:44:35 +0100] info [webmaild] 138.84.34.55 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.146.123.214
country_id: 1562822
description:
2025-02-06 10:44:19 dovecot_plain authenticator failed for (WIN-5C5TQLCJHF1) [115.146.123.214]:59365: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.132.207
country_id: 2077456
description:
Feb  6 10:44:28 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.132.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.132.207
country_id: 2077456
description:
2025-02-06 10:44:30 dovecot_plain authenticator failed for 207.132.220.111.sta.wbroadband.net.au [111.220.132.207]:33834: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.115.42.62
country_id: 1814991
description:
2025-02-06 10:44:44 dovecot_plain authenticator failed for ([27.115.42.62]) [27.115.42.62]:52100: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.254.126.238
country_id: 2661886
description:
Feb  6 10:44:45 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.254.126.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
country_id: 2661886
description:
2025-02-06 10:44:47 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se (undis) [83.254.126.238]:57474: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.146.123.214
country_id: 1562822
description:
Feb  6 10:44:17 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.146.123.214 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.229.158.112
country_id: 3469034
description:
[2025-02-06 10:45:48 +0100] info [webmaild] 200.229.158.112 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.123.25.180
country_id: 3437598
description:
[2025-02-06 10:46:22 +0100] info [webmaild] 181.123.25.180 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 10:46:31 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.45
country_id: 298795
description:
Feb  6 10:46:31 ait dovecot[1026999]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.45, lip=136.243.145.84, TLS, session=<XPPrHXYtpZG594kt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.137.210.63
country_id: 3469034
description:
[2025-02-06 10:46:53 +0100] info [webmaild] 177.137.210.63 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.174.216.30
country_id: 3865483
description:
[2025-02-06 10:47:19 +0100] info [webmaild] 181.174.216.30 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.35.237.38
country_id: 1835841
description:
2025-02-06 10:47:26 dovecot_login authenticator failed for ([211.35.237.38]) [211.35.237.38]:35537: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.72.103.74
country_id: 1562822
description:
Feb  6 10:47:45 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.72.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.103.74
country_id: 1562822
description:
2025-02-06 10:47:47 dovecot_login authenticator failed for ([27.72.103.74]) [27.72.103.74]:56144: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.146.123.214
country_id: 1562822
description:
Feb  6 10:47:47 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.146.123.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.35.237.38
country_id: 1835841
description:
Feb  6 10:47:24 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.35.237.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.146.123.214
country_id: 1562822
description:
2025-02-06 10:47:49 dovecot_plain authenticator failed for (WIN-5C5TQLCJHF1) [115.146.123.214]:52713: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.189.90
country_id: 1835841
description:
Feb  6 10:48:49 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.189.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.189.90
country_id: 1835841
description:
2025-02-06 10:48:51 dovecot_plain authenticator failed for ([112.172.189.90]) [112.172.189.90]:54104: 535 Incorrect authentication data (set_id=ads20a00141y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.84.18
country_id: 895949
description:
Feb  6 10:48:22 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.84.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.84.18
country_id: 895949
description:
2025-02-06 10:48:24 dovecot_login authenticator failed for ([41.216.84.18]) [41.216.84.18]:35803: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.139.107.146
country_id: 1269750
description:
Feb  6 10:48:34 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.139.107.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.30.108.247
country_id: 1168579
description:
Feb  6 10:48:46 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.30.108.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.30.108.247
country_id: 1168579
description:
2025-02-06 10:48:48 dovecot_plain authenticator failed for static-host119-30-108-247.link.net.pk [119.30.108.247]:55119: 535 Incorrect authentication data (set_id=jessica1234@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.49.116.82
country_id: 3686110
description:
[2025-02-06 10:48:31 +0100] info [webmaild] 181.49.116.82 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-02-06 10:48:36 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:47984: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.203.122.112
country_id: 6252001
description:
2025-02-06 10:49:01 dovecot_plain authenticator failed for syn-069-203-122-112.res.spectrum.com [69.203.122.112]:40096: 535 Incorrect authentication data (set_id=jessica1234)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.60.194.189
country_id: 2510769
description:
2025-02-06 10:49:32 dovecot_plain authenticator failed for 81.60.194.189.dyn.user.ono.com [81.60.194.189]:34301: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.197.68.116
country_id: 1880251
description:
Feb  6 10:49:35 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.197.68.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
country_id: 1269750
description:
2025-02-06 10:49:03 dovecot_plain authenticator failed for (nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:53389: 535 Incorrect authentication data (set_id=ads20a00141y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.46.220.48
country_id: 3895114
description:
[2025-02-06 10:49:03 +0100] info [webmaild] 190.46.220.48 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.194.8
country_id: 1814991
description:
Feb  6 10:49:17 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.194.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.194.8
country_id: 1814991
description:
2025-02-06 10:49:19 dovecot_plain authenticator failed for ([183.247.194.8]) [183.247.194.8]:36434: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.53.66
country_id: 1668284
description:
2025-02-06 10:49:24 dovecot_plain authenticator failed for (58-115-53-66.twt1.com.tw) [58.115.53.66]:45960: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.0.132
country_id: 99237
description:
[2025-02-06 10:49:31 +0100] info [webmaild] 169.224.0.132 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.68.116
country_id: 1880251
description:
2025-02-06 10:49:37 dovecot_plain authenticator failed for (116.68.197.124.unknown.m1.com.sg) [124.197.68.116]:32808: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.203.122.112
country_id: 6252001
description:
Feb  6 10:48:59 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.203.122.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.123
country_id: 1269750
description:
Feb  6 10:49:01 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.60.194.189
country_id: 2510769
description:
Feb  6 10:49:30 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.60.194.189 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.86.35.30
country_id: 3469034
description:
[2025-02-06 10:50:12 +0100] info [webmaild] 177.86.35.30 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.224.164.194
country_id: 1814991
description:
Feb  6 10:50:23 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.224.164.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.164.194
country_id: 1814991
description:
2025-02-06 10:50:25 dovecot_plain authenticator failed for ([122.224.164.194]) [122.224.164.194]:56624: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.218.163.130
country_id: 1814991
description:
2025-02-06 10:50:32 dovecot_plain authenticator failed for ([58.218.163.130]) [58.218.163.130]:50268: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.99.41.30
country_id: 2635167
description:
Feb  6 10:50:39 ait sshd[1114685]: pam_imunify(sshd:auth): [IM360_RBL] The IP 79.99.41.30 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 79.99.41.30
country_id: 2635167
description:
Feb  6 10:50:39 ait sshd[1114685]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.99.41.30


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:10-50.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.218.163.130
country_id: 1814991
description:
Feb  6 10:50:30 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.218.163.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.84.5.183
country_id: 2077456
description:
Feb  6 10:50:38 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.84.5.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.84.5.183
country_id: 2077456
description:
2025-02-06 10:50:40 dovecot_plain authenticator failed for (210-84-5-183.tpgi.com.au) [210.84.5.183]:48421: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.223.203
country_id: 1835841
description:
2025-02-06 10:50:58 dovecot_plain authenticator failed for ([210.99.223.203]) [210.99.223.203]:40094: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.161.138.91
country_id: 6254930
description:
[2025-02-06 10:51:24 +0100] info [webmaild] 188.161.138.91 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.98
country_id: 1269750
description:
2025-02-06 10:51:39 dovecot_plain authenticator failed for ([103.190.91.98]) [103.190.91.98]:50688: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.94.106
country_id: 1814991
description:
2025-02-06 10:51:53 dovecot_plain authenticator failed for ([60.191.94.106]) [60.191.94.106]:47830: 535 Incorrect authentication data (set_id=ads20b00294y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.146.123.214
country_id: 1562822
description:
2025-02-06 10:51:18 dovecot_plain authenticator failed for (WIN-5C5TQLCJHF1) [115.146.123.214]:61444: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.110.38.245
country_id: 130758
description:
2025-02-06 10:51:29 dovecot_plain authenticator failed for (Hosting-Vip) [195.110.38.245]:5682: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.195.65
country_id: 6252001
description:
Feb  6 10:51:42 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.215.195.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.17.90.246
country_id: 6252001
description:
2025-02-06 10:51:49 dovecot_plain authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:36198: 535 Incorrect authentication data (set_id=eng20b00167y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.164.28
country_id: 1269750
description:
Feb  6 10:51:51 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.164.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.223.203
country_id: 1835841
description:
Feb  6 10:50:56 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.223.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.146.123.214
country_id: 1562822
description:
Feb  6 10:51:16 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.146.123.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.215.195.65
country_id: 6252001
description:
2025-02-06 10:51:44 dovecot_login authenticator failed for (162-215-195-65.unifiedlayer.com) [162.215.195.65]:57488: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.110.38.245
country_id: 130758
description:
Feb  6 10:51:27 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.110.38.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.98
country_id: 1269750
description:
Feb  6 10:51:37 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.17.90.246
country_id: 6252001
description:
Feb  6 10:51:47 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.17.90.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.191.94.106
country_id: 1814991
description:
Feb  6 10:51:51 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.191.94.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.164.28
country_id: 1269750
description:
2025-02-06 10:51:53 dovecot_plain authenticator failed for (abts-north-static-028.164.160.122.airtelbroadband.in) [122.160.164.28]:50490: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.247
country_id: 1269750
description:
Feb  6 10:51:57 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.139
country_id: 1835841
description:
Feb  6 10:52:03 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.240.170.17
country_id: 3469034
description:
[2025-02-06 10:52:24 +0100] info [webmaild] 186.240.170.17 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.172.56.175
country_id: 3469034
description:
[2025-02-06 10:51:57 +0100] info [webmaild] 45.172.56.175 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
country_id: 1269750
description:
2025-02-06 10:51:59 dovecot_plain authenticator failed for (nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:58275: 535 Incorrect authentication data (set_id=eng20b00167y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.139
country_id: 1835841
description:
2025-02-06 10:52:05 dovecot_plain authenticator failed for ([61.108.83.254]) [61.108.83.139]:34689: 535 Incorrect authentication data (set_id=ads20b00294y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.173
country_id: 1814991
description:
Feb  6 10:52:07 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.173
country_id: 1814991
description:
2025-02-06 10:52:09 dovecot_login authenticator failed for ([182.135.66.173]) [182.135.66.173]:39546: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.106.154.237
country_id: 294640
description:
2025-02-06 10:53:13 dovecot_login authenticator failed for ([149.106.154.237]) [149.106.154.237]:57584: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-02-06 10:53:24 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:48317: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.81
country_id: 1814991
description:
2025-02-06 10:53:36 dovecot_plain authenticator failed for ([183.249.1.81]) [183.249.1.81]:35470: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.81
country_id: 1814991
description:
Feb  6 10:53:34 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.21.7.12
country_id: 1814991
description:
Feb  6 10:53:19 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.21.7.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.21.7.12
country_id: 1814991
description:
2025-02-06 10:53:21 dovecot_plain authenticator failed for ([210.21.7.12]) [210.21.7.12]:43220: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.102.242
country_id: 290557
description:
Feb  6 10:53:22 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.102.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.243.2
country_id: 1814991
description:
Feb  6 10:53:22 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.243.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.6.0.61
country_id: 3469034
description:
[2025-02-06 10:53:04 +0100] info [webmaild] 45.6.0.61 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.53.18.44
country_id: 1149361
description:
Feb  6 10:53:07 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.53.18.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.106.154.237
country_id: 294640
description:
Feb  6 10:53:11 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.106.154.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.243.2
country_id: 1814991
description:
2025-02-06 10:53:24 dovecot_plain authenticator failed for ([183.220.243.2]) [183.220.243.2]:40820: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.53.18.44
country_id: 1149361
description:
2025-02-06 10:53:09 dovecot_plain authenticator failed for ([103.53.18.44]) [103.53.18.44]:43908: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.124.47.11
country_id: 1814991
description:
Feb  6 10:53:49 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.124.47.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.124.47.11
country_id: 1814991
description:
2025-02-06 10:53:51 dovecot_plain authenticator failed for ([111.124.47.11]) [111.124.47.11]:53498: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.235.148.73
country_id: 1562822
description:
Feb  6 10:54:00 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.235.148.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.235.148.73
country_id: 1562822
description:
2025-02-06 10:54:02 dovecot_plain authenticator failed for ([171.235.148.73]) [171.235.148.73]:57498: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.161.68.150
country_id: 1210997
description:
[2025-02-06 10:54:19 +0100] info [webmaild] 103.161.68.150 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.92.51.188
country_id: 1269750
description:
Feb  6 10:54:44 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.92.51.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.110.38.245
country_id: 130758
description:
Feb  6 10:54:17 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.110.38.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 10:54:30 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.180.52.57
country_id: 3017382
description:
Feb  6 10:54:22 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.180.52.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.110.38.245
country_id: 130758
description:
2025-02-06 10:54:19 dovecot_plain authenticator failed for (Hosting-Vip) [195.110.38.245]:15007: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.180.52.57
country_id: 3017382
description:
2025-02-06 10:54:24 dovecot_plain authenticator failed for i15-les03-ix2-176-180-52-57.dsl.dyn.abo.bbox.fr (hyped) [176.180.52.57]:52586: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.249.32.137
country_id: 3625428
description:
[2025-02-06 10:54:49 +0100] info [webmaild] 167.249.32.137 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.90.195.68
country_id: 953987
description:
2025-02-06 10:55:37 dovecot_plain authenticator failed for (197-90-195-68.dyn.mweb.co.za) [197.90.195.68]:42260: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.6.226.138
country_id: 3658394
description:
[2025-02-06 10:55:38 +0100] info [webmaild] 45.6.226.138 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
country_id: 2661886
description:
Feb  6 10:55:48 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-02-06 10:55:50 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (criver) [81.225.30.107]:34171: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.64.170.74
country_id: 3624060
description:
[2025-02-06 10:55:05 +0100] info [webmaild] 186.64.170.74 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 10:55:05 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:10-55.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.90.195.68
country_id: 953987
description:
Feb  6 10:55:35 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.90.195.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.24.37.27
country_id: 6251999
description:
Feb  6 10:55:58 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.24.37.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.24.37.27
country_id: 6251999
description:
2025-02-06 10:56:00 dovecot_plain authenticator failed for (192-24-37-27.nftctelecom.com) [192.24.37.27]:40204: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.199.61.30
country_id: 3658394
description:
[2025-02-06 10:56:52 +0100] info [webmaild] 181.199.61.30 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.227.214.33
country_id: 1835841
description:
Feb  6 10:56:53 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.227.214.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.227.214.33
country_id: 1835841
description:
2025-02-06 10:56:55 dovecot_plain authenticator failed for ([182.227.214.33]) [182.227.214.33]:38528: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.110.38.245
country_id: 130758
description:
2025-02-06 10:57:13 dovecot_plain authenticator failed for (Hosting-Vip) [195.110.38.245]:39295: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.110.38.245
country_id: 130758
description:
Feb  6 10:57:11 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.110.38.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.65.21
country_id: 1814991
description:
2025-02-06 10:57:28 dovecot_plain authenticator failed for ([183.220.65.21]) [183.220.65.21]:41306: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.6.164.231
country_id: 3932488
description:
[2025-02-06 10:57:22 +0100] info [webmaild] 179.6.164.231 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
country_id: 1522867
description:
2025-02-06 10:57:45 dovecot_plain authenticator failed for (semizing) [109.166.70.166]:59798: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.65.21
country_id: 1814991
description:
Feb  6 10:57:26 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.65.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.185.79.32
country_id: 3469034
description:
[2025-02-06 10:57:42 +0100] info [webmaild] 191.185.79.32 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
country_id: 1522867
description:
Feb  6 10:57:43 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.20.137
country_id: 3175395
description:
2025-02-06 10:58:17 dovecot_plain authenticator failed for ([2.192.20.137]) [2.192.20.137]:36882: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  6 10:58:21 ait sshd[1118016]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.90.250
country_id: 1814991
description:
Feb  6 10:58:06 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.90.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.7.214.111
country_id: 3469034
description:
[2025-02-06 10:58:15 +0100] info [webmaild] 201.7.214.111 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.192.20.137
country_id: 3175395
description:
Feb  6 10:58:15 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.192.20.137 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 10:58:16 ait sshd[1117989]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.90.250
country_id: 1814991
description:
2025-02-06 10:58:08 dovecot_plain authenticator failed for ([58.18.90.250]) [58.18.90.250]:42125: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:10-58.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 10:58:16 ait sshd[1117989]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  6 10:58:21 ait sshd[1118016]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.121.92
country_id: 99237
description:
[2025-02-06 10:59:28 +0100] info [webmaild] 169.224.121.92 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.15
country_id: 6251999
description:
Feb  6 10:59:47 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.15
country_id: 6251999
description:
2025-02-06 10:59:49 dovecot_plain authenticator failed for ([207.219.222.15]) [207.219.222.15]:42708: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.19.128
country_id: 1880251
description:
47.128.19.128 - - [06/Feb/2025:10:59:20 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17634968 HTTP/1.1" 302 0 www.aitedu.us "http://www.aitedu.us/spcp/index.php?Itemid=124&option=com_joomgallery&view=toplist" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.19.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.110.38.245
country_id: 130758
description:
Feb  6 11:00:10 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.110.38.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.215.199.37
country_id: 1819730
description:
2025-02-06 11:00:28 dovecot_plain authenticator failed for ([125.215.199.37]) [125.215.199.37]:57721: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.37.223.58
country_id: 3175395
description:
Feb  6 11:00:40 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.37.223.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
country_id: 3175395
description:
2025-02-06 11:00:42 dovecot_plain authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:53260: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.215.199.37
country_id: 1819730
description:
Feb  6 11:00:26 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.215.199.37 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.84.151.25
country_id: 3469034
description:
[2025-02-06 11:00:42 +0100] info [webmaild] 177.84.151.25 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.120.118.27
country_id: 6290252
description:
[2025-02-06 10:59:57 +0100] info [webmaild] 188.120.118.27 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.68
country_id: 1269750
description:
Feb  6 11:00:02 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.68
country_id: 1269750
description:
2025-02-06 11:00:04 dovecot_plain authenticator failed for ([144.48.49.68]) [144.48.49.68]:53403: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.133.152.217
country_id: 3439705
description:
[2025-02-06 11:00:10 +0100] info [webmaild] 190.133.152.217 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.110.38.245
country_id: 130758
description:
2025-02-06 11:00:12 dovecot_plain authenticator failed for (Hosting-Vip) [195.110.38.245]:30327: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.158.5.59
country_id: 6252001
description:
Feb  6 11:01:11 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.158.5.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.158.5.59
country_id: 6252001
description:
2025-02-06 11:01:13 dovecot_plain authenticator failed for 47-158-5-59.lsan.ca.frontiernet.net [47.158.5.59]:62534: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.249.93
country_id: 6252001
description:
Feb  6 11:01:01 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.249.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.249.93
country_id: 6252001
description:
2025-02-06 11:01:03 dovecot_plain authenticator failed for ([96.79.249.93]) [96.79.249.93]:47802: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-01.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.15.126
country_id: 1149361
description:
Feb  6 11:02:33 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.15.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.183.73.97
country_id: 3469034
description:
[2025-02-06 11:02:41 +0100] info [webmaild] 45.183.73.97 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.176.58.81
country_id: 2542007
description:
[2025-02-06 11:02:05 +0100] info [webmaild] 160.176.58.81 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.190.110.210
country_id: 1814991
description:
2025-02-06 11:02:16 dovecot_plain authenticator failed for ([222.190.110.210]) [222.190.110.210]:42640: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.154.90.47
country_id: 1835841
description:
Feb  6 11:02:21 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.154.90.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2025-02-06 11:02:25 dovecot_plain authenticator failed for ([121.179.93.147]) [121.179.93.147]:44502: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.197.86
country_id: 1819730
description:
2025-02-06 11:02:31 dovecot_plain authenticator failed for ([121.202.197.86]) [121.202.197.86]:29886: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.120.192.105
country_id: 732800
description:
Feb  6 11:02:30 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.120.192.105 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.177.174.17
country_id: 3658394
description:
[2025-02-06 11:02:35 +0100] info [webmaild] 102.177.174.17 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.120.192.105
country_id: 732800
description:
2025-02-06 11:02:32 dovecot_plain authenticator failed for (109-120-192-105.ip.btc-net.bg) [109.120.192.105]:60558: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.126
country_id: 1149361
description:
2025-02-06 11:02:35 dovecot_plain authenticator failed for ([149.54.15.126]) [149.54.15.126]:57912: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.190.110.210
country_id: 1814991
description:
Feb  6 11:02:14 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.190.110.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.170.154
country_id: 1835841
description:
Feb  6 11:02:15 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.170.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
country_id: 1835841
description:
Feb  6 11:02:23 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.197.86
country_id: 1819730
description:
Feb  6 11:02:29 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.197.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.170.154
country_id: 1835841
description:
2025-02-06 11:02:17 dovecot_plain authenticator failed for ([211.44.170.154]) [211.44.170.154]:35168: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.47
country_id: 1835841
description:
2025-02-06 11:02:23 dovecot_plain authenticator failed for ([121.154.90.47]) [121.154.90.47]:46638: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.115.54.49
country_id: 1668284
description:
Feb  6 11:02:38 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.115.54.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.54.49
country_id: 1668284
description:
2025-02-06 11:02:40 dovecot_plain authenticator failed for (58-115-54-49.twt1.com.tw) [58.115.54.49]:48551: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.168.246
country_id: 1269750
description:
2025-02-06 11:03:20 dovecot_plain authenticator failed for (host103-171-169-246.renubroadband.com) [103.171.168.246]:55212: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.156.255.186
country_id: 6252001
description:
Feb  6 11:03:28 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.156.255.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-02-06 11:03:29 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:50226: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.123
country_id: 1269750
description:
Feb  6 11:03:31 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.97.253.246
country_id: 6252001
description:
Feb  6 11:03:16 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.97.253.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.4.102
country_id: 3469034
description:
Feb  6 11:03:16 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.4.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.233.177
country_id: 1269750
description:
Feb  6 11:03:17 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.233.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.123
country_id: 1269750
description:
2025-02-06 11:03:33 dovecot_plain authenticator failed for ([103.146.233.123]) [103.146.233.123]:41347: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.213.57.49
country_id: 1835841
description:
2025-02-06 11:03:33 dovecot_plain authenticator failed for ([182.213.57.49]) [182.213.57.49]:54576: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.175.8.140
country_id: 1835841
description:
Feb  6 11:03:44 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.175.8.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
country_id: 1880251
description:
Feb  6 11:03:21 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.142.135
country_id: 1562822
description:
Feb  6 11:03:31 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.142.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.200.77.33
country_id: 2017370
description:
2025-02-06 11:03:31 dovecot_plain authenticator failed for ([37.200.77.33]) [37.200.77.33]:57548: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.12.201.7
country_id: 1835841
description:
Feb  6 11:03:19 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.12.201.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.113.43.143
country_id: 1269750
description:
2025-02-06 11:03:19 dovecot_plain authenticator failed for vps-b909f986.vps.ovh.ca [148.113.43.143]:49386: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.200.77.33
country_id: 2017370
description:
Feb  6 11:03:29 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.200.77.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.252.209.189
country_id: 6252001
description:
2025-02-06 11:03:17 dovecot_plain authenticator failed for ([195.252.209.189]) [195.252.209.189]:51865: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.217.162
country_id: 1814991
description:
Feb  6 11:03:47 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.217.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.248.31.142
country_id: 1835841
description:
2025-02-06 11:03:25 dovecot_plain authenticator failed for ([211.248.31.142]) [211.248.31.142]:33630: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.178.103.119
country_id: 6252001
description:
Feb  6 11:03:30 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.178.103.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.102.188.188
country_id: 1668284
description:
2025-02-06 11:03:32 dovecot_plain authenticator failed for (59-102-188-188.nty.dynamic.tbcnet.net.tw) [59.102.188.188]:36113: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.39.163
country_id: 1668284
description:
2025-02-06 11:03:34 dovecot_plain authenticator failed for 111-70-39-163.emome-ip.hinet.net [111.70.39.163]:43214: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.126.185
country_id: 337996
description:
Feb  6 11:03:14 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.126.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.7.86.144
country_id: 1814991
description:
Feb  6 11:03:17 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.7.86.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
country_id: 1835841
description:
2025-02-06 11:03:20 dovecot_plain authenticator failed for ([1.227.228.136]) [1.227.228.136]:33849: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.10
country_id: 2077456
description:
2025-02-06 11:03:43 dovecot_plain authenticator failed for ([203.189.124.10]) [203.189.124.10]:49241: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.49.3.38
country_id: 3686110
description:
Feb  6 11:03:51 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.49.3.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.138
country_id: 1835841
description:
2025-02-06 11:03:25 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:37275: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.243.79.22
country_id: 3469034
description:
Feb  6 11:03:33 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.243.79.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.58.73.238
country_id: 1814991
description:
Feb  6 11:03:36 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.58.73.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.78.179.108
country_id: 1835841
description:
Feb  6 11:03:18 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.78.179.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.248.31.142
country_id: 1835841
description:
Feb  6 11:03:23 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.248.31.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.248.205.14
country_id: 1814991
description:
2025-02-06 11:03:28 dovecot_plain authenticator failed for ([220.248.205.15]) [220.248.205.14]:1268: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.6.16.137
country_id: 1835841
description:
2025-02-06 11:03:33 dovecot_plain authenticator failed for ([14.6.16.137]) [14.6.16.137]:58150: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.201.7
country_id: 1835841
description:
2025-02-06 11:03:21 dovecot_plain authenticator failed for ([59.12.201.7]) [59.12.201.7]:47373: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.49.3.38
country_id: 3686110
description:
2025-02-06 11:03:53 dovecot_plain authenticator failed for ([181.49.3.38]) [181.49.3.38]:57366: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.4.102
country_id: 3469034
description:
2025-02-06 11:03:18 dovecot_plain authenticator failed for ([200.149.4.102]) [200.149.4.102]:42314: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.202
country_id: 1269750
description:
Feb  6 11:03:20 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.252.147
country_id: 2077456
description:
2025-02-06 11:03:42 dovecot_plain authenticator failed for 122-148-252-147.sta.wbroadband.net.au [122.148.252.147]:56543: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.68.208
country_id: 1835841
description:
Feb  6 11:03:51 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.125.68.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.252.209.189
country_id: 6252001
description:
Feb  6 11:03:15 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.252.209.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.251
country_id: 1819730
description:
2025-02-06 11:03:19 dovecot_plain authenticator failed for (m121-202-204-251.smartone.com) [121.202.204.251]:22436: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2025-02-06 11:03:27 dovecot_plain authenticator failed for ([196.190.43.139]) [196.190.41.137]:12284: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.178.103.119
country_id: 6252001
description:
2025-02-06 11:03:32 dovecot_plain authenticator failed for syn-076-178-103-119.res.spectrum.com [76.178.103.119]:18353: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.39.163
country_id: 1668284
description:
Feb  6 11:03:32 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.39.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.208.238
country_id: 1814991
description:
2025-02-06 11:03:33 dovecot_plain authenticator failed for ([221.195.208.238]) [221.195.208.238]:32122: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-02-06 11:03:18 dovecot_plain authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:38282: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
country_id: 1835841
description:
Feb  6 11:03:18 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.61
country_id: 1819730
description:
Feb  6 11:03:30 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
country_id: 1814991
description:
2025-02-06 11:03:37 dovecot_plain authenticator failed for ([111.50.70.34]) [111.50.70.34]:58857: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.58.73.238
country_id: 1814991
description:
2025-02-06 11:03:38 dovecot_plain authenticator failed for ([218.58.73.238]) [218.58.73.238]:49987: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.137.140
country_id: 1814991
description:
2025-02-06 11:03:47 dovecot_plain authenticator failed for ([120.236.137.140]) [120.236.137.140]:52258: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.217.162
country_id: 1814991
description:
2025-02-06 11:03:49 dovecot_plain authenticator failed for ([124.115.217.162]) [124.115.217.162]:47004: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.21.141.54
country_id: 1269750
description:
2025-02-06 11:03:23 dovecot_plain authenticator failed for ([125.21.141.54]) [125.21.141.54]:55506: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.119.32
country_id: 1861060
description:
2025-02-06 11:03:28 dovecot_plain authenticator failed for p72033-obmd01.osaka.ocn.ne.jp [180.7.119.32]:35919: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.142.135
country_id: 1562822
description:
2025-02-06 11:03:33 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:64359: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.242.221.233
country_id: 3469034
description:
[2025-02-06 11:03:14 +0100] info [webmaild] 191.242.221.233 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
country_id: 1814991
description:
Feb  6 11:03:35 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.23.209.47
country_id: 3865483
description:
Feb  6 11:03:17 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.23.209.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.102.188.188
country_id: 1668284
description:
Feb  6 11:03:30 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.102.188.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.155.191.166
country_id: 1814991
description:
Feb  6 11:03:16 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.155.191.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.123.175.194
country_id: 1814991
description:
Feb  6 11:03:28 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.123.175.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.123.175.194
country_id: 1814991
description:
2025-02-06 11:03:30 dovecot_plain authenticator failed for ([183.56.179.201]) [119.123.175.194]:8832: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.35.188.202
country_id: 2921044
description:
Feb  6 11:03:34 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.35.188.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.243.79.22
country_id: 3469034
description:
2025-02-06 11:03:35 dovecot_plain authenticator failed for 191-243-79-22.telecomconectividade.net.br [191.243.79.22]:47488: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.185
country_id: 337996
description:
2025-02-06 11:03:16 dovecot_plain authenticator failed for ([196.189.126.185]) [196.189.126.185]:57288: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.155.191.166
country_id: 1814991
description:
2025-02-06 11:03:18 dovecot_plain authenticator failed for ([39.155.191.166]) [39.155.191.166]:9396: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.7.86.144
country_id: 1814991
description:
2025-02-06 11:03:19 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [123.7.86.144]:55326: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.233.177
country_id: 1269750
description:
2025-02-06 11:03:19 dovecot_plain authenticator failed for (nsg-corporate-177.233.187.122.airtel.in) [122.187.233.177]:44924: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.23.209.47
country_id: 3865483
description:
2025-02-06 11:03:19 dovecot_plain authenticator failed for (cpe-186-23-209-47.telecentro-reversos.com.ar) [186.23.209.47]:52084: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
country_id: 1168579
description:
2025-02-06 11:03:27 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:50395: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.92.25.206
country_id: 1835841
description:
Feb  6 11:03:46 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.92.25.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.110.38.245
country_id: 130758
description:
2025-02-06 11:03:15 dovecot_plain authenticator failed for (Hosting-Vip) [195.110.38.245]:52098: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.146.210.180
country_id: 2017370
description:
2025-02-06 11:03:17 dovecot_plain authenticator failed for mail-02.03.perm.ru [46.146.210.180]:45125: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
country_id: 6252001
description:
Feb  6 11:03:27 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.205
country_id: 1269750
description:
2025-02-06 11:03:35 dovecot_plain authenticator failed for (nsg-corporate-205.230.187.122.airtel.in) [122.187.230.205]:38472: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.148.252.147
country_id: 2077456
description:
Feb  6 11:03:40 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.148.252.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.137.140
country_id: 1814991
description:
Feb  6 11:03:45 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.137.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.10
country_id: 2077456
description:
Feb  6 11:03:41 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.113.43.143
country_id: 1269750
description:
Feb  6 11:03:17 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.113.43.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.197.237.177
country_id: 1880251
description:
2025-02-06 11:03:21 dovecot_plain authenticator failed for (177.237.197.116.unknown.m1.com.sg) [116.197.237.177]:59858: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.213.57.49
country_id: 1835841
description:
Feb  6 11:03:31 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.213.57.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.146.210.180
country_id: 2017370
description:
Feb  6 11:03:15 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.146.210.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.195.208.238
country_id: 1814991
description:
Feb  6 11:03:31 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.195.208.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.10.127.167
country_id: 1814991
description:
Feb  6 11:03:34 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.10.127.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.218.133.106
country_id: 1269750
description:
Feb  6 11:03:37 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.218.133.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.165.148.166
country_id: 3469034
description:
Feb  6 11:03:14 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.165.148.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.168.246
country_id: 1269750
description:
Feb  6 11:03:18 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.168.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.61
country_id: 1819730
description:
2025-02-06 11:03:32 dovecot_plain authenticator failed for (m121-202-155-61.smartone.com) [121.202.155.61]:34687: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
country_id: 3469034
description:
2025-02-06 11:03:16 dovecot_plain authenticator failed for (148166.telemar.net.br) [200.165.148.166]:41080: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
country_id: 1835841
description:
Feb  6 11:03:35 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.121
country_id: 1269750
description:
Feb  6 11:03:39 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
country_id: 1168579
description:
Feb  6 11:03:25 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.205
country_id: 1269750
description:
Feb  6 11:03:33 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
country_id: 1835841
description:
2025-02-06 11:03:37 dovecot_plain authenticator failed for ([218.147.6.84]) [218.147.6.84]:52082: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.92.25.206
country_id: 1835841
description:
2025-02-06 11:03:48 dovecot_plain authenticator failed for ([220.92.25.206]) [220.92.25.206]:41118: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.125.68.208
country_id: 1835841
description:
2025-02-06 11:03:53 dovecot_plain authenticator failed for ([175.125.68.208]) [175.125.68.208]:48438: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.41.137
country_id: 337996
description:
Feb  6 11:03:25 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.41.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.205.243.224
country_id: 6252001
description:
2025-02-06 11:03:28 dovecot_plain authenticator failed for (173-205-243-224.ip.mhcable.com) [173.205.243.224]:52926: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.35.188.202
country_id: 2921044
description:
2025-02-06 11:03:36 dovecot_plain authenticator failed for 202-188-035-194.ip-addr.vsenet.de [194.35.188.202]:56220: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.138
country_id: 1835841
description:
Feb  6 11:03:23 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.6.16.137
country_id: 1835841
description:
Feb  6 11:03:31 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.6.16.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.218.133.106
country_id: 1269750
description:
2025-02-06 11:03:39 dovecot_plain authenticator failed for ([103.218.133.106]) [103.218.133.106]:37266: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.175.8.140
country_id: 1835841
description:
2025-02-06 11:03:46 dovecot_plain authenticator failed for ([121.175.8.140]) [121.175.8.140]:39956: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.197.237.177
country_id: 1880251
description:
Feb  6 11:03:19 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.197.237.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.21.141.54
country_id: 1269750
description:
Feb  6 11:03:21 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.21.141.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.202
country_id: 1269750
description:
2025-02-06 11:03:22 dovecot_plain authenticator failed for ([103.146.233.202]) [103.146.233.202]:43034: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.10.127.167
country_id: 1814991
description:
2025-02-06 11:03:36 dovecot_plain authenticator failed for ([116.10.127.167]) [116.10.127.167]:58280: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.121
country_id: 1269750
description:
2025-02-06 11:03:41 dovecot_plain authenticator failed for ([103.146.233.121]) [103.146.233.121]:54474: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.251
country_id: 1819730
description:
Feb  6 11:03:17 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.248.205.14
country_id: 1814991
description:
Feb  6 11:03:26 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.248.205.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.156.255.186
country_id: 6252001
description:
2025-02-06 11:03:30 dovecot_plain authenticator failed for syn-098-156-255-186.res.spectrum.com [98.156.255.186]:55578: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.205.243.224
country_id: 6252001
description:
Feb  6 11:03:26 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.205.243.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.110.38.245
country_id: 130758
description:
Feb  6 11:03:13 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.110.38.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.78.179.108
country_id: 1835841
description:
2025-02-06 11:03:20 dovecot_plain authenticator failed for ([220.78.179.108]) [220.78.179.108]:40447: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
country_id: 1880251
description:
2025-02-06 11:03:23 dovecot_plain authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:4901: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.72.56.178
country_id: 1668284
description:
Feb  6 11:03:56 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.72.56.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.238.192.121
country_id: 2750405
description:
Feb  6 11:03:56 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.238.192.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.142.135
country_id: 1562822
description:
Feb  6 11:04:06 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.142.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.238.192.121
country_id: 2750405
description:
2025-02-06 11:03:58 dovecot_plain authenticator failed for host-5l.vsg1-a.v4.dfn.nl (host-5l.vsg1-a.dfn.nl) [62.238.192.121]:58908: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.72.56.178
country_id: 1668284
description:
2025-02-06 11:03:58 dovecot_plain authenticator failed for ([192.72.56.178]) [192.72.56.178]:45835: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.241.214.127
country_id: 1814991
description:
Feb  6 11:04:04 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.241.214.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.214.127
country_id: 1814991
description:
2025-02-06 11:04:06 dovecot_plain authenticator failed for ([223.241.214.127]) [223.241.214.127]:60830: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.142.135
country_id: 1562822
description:
2025-02-06 11:04:08 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:1790: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 194.169.166.158
country_id: 783754
description:
[2025-02-06 11:04:36 +0100] info [webmaild] 194.169.166.158 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.3.10.73
country_id: 3469034
description:
[2025-02-06 11:05:27 +0100] info [webmaild] 187.3.10.73 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.148.216.117
country_id: 1210997
description:
Feb  6 11:05:39 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.148.216.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.242.165.148
country_id: 1835841
description:
Feb  6 11:05:40 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.242.165.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.216.117
country_id: 1210997
description:
2025-02-06 11:05:41 dovecot_plain authenticator failed for ([103.148.216.98]) [103.148.216.117]:46246: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.242.165.148
country_id: 1835841
description:
2025-02-06 11:05:42 dovecot_plain authenticator failed for ([1.242.165.148]) [1.242.165.148]:48505: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.231.212.78
country_id: 6252001
description:
Feb  6 11:05:50 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.231.212.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.231.212.78
country_id: 6252001
description:
2025-02-06 11:05:52 dovecot_plain authenticator failed for syn-104-231-212-078.res.spectrum.com [104.231.212.78]:49180: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.180.171.23
country_id: 3469034
description:
[2025-02-06 11:05:06 +0100] info [webmaild] 187.180.171.23 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.82.73.242
country_id: 3469034
description:
[2025-02-06 11:06:03 +0100] info [webmaild] 170.82.73.242 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.159.164.28
country_id: 294640
description:
Feb  6 11:06:07 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.159.164.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.24
country_id: 617790
description:
2025-02-06 11:06:29 dovecot_plain authenticator failed for ([185.167.56.24]) [185.167.56.24]:48482: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.4.133
country_id: 2017370
description:
2025-02-06 11:06:49 dovecot_plain authenticator failed for 89-109-4-133.dynamic.mts-nn.ru [89.109.4.133]:53502: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.128.123.34
country_id: 2017370
description:
Feb  6 11:06:47 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.128.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.109.4.133
country_id: 2017370
description:
Feb  6 11:06:47 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.109.4.133 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-06.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.164.28
country_id: 294640
description:
2025-02-06 11:06:09 dovecot_plain authenticator failed for ([85.159.164.28]) [85.159.164.28]:46118: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.165.114
country_id: 6252001
description:
2025-02-06 11:06:13 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:59455: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.189
country_id: 1814991
description:
Feb  6 11:06:23 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.24
country_id: 617790
description:
Feb  6 11:06:27 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.182.234.110
country_id: 6252001
description:
Feb  6 11:06:46 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.182.234.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.34.165.114
country_id: 6252001
description:
Feb  6 11:06:11 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.34.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
country_id: 1835841
description:
Feb  6 11:06:24 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.20.134.78
country_id: 1835841
description:
Feb  6 11:07:21 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.20.134.78 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 93.172.144.50
country_id: 294640
description:
[2025-02-06 11:07:21 +0100] info [webmaild] 93.172.144.50 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
country_id: 1269750
description:
Feb  6 11:06:59 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-02-06 11:07:01 dovecot_plain authenticator failed for ([103.174.34.49]) [103.174.34.49]:50139: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.216.168.226
country_id: 3469034
description:
Feb  6 11:07:06 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.216.168.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.168.226
country_id: 3469034
description:
2025-02-06 11:07:08 dovecot_plain authenticator failed for (200-217-53-25.host.telemar.net.br) [200.216.168.226]:33424: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.20.134.78
country_id: 1835841
description:
2025-02-06 11:07:23 dovecot_plain authenticator failed for ([115.20.134.78]) [115.20.134.78]:53702: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.182.234.110
country_id: 6252001
description:
Feb  6 11:06:54 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.182.234.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.128.123.34
country_id: 2017370
description:
Feb  6 11:06:54 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.128.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 115.231.78.10
country_id: 1814991
description:
Feb  6 11:07:43 ait dovecot[1026999]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=115.231.78.10, lip=136.243.145.84, session=<cGrAaXYtjVJz504K>


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.31.194.203
country_id: 130758
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-08.194.31.194.203


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.112.118.79
country_id: 1527747
description:
[2025-02-06 11:08:48 +0100] info [webmaild] 212.112.118.79 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.93.27
country_id: 1512440
description:
[2025-02-06 11:07:56 +0100] info [webmaild] 213.230.93.27 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.0.56.149
country_id: 3469034
description:
[2025-02-06 11:08:13 +0100] info [webmaild] 170.0.56.149 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 11:08:24 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.13.101.46
country_id: 1814991
description:
Feb  6 11:08:32 ait sshd[1122109]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.101.46


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.237.113.87
country_id: 732800
description:
Feb  6 11:09:24 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.237.113.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.113.87
country_id: 732800
description:
2025-02-06 11:09:26 dovecot_plain authenticator failed for (sabled) [151.237.113.87]:51140: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.191.118.246
country_id: 3469034
description:
[2025-02-06 11:10:51 +0100] info [webmaild] 45.191.118.246 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.71.163.159
country_id: 3469034
description:
[2025-02-06 11:09:56 +0100] info [webmaild] 45.71.163.159 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.149.143.159
country_id: 732800
description:
[2025-02-06 11:10:24 +0100] info [webmaild] 213.149.143.159 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.29.76.99
country_id: 1814991
description:
Feb  6 11:10:37 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.29.76.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.29.76.99
country_id: 1814991
description:
2025-02-06 11:10:39 dovecot_login authenticator failed for ([14.29.76.100]) [14.29.76.99]:6371: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.52.109
country_id: 732800
description:
Feb  6 11:10:48 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
country_id: 732800
description:
2025-02-06 11:10:50 dovecot_login authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:42604: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.150.37.249
country_id: 2017370
description:
Feb  6 11:11:39 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.150.37.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.49.235.214
country_id: 6252001
description:
Feb  6 11:11:03 ait sshd[1123168]: pam_imunify(sshd:auth): [IM360_RBL] The IP 69.49.235.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 69.49.235.214
country_id: 6252001
description:
Feb  6 11:11:03 ait sshd[1123168]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.49.235.214


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.45.164.244
country_id: 3469034
description:
[2025-02-06 11:11:24 +0100] info [webmaild] 189.45.164.244 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.150.37.249
country_id: 2017370
description:
2025-02-06 11:11:41 dovecot_plain authenticator failed for ([217.150.37.249]) [217.150.37.249]:49882: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.4.81.206
country_id: 2658434
description:
Feb  6 11:12:29 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.4.81.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.228.85
country_id: 6252001
description:
Feb  6 11:12:38 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.228.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.29.100.218
country_id: 1814991
description:
Feb  6 11:12:50 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.29.100.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.253.226
country_id: 1269750
description:
Feb  6 11:11:54 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.253.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.71.109
country_id: 1835841
description:
2025-02-06 11:12:05 dovecot_login authenticator failed for ([112.168.71.109]) [112.168.71.109]:35696: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.237.108
country_id: 1814991
description:
Feb  6 11:12:13 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.237.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.231.102.189
country_id: 6252001
description:
2025-02-06 11:12:30 dovecot_plain authenticator failed for ([73.231.102.189]) [73.231.102.189]:55156: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.118.162.194
country_id: 2453866
description:
Feb  6 11:12:32 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.118.162.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.250
country_id: 1819730
description:
Feb  6 11:12:09 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.185
country_id: 337996
description:
2025-02-06 11:12:32 dovecot_plain authenticator failed for ([196.189.126.185]) [196.189.126.185]:39174: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.238.92.245
country_id: 2623032
description:
Feb  6 11:12:41 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.238.92.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2025-02-06 11:12:43 dovecot_plain authenticator failed for (84-238-92-245.ptr.bnaa.dk) [84.238.92.245]:37501: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.22.37.184
country_id: 3144096
description:
2025-02-06 11:12:45 dovecot_plain authenticator failed for ([217.22.37.184]) [217.22.37.184]:59842: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.122.31.214
country_id: 2017370
description:
2025-02-06 11:12:27 dovecot_login authenticator failed for ([91.122.31.214]) [91.122.31.214]:35261: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.247
country_id: 1819730
description:
Feb  6 11:12:29 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.126.185
country_id: 337996
description:
Feb  6 11:12:30 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.126.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.96
country_id: 1814991
description:
Feb  6 11:12:31 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
country_id: 3017382
description:
2025-02-06 11:12:49 dovecot_plain authenticator failed for 104.178.69.85.rev.sfr.net [85.69.178.104]:39740: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.156.85
country_id: 1269750
description:
Feb  6 11:12:01 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.156.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.27.114
country_id: 1814991
description:
2025-02-06 11:12:15 dovecot_login authenticator failed for (114.27.33.36.adsl-pool.ah.cnuninet.net) [36.33.27.114]:47816: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
country_id: 1269750
description:
2025-02-06 11:12:40 dovecot_plain authenticator failed for ([49.249.76.221]) [49.249.76.221]:46956: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
country_id: 2453866
description:
2025-02-06 11:12:34 dovecot_plain authenticator failed for ([154.118.162.194]) [154.118.162.194]:38298: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.249.76.221
country_id: 1269750
description:
Feb  6 11:12:38 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.249.76.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.109.211.44
country_id: 1821275
description:
Feb  6 11:11:55 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.109.211.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.200.95.200
country_id: 2750405
description:
2025-02-06 11:12:04 dovecot_plain authenticator failed for 89-200-95-200.mobile.kpn.net [89.200.95.200]:40950: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.27.114
country_id: 1814991
description:
Feb  6 11:12:13 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.27.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.231.102.189
country_id: 6252001
description:
Feb  6 11:12:28 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.231.102.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.13.99.66
country_id: 1814991
description:
Feb  6 11:12:39 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.13.99.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.161.16.240
country_id: 1835841
description:
2025-02-06 11:12:43 dovecot_plain authenticator failed for ([221.161.16.240]) [221.161.16.240]:35310: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 11:12:54 ait sshd[1123968]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.129.201.81
country_id: 1210997
description:
2025-02-06 11:12:32 dovecot_plain authenticator failed for ([103.129.201.82]) [103.129.201.81]:59414: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.114.215
country_id: 1168579
description:
2025-02-06 11:12:42 dovecot_plain authenticator failed for ([103.123.114.215]) [103.123.114.215]:59670: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.156.85
country_id: 1269750
description:
2025-02-06 11:12:03 dovecot_plain authenticator failed for (abts-north-static-085.156.160.122.airtelbroadband.in) [122.160.156.85]:48314: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.159.117.51
country_id: 690791
description:
Feb  6 11:12:40 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.159.117.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.249
country_id: 3469034
description:
2025-02-06 11:12:39 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.152.249]:53125: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.159.117.51
country_id: 690791
description:
2025-02-06 11:12:42 dovecot_plain authenticator failed for (pool.sevtele.com) [178.159.117.51]:56058: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.13.99.66
country_id: 1814991
description:
2025-02-06 11:12:41 dovecot_plain authenticator failed for ([210.13.99.68]) [210.13.99.66]:30981: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.109.217.15
country_id: 783754
description:
2025-02-06 11:11:59 dovecot_plain authenticator failed for (exabloyst) [192.109.217.15]:34357: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.250
country_id: 1819730
description:
2025-02-06 11:12:11 dovecot_login authenticator failed for (m121-202-154-250.smartone.com) [121.202.154.250]:31099: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.250.249.12
country_id: 1269750
description:
2025-02-06 11:12:23 dovecot_plain authenticator failed for ([45.250.249.12]) [45.250.249.12]:56132: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.250.7.67
country_id: 149590
description:
2025-02-06 11:12:32 dovecot_plain authenticator failed for ([197.250.7.67]) [197.250.7.67]:42860: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.30.127.9
country_id: 1814991
description:
Feb  6 11:12:36 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.30.127.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.226.214
country_id: 6252001
description:
2025-02-06 11:12:49 dovecot_plain authenticator failed for ([75.110.226.214]) [75.110.226.214]:46966: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.109.211.44
country_id: 1821275
description:
2025-02-06 11:11:57 dovecot_plain authenticator failed for nz211l44.bb27109.ctm.net [27.109.211.44]:36648: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.247
country_id: 1819730
description:
2025-02-06 11:12:31 dovecot_plain authenticator failed for (m121-202-153-247.smartone.com) [121.202.153.247]:19674: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.69.178.104
country_id: 3017382
description:
Feb  6 11:12:47 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.69.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.53.114.86
country_id: 6252001
description:
Feb  6 11:12:48 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.53.114.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.53.114.86
country_id: 6252001
description:
2025-02-06 11:12:50 dovecot_plain authenticator failed for syn-067-053-114-086.biz.spectrum.com [67.53.114.86]:34993: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.168.71.109
country_id: 1835841
description:
Feb  6 11:12:03 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.168.71.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.122.31.214
country_id: 2017370
description:
Feb  6 11:12:25 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.122.31.214 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.237.127.230
country_id: 3469034
description:
[2025-02-06 11:12:30 +0100] info [webmaild] 186.237.127.230 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.152.249
country_id: 3469034
description:
Feb  6 11:12:37 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.152.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.110.226.214
country_id: 6252001
description:
Feb  6 11:12:47 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.110.226.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.22.37.184
country_id: 3144096
description:
Feb  6 11:12:43 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.22.37.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-02-06 11:11:58 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:56076: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.200.95.200
country_id: 2750405
description:
Feb  6 11:12:02 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.200.95.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
country_id: 2658434
description:
2025-02-06 11:12:31 dovecot_plain authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:52344: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.184.34.107
country_id: 1835841
description:
Feb  6 11:12:54 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.184.34.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
country_id: 6252001
description:
Feb  6 11:11:56 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.29.130
country_id: 1668284
description:
Feb  6 11:12:04 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.29.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.250.249.12
country_id: 1269750
description:
Feb  6 11:12:21 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.250.249.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.132.229.196
country_id: 3175395
description:
2025-02-06 11:12:32 dovecot_plain authenticator failed for ([185.132.229.196]) [185.132.229.196]:36210: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.96
country_id: 1814991
description:
2025-02-06 11:12:33 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:42710: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2025-02-06 11:11:56 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:36547: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.237.108
country_id: 1814991
description:
2025-02-06 11:12:15 dovecot_plain authenticator failed for ([218.22.237.108]) [218.22.237.108]:42025: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.250.7.67
country_id: 149590
description:
Feb  6 11:12:30 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.250.7.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.129.201.81
country_id: 1210997
description:
Feb  6 11:12:30 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.129.201.81 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 11:12:54 ait sshd[1123968]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.30.127.9
country_id: 1814991
description:
2025-02-06 11:12:38 dovecot_plain authenticator failed for ([112.29.109.174]) [112.30.127.9]:49063: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.161.16.240
country_id: 1835841
description:
Feb  6 11:12:41 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.161.16.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.228.85
country_id: 6252001
description:
2025-02-06 11:12:40 dovecot_login authenticator failed for ([104.241.228.85]) [104.241.228.85]:43270: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.29.100.218
country_id: 1814991
description:
2025-02-06 11:12:52 dovecot_plain authenticator failed for ([60.29.100.218]) [60.29.100.218]:50019: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.109.217.15
country_id: 783754
description:
Feb  6 11:11:57 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.109.217.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.130
country_id: 1668284
description:
2025-02-06 11:12:06 dovecot_login authenticator failed for 111-70-29-130.emome-ip.hinet.net [111.70.29.130]:55539: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-12.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.132.229.196
country_id: 3175395
description:
Feb  6 11:12:30 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.132.229.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.114.215
country_id: 1168579
description:
Feb  6 11:12:40 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.114.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.112.154.174
country_id: 1269750
description:
2025-02-06 11:13:21 dovecot_plain authenticator failed for ([203.112.154.174]) [203.112.154.174]:42646: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.33.204.130
country_id: 2017370
description:
Feb  6 11:13:25 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.33.204.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.12.68.242
country_id: 1814991
description:
2025-02-06 11:13:38 dovecot_plain authenticator failed for ([210.12.68.242]) [210.12.68.242]:52689: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.90.43
country_id: 1814991
description:
2025-02-06 11:13:03 dovecot_plain authenticator failed for ([39.174.90.48]) [39.174.90.43]:44981: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.142.167
country_id: 1814991
description:
Feb  6 11:13:19 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.142.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
country_id: 1562822
description:
2025-02-06 11:12:58 dovecot_plain authenticator failed for ([171.244.40.236]) [171.244.40.236]:51036: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.49.235.214
country_id: 6252001
description:
Feb  6 11:13:04 ait sshd[1124148]: pam_imunify(sshd:auth): [IM360_RBL] The IP 69.49.235.214 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-13.80.76.51.123


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 137.184.235.202
country_id: 6252001
domain: iric.us
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/ph-file-manager/wp-file.php||WPU:||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.12.68.242
country_id: 1814991
description:
Feb  6 11:13:36 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.12.68.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2025-02-06 11:13:21 dovecot_login authenticator failed for ([112.194.142.167]) [112.194.142.167]:34332: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.246.43
country_id: 1814991
description:
Feb  6 11:13:34 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.246.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.34.107
country_id: 1835841
description:
2025-02-06 11:12:56 dovecot_plain authenticator failed for ([112.184.34.107]) [112.184.34.107]:58118: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 69.49.235.214
country_id: 6252001
description:
Feb  6 11:13:04 ait sshd[1124148]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.49.235.214


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2025-02-06 11:13:27 dovecot_plain authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:35600: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
country_id: 3017382
description:
Feb  6 11:13:01 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.112.154.174
country_id: 1269750
description:
Feb  6 11:13:19 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.112.154.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.143.231.208
country_id: 1814991
description:
Feb  6 11:12:55 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.143.231.208 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.28.167.162
country_id: 248816
description:
[2025-02-06 11:13:01 +0100] info [webmaild] 176.28.167.162 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.184.194
country_id: 1814991
description:
2025-02-06 11:13:12 dovecot_plain authenticator failed for ([114.242.172.76]) [61.51.184.194]:48044: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
country_id: 3017382
description:
2025-02-06 11:13:03 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (henizacous) [51.255.84.180]:52716: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
country_id: 1814991
description:
2025-02-06 11:13:36 dovecot_login authenticator failed for ([220.178.246.43]) [220.178.246.43]:58132: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
country_id: 1562822
description:
Feb  6 11:12:56 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.143.231.208
country_id: 1814991
description:
2025-02-06 11:12:57 dovecot_plain authenticator failed for ([43.143.231.208]) [43.143.231.208]:49502: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.184.194
country_id: 1814991
description:
Feb  6 11:13:10 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.184.194 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.163.68.117
country_id: 690791
description:
[2025-02-06 11:13:39 +0100] info [webmaild] 188.163.68.117 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.171.157
country_id: 1814991
description:
Feb  6 11:14:24 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.171.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.164.217.166
country_id: 1814991
description:
2025-02-06 11:14:36 dovecot_login authenticator failed for ([119.164.217.166]) [119.164.217.166]:46256: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.133.206
country_id: 6252001
description:
2025-02-06 11:14:45 dovecot_login authenticator failed for syn-035-130-133-206.biz.spectrum.com [35.130.133.206]:46448: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.168.134.253
country_id: 3469034
description:
[2025-02-06 11:14:26 +0100] info [webmaild] 45.168.134.253 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.133.206
country_id: 6252001
description:
Feb  6 11:14:43 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.133.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.49.235.214
country_id: 6252001
description:
Feb  6 11:14:12 ait sshd[1124730]: pam_imunify(sshd:auth): [IM360_RBL] The IP 69.49.235.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 69.49.235.214
country_id: 6252001
description:
Feb  6 11:14:12 ait sshd[1124730]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.49.235.214


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.49.235.214
country_id: 6252001
description:
Feb  6 11:14:14 ait sshd[1124730]: Failed password for invalid user redash from 69.49.235.214 port 35528 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.171.157
country_id: 1814991
description:
2025-02-06 11:14:26 dovecot_login authenticator failed for ([220.180.171.157]) [220.180.171.157]:39595: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.164.217.166
country_id: 1814991
description:
Feb  6 11:14:34 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.164.217.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.174.209.160
country_id: 1814991
description:
Feb  6 11:15:12 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.174.209.160 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.22.84
country_id: 1880251
description:
47.128.22.84 - - [06/Feb/2025:11:15:20 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=25310330 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/main/index.php?Itemid=81&id=67&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.22.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.99
country_id: 6251999
description:
2025-02-06 11:15:23 dovecot_plain authenticator failed for ([207.219.221.99]) [207.219.221.99]:33351: 535 Incorrect authentication data (set_id=ads19b00191y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.31.161
country_id: 1880251
description:
47.128.31.161 - - [06/Feb/2025:11:15:47 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16896838 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/2/?filtering=1&level=intermediate&rating_filter=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.31.161


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.99
country_id: 6251999
description:
Feb  6 11:15:21 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
country_id: 690791
description:
2025-02-06 11:15:05 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (junsicity) [92.244.126.105]:33449: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.22.104.250
country_id: 1210997
description:
[2025-02-06 11:15:09 +0100] info [webmaild] 160.22.104.250 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.208.158.150
country_id: 6252001
description:
Feb  6 11:15:33 ait sshd[1125518]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.208.158.150


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.174.209.160
country_id: 1814991
description:
2025-02-06 11:15:14 dovecot_plain authenticator failed for ([220.174.209.156]) [220.174.209.160]:39492: 535 Incorrect authentication data (set_id=ads19b00191y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 164.163.75.182
country_id: 3608932
description:
[2025-02-06 11:15:38 +0100] info [webmaild] 164.163.75.182 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
country_id: 1522867
description:
Feb  6 11:16:03 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
country_id: 1522867
description:
2025-02-06 11:16:05 dovecot_plain authenticator failed for (nimper) [109.166.70.166]:65078: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 11:16:23 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 11:17:41 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.94.190
country_id: 1814991
description:
Feb  6 11:16:55 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.94.190 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 175.107.237.160
country_id: 1168579
description:
[2025-02-06 11:17:01 +0100] info [webmaild] 175.107.237.160 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 11:17:21 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.199.57.220
country_id: 6251999
description:
Feb  6 11:17:38 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.199.57.220 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.83.229.160
country_id: 3469034
description:
[2025-02-06 11:17:53 +0100] info [webmaild] 170.83.229.160 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.94.190
country_id: 1814991
description:
2025-02-06 11:16:57 dovecot_login authenticator failed for ([39.164.94.190]) [39.164.94.190]:55828: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.193.235.16
country_id: 290557
description:
[2025-02-06 11:17:39 +0100] info [webmaild] 5.193.235.16 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.199.57.220
country_id: 6251999
description:
2025-02-06 11:17:40 dovecot_login authenticator failed for ([192.199.57.220]) [192.199.57.220]:55236: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.224.155.128
country_id: 3469034
description:
[2025-02-06 11:18:27 +0100] info [webmaild] 186.224.155.128 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.73.164.78
country_id: 2542007
description:
Feb  6 11:18:09 ait sshd[1126845]: pam_imunify(sshd:auth): [IM360_RBL] The IP 105.73.164.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
country_id: 6252001
description:
Feb  6 11:18:23 ait sshd[1126898]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 105.73.164.78
country_id: 2542007
description:
Feb  6 11:18:09 ait sshd[1126845]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=105.73.164.78


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.154.35.184
country_id: 2750405
description:
Feb  6 11:18:20 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.154.35.184 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-17.194.163.182.227


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.13.101.46
country_id: 1814991
description:
Feb  6 11:18:10 ait sshd[1126841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.101.46


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
country_id: 6252001
description:
Feb  6 11:18:23 ait sshd[1126898]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.35.184
country_id: 2750405
description:
2025-02-06 11:18:22 dovecot_plain authenticator failed for ([94.154.35.184]) [94.154.35.184]:58292: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.160.123.6
country_id: 732800
description:
Feb  6 11:19:18 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.160.123.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.212.173.17
country_id: 1835841
description:
2025-02-06 11:19:45 dovecot_plain authenticator failed for ([175.212.173.17]) [175.212.173.17]:39687: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.134.3.252
country_id: 6252001
description:
Feb  6 11:19:53 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.134.3.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.160.123.6
country_id: 732800
description:
2025-02-06 11:19:20 dovecot_plain authenticator failed for (nosclinus) [109.160.123.6]:35528: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.187.240.150
country_id: 3469034
description:
[2025-02-06 11:19:40 +0100] info [webmaild] 179.187.240.150 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.3.252
country_id: 6252001
description:
2025-02-06 11:19:55 dovecot_plain authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:33112: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.233.4.50
country_id: 1814991
description:
2025-02-06 11:19:20 dovecot_plain authenticator failed for ([61.233.4.50]) [61.233.4.50]:41711: 535 Incorrect authentication data (set_id=ads89b99891y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.212.173.17
country_id: 1835841
description:
Feb  6 11:19:43 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.212.173.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.138
country_id: 1835841
description:
Feb  6 11:19:02 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.138 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.167.217.137
country_id: 1643084
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:11-19.103.167.217.137


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.138
country_id: 1835841
description:
2025-02-06 11:19:04 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:57648: 535 Incorrect authentication data (set_id=ads89b99891y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.233.4.50
country_id: 1814991
description:
Feb  6 11:19:18 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.233.4.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.210.222.6
country_id: 192950
description:
[2025-02-06 11:20:44 +0100] info [webmaild] 102.210.222.6 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 90.156.163.139
country_id: 1512440
description:
[2025-02-06 11:20:17 +0100] info [webmaild] 90.156.163.139 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 11:20:42 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 105.73.164.78
country_id: 2542007
description:
Feb  6 11:21:05 ait sshd[1128357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=105.73.164.78


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.104.8.93
country_id: 3469034
description:
[2025-02-06 11:21:17 +0100] info [webmaild] 177.104.8.93 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.197.237.177
country_id: 1880251
description:
Feb  6 11:21:41 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.197.237.177 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.13.101.46
country_id: 1814991
description:
Feb  6 11:21:41 ait sshd[1128559]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.101.46


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.6.102.11
country_id: 1814991
description:
Feb  6 11:21:32 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.6.102.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.197.237.177
country_id: 1880251
description:
2025-02-06 11:21:43 dovecot_login authenticator failed for (177.237.197.116.unknown.m1.com.sg) [116.197.237.177]:48697: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.164.147.150
country_id: 3865483
description:
Feb  6 11:21:46 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.164.147.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.164.147.150
country_id: 3865483
description:
2025-02-06 11:21:48 dovecot_login authenticator failed for (150-147-164-181.fibertel.com.ar) [181.164.147.150]:59170: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.102.11
country_id: 1814991
description:
2025-02-06 11:21:34 dovecot_login authenticator failed for ([183.6.102.11]) [183.6.102.11]:2698: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.73.164.78
country_id: 2542007
description:
Feb  6 11:21:05 ait sshd[1128357]: pam_imunify(sshd:auth): [IM360_RBL] The IP 105.73.164.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.73.164.78
country_id: 2542007
description:
Feb  6 11:22:48 ait sshd[1129282]: pam_imunify(sshd:auth): [IM360_RBL] The IP 105.73.164.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.73
country_id: 1819730
description:
Feb  6 11:21:56 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.19.108
country_id: 298795
description:
Feb  6 11:22:10 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.19.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.19.108
country_id: 298795
description:
2025-02-06 11:22:12 dovecot_plain authenticator failed for ([149.0.19.108]) [149.0.19.108]:55294: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.109.96.111
country_id: 1210997
description:
[2025-02-06 11:22:22 +0100] info [webmaild] 103.109.96.111 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 105.73.164.78
country_id: 2542007
description:
Feb  6 11:22:48 ait sshd[1129282]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=105.73.164.78


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.73
country_id: 1819730
description:
2025-02-06 11:21:58 dovecot_plain authenticator failed for (m121-202-155-73.smartone.com) [121.202.155.73]:31547: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.76.161.99
country_id: 289688
description:
Feb  6 11:21:56 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.76.161.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.76.161.99
country_id: 289688
description:
2025-02-06 11:21:58 dovecot_login authenticator failed for ([89.211.42.163]) [80.76.161.99]:50637: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.73.164.78
country_id: 2542007
description:
Feb  6 11:22:50 ait sshd[1129282]: Failed password for invalid user caja from 105.73.164.78 port 52070 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 223.123.32.62
country_id: 1168579
description:
[2025-02-06 11:23:45 +0100] info [webmaild] 223.123.32.62 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.17.90.246
country_id: 6252001
description:
2025-02-06 11:23:01 dovecot_plain authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:39914: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.247.87.75
country_id: 3996063
description:
2025-02-06 11:23:11 dovecot_plain authenticator failed for ([132.247.87.75]) [132.247.87.75]:49057: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.34
country_id: 1819730
description:
2025-02-06 11:23:36 dovecot_login authenticator failed for (m121-202-152-34.smartone.com) [121.202.152.34]:18244: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 11:23:25 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.34
country_id: 1819730
description:
Feb  6 11:23:34 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.91.84.89
country_id: 3469034
description:
2025-02-06 11:23:49 dovecot_login authenticator failed for ([187.92.76.49]) [201.91.84.89]:40638: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.17.90.246
country_id: 6252001
description:
Feb  6 11:22:59 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.17.90.246 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.247.10.19
country_id: 3469034
description:
[2025-02-06 11:23:00 +0100] info [webmaild] 186.247.10.19 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 132.247.87.75
country_id: 3996063
description:
Feb  6 11:23:09 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 132.247.87.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.84.89
country_id: 3469034
description:
Feb  6 11:23:47 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.84.89 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.250.152.57
country_id: 3932488
description:
[2025-02-06 11:24:12 +0100] info [webmaild] 38.250.152.57 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.147.94
country_id: 290557
description:
Feb  6 11:24:44 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.147.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-02-06 11:24:46 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:32959: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-24.194.163.182.227


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
country_id: 1814991
description:
Feb  6 11:25:36 ait sshd[1130673]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.182.234.110
country_id: 6252001
description:
Feb  6 11:25:10 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.182.234.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.80.58.43
country_id: 3469034
description:
[2025-02-06 11:25:13 +0100] info [webmaild] 170.80.58.43 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.182.234.110
country_id: 6252001
description:
2025-02-06 11:25:12 dovecot_login authenticator failed for (todohogar.sati.com.py-test3) [147.182.234.110]:34408: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.104.14.116
country_id: 3469034
description:
[2025-02-06 11:25:50 +0100] info [webmaild] 177.104.14.116 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
country_id: 1814991
description:
Feb  6 11:25:36 ait sshd[1130673]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 11:26:15 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.159.14.187
country_id: 3469034
description:
2025-02-06 11:26:47 dovecot_plain authenticator failed for (200-168-190-81.jandaia.com) [200.159.14.187]:35576: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.129
country_id: 1835841
description:
2025-02-06 11:26:27 dovecot_plain authenticator failed for ([118.220.149.129]) [118.220.149.129]:45916: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.216.7.163
country_id: 1668284
description:
Feb  6 11:26:46 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.216.7.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
country_id: 3469034
description:
2025-02-06 11:26:16 dovecot_plain authenticator failed for ([186.200.8.115]) [186.200.249.162]:57349: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.122.134
country_id: 99237
description:
[2025-02-06 11:26:20 +0100] info [webmaild] 169.224.122.134 - customerservice@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.220.149.129
country_id: 1835841
description:
Feb  6 11:26:25 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.220.149.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.159.14.187
country_id: 3469034
description:
Feb  6 11:26:45 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.159.14.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
country_id: 3469034
description:
Feb  6 11:26:14 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.216.7.163
country_id: 1668284
description:
2025-02-06 11:26:48 dovecot_plain authenticator failed for 61-216-7-163.hinet-ip.hinet.net ([61.216.7.165]) [61.216.7.163]:39817: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.253.142
country_id: 1269750
description:
Feb  6 11:27:29 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.253.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.76.58.118
country_id: 1835841
description:
2025-02-06 11:27:37 dovecot_plain authenticator failed for ([61.76.58.118]) [61.76.58.118]:60508: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.186.136.36
country_id: 1814991
description:
Feb  6 11:27:48 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.186.136.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.245.207.104
country_id: 1835841
description:
2025-02-06 11:27:08 dovecot_plain authenticator failed for ([1.245.207.104]) [1.245.207.104]:59343: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.92.25.206
country_id: 1835841
description:
2025-02-06 11:27:09 dovecot_plain authenticator failed for ([220.92.25.206]) [220.92.25.206]:39274: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-27.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.245.207.104
country_id: 1835841
description:
Feb  6 11:27:06 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.245.207.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.76.58.118
country_id: 1835841
description:
Feb  6 11:27:35 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.76.58.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.186.136.36
country_id: 1814991
description:
2025-02-06 11:27:50 dovecot_plain authenticator failed for ([61.186.136.36]) [61.186.136.36]:58140: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.253.37
country_id: 1814991
description:
Feb  6 11:27:11 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.253.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.253.37
country_id: 1814991
description:
2025-02-06 11:27:13 dovecot_plain authenticator failed for ([218.22.253.37]) [218.22.253.37]:37860: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.253.142
country_id: 1269750
description:
2025-02-06 11:27:31 dovecot_plain authenticator failed for ([122.165.253.142]) [122.165.253.142]:56946: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.92.25.206
country_id: 1835841
description:
Feb  6 11:27:07 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.92.25.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.67.5.146
country_id: 1814991
description:
Feb  6 11:26:56 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.67.5.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.5.32.171
country_id: 3469034
description:
[2025-02-06 11:26:56 +0100] info [webmaild] 191.5.32.171 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.67.5.146
country_id: 1814991
description:
2025-02-06 11:26:58 dovecot_plain authenticator failed for ([183.67.5.146]) [183.67.5.146]:46859: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.20.122.41
country_id: 3865483
description:
[2025-02-06 11:28:13 +0100] info [webmaild] 181.20.122.41 - customerservice@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.223.192.254
country_id: 3469034
description:
Feb  6 11:28:25 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.223.192.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.37.54
country_id: 1819730
description:
2025-02-06 11:28:32 dovecot_plain authenticator failed for 054.37.246.220.static.netvigator.com [220.246.37.54]:61602: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.139.195
country_id: 1880251
description:
2025-02-06 11:28:51 dovecot_plain authenticator failed for ([175.156.139.195]) [175.156.139.195]:48533: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.157.169.242
country_id: 1269750
description:
2025-02-06 11:28:42 dovecot_plain authenticator failed for (abts-north-dynamic-161.133.176.122.airtelbroadband.in) [103.157.169.242]:43025: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.189.234.37
country_id: 1643084
description:
2025-02-06 11:28:43 dovecot_plain authenticator failed for (ip103-189-234-37.cloudhost.web.id) [103.189.234.37]:53236: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.127.147
country_id: 1835841
description:
2025-02-06 11:28:24 dovecot_plain authenticator failed for ([118.36.127.147]) [118.36.127.147]:51399: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.70.158.32
country_id: 1814991
description:
Feb  6 11:28:33 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.70.158.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.230.179
country_id: 3469034
description:
Feb  6 11:28:39 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.230.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.157.169.242
country_id: 1269750
description:
Feb  6 11:28:40 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.157.169.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.36.127.147
country_id: 1835841
description:
Feb  6 11:28:22 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.36.127.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.102
country_id: 1819730
description:
Feb  6 11:28:43 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.102
country_id: 1819730
description:
2025-02-06 11:28:45 dovecot_plain authenticator failed for ([121.202.152.102]) [121.202.152.102]:26156: 535 Incorrect authentication data (set_id=amadam)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.224.251.91
country_id: 3469034
description:
[2025-02-06 11:28:49 +0100] info [webmaild] 186.224.251.91 - customerservice@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.230.179
country_id: 3469034
description:
2025-02-06 11:28:41 dovecot_plain authenticator failed for 189.115.230.179.dynamic.adsl.gvt.net.br [189.115.230.179]:41377: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.139.195
country_id: 1880251
description:
Feb  6 11:28:49 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.139.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.192.254
country_id: 3469034
description:
2025-02-06 11:28:27 dovecot_plain authenticator failed for ([200.223.193.9]) [200.223.192.254]:39150: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.37.54
country_id: 1819730
description:
Feb  6 11:28:30 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.37.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.70.158.32
country_id: 1814991
description:
2025-02-06 11:28:35 dovecot_plain authenticator failed for ([1.70.158.32]) [1.70.158.32]:44764: 535 Incorrect authentication data (set_id=amadam@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.189.234.37
country_id: 1643084
description:
Feb  6 11:28:41 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.189.234.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.82.12.128
country_id: 6252001
description:
Feb  6 11:29:26 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.82.12.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.82.12.128
country_id: 6252001
description:
2025-02-06 11:29:28 dovecot_plain authenticator failed for (50-82-12-128.client.mchsi.com) [50.82.12.128]:36450: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.4.117.242
country_id: 3469034
description:
[2025-02-06 11:29:43 +0100] info [webmaild] 200.4.117.242 - customerservice@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


