# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.175.110.3
description:
2025-02-04 08:42:05 dovecot_login authenticator failed for ([222.175.110.3]) [222.175.110.3]:49288: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.25.36.197
description:
Feb  4 08:41:12 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.25.36.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.190.181
description:
Feb  4 08:41:25 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.190.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.65.203.82
description:
Feb  4 08:41:29 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.65.203.82 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.222
description:
Feb  4 08:42:11 ait sshd[3997783]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.222  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 08:42:34 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.222
description:
Feb  4 08:42:10 ait sshd[3997783]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.222 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.141.43.107
description:
[2025-02-04 08:42:21 +0100] info [webmaild] 102.141.43.107 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 08:42:30 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.79.195
description:
Feb  4 08:42:58 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.79.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
description:
2025-02-04 08:43:00 dovecot_plain authenticator failed for ([213.55.79.199]) [213.55.79.195]:35114: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.90.213.28
description:
Feb  4 08:44:05 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.90.213.28 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 213.136.78.38
domain: ait.edu.gh
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:08-43.213.136.78.38||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.125.67.109
description:
2025-02-04 08:43:11 dovecot_plain authenticator failed for ([39.125.67.109]) [39.125.67.109]:36634: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.142.210.138
description:
Feb  4 08:43:16 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.142.210.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.179.70.159
description:
[2025-02-04 08:43:50 +0100] info [webmaild] 45.179.70.159 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.158.42
description:
Feb  4 08:43:57 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.158.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.142.210.138
description:
2025-02-04 08:43:18 dovecot_login authenticator failed for ([61.142.210.138]) [61.142.210.138]:55460: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.22.255.28
description:
Feb  4 08:43:28 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.22.255.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.22.255.28
description:
2025-02-04 08:43:30 dovecot_login authenticator failed for ([58.22.255.28]) [58.22.255.28]:36782: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.218
description:
Feb  4 08:43:47 ait sshd[3998515]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.218
description:
Feb  4 08:43:47 ait sshd[3998515]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.218  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.158.42
description:
2025-02-04 08:43:59 dovecot_login authenticator failed for (186-201-3-45.customer.tdatabrasil.net.br) [186.200.158.42]:57693: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.125.67.109
description:
Feb  4 08:43:09 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.125.67.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.248.7
description:
Feb  4 08:44:39 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.241.150
description:
2025-02-04 08:44:50 dovecot_plain authenticator failed for ([61.143.241.150]) [61.143.241.150]:53461: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.204.162.116
description:
2025-02-04 08:44:55 dovecot_login authenticator failed for ([82.204.162.116]) [82.204.162.116]:53380: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.142.210.138
description:
Feb  4 08:44:32 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.142.210.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.178.132
description:
Feb  4 08:44:58 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.178.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.185.7.163
description:
Feb  4 08:44:37 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.185.7.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.25.36.197
description:
2025-02-04 08:44:42 dovecot_login authenticator failed for ([37.25.36.197]) [37.25.36.197]:44859: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.172.170.49
description:
Feb  4 08:44:59 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.172.170.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.170.49
description:
2025-02-04 08:45:01 dovecot_plain authenticator failed for (201.172.170.49-clientes-izzi.mx) [201.172.170.49]:56080: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.8.11.40
description:
[2025-02-04 08:45:03 +0100] info [webmaild] 191.8.11.40 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.102.139.202
description:
[2025-02-04 08:44:30 +0100] info [webmaild] 103.102.139.202 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.7.163
description:
2025-02-04 08:44:39 dovecot_login authenticator failed for (abts-tn-static-163.7.185.136.airtelbroadband.in) [136.185.7.163]:33720: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
description:
2025-02-04 08:44:22 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:37272: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
description:
2025-02-04 08:44:41 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:45234: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.204.162.116
description:
Feb  4 08:44:53 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.204.162.116 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.66.5.10
description:
[2025-02-04 08:44:23 +0100] info [webmaild] 105.66.5.10 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.142.210.138
description:
2025-02-04 08:44:34 dovecot_login authenticator failed for ([61.142.210.138]) [61.142.210.138]:56050: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.121.199.203
description:
Feb  4 08:44:37 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.121.199.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.241.150
description:
Feb  4 08:44:48 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.241.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.25.36.197
description:
Feb  4 08:44:40 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.25.36.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.178.132
description:
2025-02-04 08:45:00 dovecot_plain authenticator failed for (132-178-53-194.mairnet.net) [194.53.178.132]:44614: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
description:
2025-02-04 08:44:07 dovecot_login authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:49638: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.88.10.10
description:
Feb  4 08:44:20 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.88.10.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
description:
2025-02-04 08:44:39 dovecot_plain authenticator failed for ool-4579c7cb.dyn.optonline.net (rescochize) [69.121.199.203]:60472: 535 Incorrect authentication data (set_id=cole@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.110.161.134
description:
Feb  4 08:45:47 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.110.161.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.85.137
description:
2025-02-04 08:45:47 dovecot_plain authenticator failed for (177-174-85-137.user.vivozap.com.br) [177.174.85.137]:35490: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.162.227
description:
2025-02-04 08:46:04 dovecot_plain authenticator failed for broadband-178-140-162-227.ip.moscow.rt.ru [178.140.162.227]:58946: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.255.231.10
description:
Feb  4 08:45:45 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.255.231.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.149.154.146
description:
2025-02-04 08:45:55 dovecot_plain authenticator failed for ([103.149.154.146]) [103.149.154.146]:48083: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.76.58.118
description:
Feb  4 08:45:57 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.76.58.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.132.113
description:
2025-02-04 08:45:59 dovecot_plain authenticator failed for ([188.226.132.113]) [188.226.132.113]:45595: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.162.227
description:
Feb  4 08:46:02 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.162.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.189.180.243
description:
Feb  4 08:45:43 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.189.180.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
description:
2025-02-04 08:45:43 dovecot_plain authenticator failed for ([77.211.31.222]) [77.211.31.222]:43164: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.120.224.227
description:
Feb  4 08:45:46 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.120.224.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.234
description:
2025-02-04 08:45:49 dovecot_plain authenticator failed for 110-25-105-234.adsl.fetnet.net [110.25.105.234]:46041: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.10.65.27
description:
Feb  4 08:45:57 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.10.65.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.164.165
description:
Feb  4 08:45:57 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.164.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.76.58.118
description:
2025-02-04 08:45:59 dovecot_plain authenticator failed for ([61.76.58.118]) [61.76.58.118]:40122: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.143.231.208
description:
2025-02-04 08:46:03 dovecot_plain authenticator failed for ([43.143.231.208]) [43.143.231.208]:57894: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.138
description:
2025-02-04 08:46:04 dovecot_plain authenticator failed for ([121.202.155.138]) [121.202.155.138]:30798: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.99.168
description:
Feb  4 08:45:23 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.99.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.211.31.222
description:
Feb  4 08:45:41 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.211.31.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.216.2.74
description:
Feb  4 08:45:46 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.216.2.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.85.137
description:
Feb  4 08:45:45 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.85.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.154.146
description:
Feb  4 08:45:53 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.149.154.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.164.165
description:
2025-02-04 08:45:59 dovecot_login authenticator failed for ([5.11.164.165]) [5.11.164.165]:49810: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.130.70.80
description:
Feb  4 08:46:00 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.130.70.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.234.219
description:
Feb  4 08:46:06 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.234.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.47.48.178
description:
Feb  4 08:45:06 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.47.48.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.118.234
description:
Feb  4 08:45:35 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.199.118.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.65.27
description:
2025-02-04 08:45:59 dovecot_plain authenticator failed for 46-10-65-27.ip.btc-net.bg [46.10.65.27]:37664: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 48.218.170.53
description:
2025-02-04 08:45:59 dovecot_plain authenticator failed for ([48.218.170.53]) [48.218.170.53]:45130: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.215.73
description:
2025-02-04 08:45:09 dovecot_plain authenticator failed for ([175.207.215.73]) [175.207.215.73]:36781: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.225.185.154
description:
2025-02-04 08:45:27 dovecot_plain authenticator failed for ([124.225.185.154]) [124.225.185.154]:59654: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.106.136.152
description:
Feb  4 08:45:41 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.106.136.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.110.161.134
description:
2025-02-04 08:45:49 dovecot_plain authenticator failed for ([36.110.161.134]) [36.110.161.134]:49516: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.106.187
description:
2025-02-04 08:45:56 dovecot_plain authenticator failed for ([65.76.106.187]) [65.76.106.187]:48566: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.139.55
description:
2025-02-04 08:45:59 dovecot_plain authenticator failed for ([112.194.139.55]) [112.194.139.55]:41790: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.137.159
description:
2025-02-04 08:46:02 dovecot_plain authenticator failed for ([103.109.44.163]) [122.165.137.159]:43170: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.207.215.73
description:
Feb  4 08:45:07 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.207.215.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.129.195
description:
Feb  4 08:45:43 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.129.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Feb  4 08:45:46 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.116.9.180
description:
Feb  4 08:45:49 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.116.9.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.240.210
description:
2025-02-04 08:45:58 dovecot_plain authenticator failed for (nsg-corporate-210.240.187.122.airtel.in) [122.187.240.210]:56553: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.138
description:
Feb  4 08:46:02 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.70.80
description:
2025-02-04 08:46:02 dovecot_plain authenticator failed for mobile-166-130-70-80.mycingular.net [166.130.70.80]:40778: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.47.48.178
description:
2025-02-04 08:45:08 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:57836: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.53
description:
Feb  4 08:45:43 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.194.34
description:
Feb  4 08:45:50 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.194.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.132.113
description:
Feb  4 08:45:57 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.132.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 48.218.170.53
description:
Feb  4 08:45:57 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 48.218.170.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.107.148
description:
Feb  4 08:46:01 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.107.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.225.185.154
description:
Feb  4 08:45:25 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.225.185.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.59.174
description:
2025-02-04 08:45:40 dovecot_plain authenticator failed for ([222.236.59.174]) [222.236.59.174]:36904: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.53
description:
2025-02-04 08:45:45 dovecot_plain authenticator failed for ([65.20.251.53]) [65.20.251.53]:53444: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.189.180.243
description:
2025-02-04 08:45:45 dovecot_plain authenticator failed for ([90.189.180.243]) [90.189.180.243]:59184: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.109.253.182
description:
2025-02-04 08:45:45 dovecot_plain authenticator failed for ([172.109.253.182]) [172.109.253.182]:47766: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.216.2.74
description:
2025-02-04 08:45:48 dovecot_plain authenticator failed for ([222.216.2.74]) [222.216.2.74]:34004: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.137.159
description:
Feb  4 08:46:00 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.137.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.105.234
description:
Feb  4 08:45:47 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.105.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.224.227
description:
2025-02-04 08:45:48 dovecot_plain authenticator failed for ([220.120.224.227]) [220.120.224.227]:41360: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.99.168
description:
2025-02-04 08:45:25 dovecot_login authenticator failed for ([49.245.99.168]) [49.245.99.168]:37062: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.143.231.208
description:
Feb  4 08:46:01 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.143.231.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
description:
2025-02-04 08:45:47 dovecot_plain authenticator failed for (187-8-163-70.customer.tdatabrasil.net.br) [187.8.163.70]:45293: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.255.231.10
description:
2025-02-04 08:45:47 dovecot_plain authenticator failed for ([106.255.231.10]) [106.255.231.10]:60114: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-02-04 08:45:48 dovecot_plain authenticator failed for ([171.244.40.228]) [171.244.40.236]:46832: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.97.114.149
description:
2025-02-04 08:46:04 dovecot_plain authenticator failed for c-73-97-114-149.hsd1.wa.comcast.net [73.97.114.149]:33289: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
description:
2025-02-04 08:45:37 dovecot_plain authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:25814: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
description:
Feb  4 08:45:45 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.129.195
description:
2025-02-04 08:45:45 dovecot_plain authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:53706: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.240.210
description:
Feb  4 08:45:56 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.240.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.139.55
description:
Feb  4 08:45:57 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.139.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.25.73
description:
2025-02-04 08:46:02 dovecot_plain authenticator failed for ([31.173.25.73]) [31.173.25.73]:54688: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.107.148
description:
2025-02-04 08:46:03 dovecot_plain authenticator failed for ([183.237.107.148]) [183.237.107.148]:52137: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.236.59.174
description:
Feb  4 08:45:38 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.236.59.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.109.253.182
description:
Feb  4 08:45:43 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.109.253.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.106.136.152
description:
2025-02-04 08:45:43 dovecot_plain authenticator failed for (tgw-rp.ru) [109.106.136.152]:51128: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.194.34
description:
2025-02-04 08:45:52 dovecot_plain authenticator failed for (34.194.75.138.unknown.m1.com.sg) [138.75.194.34]:53515: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.97.114.149
description:
Feb  4 08:46:02 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.97.114.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.9.180
description:
2025-02-04 08:45:51 dovecot_plain authenticator failed for ([222.116.9.180]) [222.116.9.180]:46310: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.106.187
description:
Feb  4 08:45:54 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.106.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.25.73
description:
Feb  4 08:46:00 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.25.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-02-04 08:46:19 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:45996: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
description:
2025-02-04 08:46:22 dovecot_plain authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:10530: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.229.51.205
description:
2025-02-04 08:46:26 dovecot_plain authenticator failed for ([58.229.51.205]) [58.229.51.205]:38294: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.94.0.159
description:
Feb  4 08:46:20 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.94.0.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.72.184.216
description:
[2025-02-04 08:47:04 +0100] info [webmaild] 131.72.184.216 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.5.85.87
description:
[2025-02-04 08:46:33 +0100] info [webmaild] 191.5.85.87 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.20.6.2
description:
Feb  4 08:46:41 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.20.6.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.66.41.157
description:
[2025-02-04 08:46:59 +0100] info [webmaild] 212.66.41.157 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Feb  4 08:46:17 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.170.218.142
description:
2025-02-04 08:46:14 dovecot_plain authenticator failed for ([121.170.218.142]) [121.170.218.142]:54552: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.153.106
description:
2025-02-04 08:46:16 dovecot_login authenticator failed for p82107-obmd01.osaka.ocn.ne.jp [180.7.153.106]:60101: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.170.218.142
description:
Feb  4 08:46:12 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.170.218.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.135.125.196
description:
Feb  4 08:46:16 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.135.125.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.170.200
description:
2025-02-04 08:46:29 dovecot_plain authenticator failed for (broadband-37.204-170-200.ip.moscow.rt.ru) [37.204.170.200]:59210: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.105.8
description:
[2025-02-04 08:47:05 +0100] info [cpaneld] 156.228.105.8 - sates1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sates1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.18.126.17
description:
2025-02-04 08:46:13 dovecot_plain authenticator failed for 17.red-88-18-126.staticip.rima-tde.net [88.18.126.17]:34438: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.18.126.17
description:
Feb  4 08:46:11 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.18.126.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.125.196
description:
2025-02-04 08:46:18 dovecot_plain authenticator failed for ([36.135.125.196]) [36.135.125.196]:47680: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.205
description:
Feb  4 08:46:24 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.71.98.202
description:
Feb  4 08:46:31 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.71.98.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.20.6.2
description:
2025-02-04 08:46:43 dovecot_plain authenticator failed for (187-8-73-30.customer.tdatabrasil.net.br) [189.20.6.2]:54385: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.104.74
description:
[2025-02-04 08:47:06 +0100] info [cpaneld] 156.228.104.74 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.234.219
description:
2025-02-04 08:46:08 dovecot_plain authenticator failed for (estointernet.in) [103.123.234.219]:56462: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.41.55
description:
[2025-02-04 08:47:06 +0100] info [cpaneld] 104.207.41.55 - sates1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sates1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.119.247
description:
[2025-02-04 08:47:06 +0100] info [cpaneld] 156.228.119.247 - sates1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sates1 (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.170.200
description:
Feb  4 08:46:27 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.170.200 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-46.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.114.248
description:
[2025-02-04 08:47:05 +0100] info [cpaneld] 156.228.114.248 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.71.98.202
description:
2025-02-04 08:46:33 dovecot_plain authenticator failed for ([223.71.98.202]) [223.71.98.202]:47769: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.85.81
description:
[2025-02-04 08:47:08 +0100] info [whostmgrd] 156.228.85.81 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.119.17
description:
[2025-02-04 08:47:08 +0100] info [whostmgrd] 156.228.119.17 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.39.195
description:
[2025-02-04 08:47:09 +0100] info [whostmgrd] 104.207.39.195 - sates1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.41.55
description:
[2025-02-04 08:47:09 +0100] info [whostmgrd] 104.207.41.55 - sates1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.87.58
description:
[2025-02-04 08:47:36 +0100] info [webmaild] 213.230.87.58 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.56.37
description:
[2025-02-04 08:47:07 +0100] info [whostmgrd] 104.207.56.37 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.82.82
description:
[2025-02-04 08:47:08 +0100] info [whostmgrd] 156.228.82.82 - sates1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.188.10
description:
Feb  4 08:48:44 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.188.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.188.10
description:
2025-02-04 08:48:46 dovecot_login authenticator failed for ([180.7.188.10]) [180.7.188.10]:33181: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.5.159.34
description:
Feb  4 08:48:55 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.5.159.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.5.159.34
description:
2025-02-04 08:48:57 dovecot_login authenticator failed for ([45.5.159.34]) [45.5.159.34]:52246: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.69.195.7
description:
2025-02-04 08:49:26 dovecot_login authenticator failed for ([125.69.195.7]) [125.69.195.7]:42592: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.145.27.1
description:
Feb  4 08:49:49 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.145.27.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.145.27.1
description:
2025-02-04 08:49:51 dovecot_plain authenticator failed for ([103.145.27.106]) [103.145.27.1]:57906: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.142.220.155
description:
Feb  4 08:49:07 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.142.220.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.142.220.155
description:
2025-02-04 08:49:09 dovecot_login authenticator failed for ([5.142.220.155]) [5.142.220.155]:42711: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.235.228
description:
Feb  4 08:49:23 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.235.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.230.100.252
description:
Feb  4 08:49:32 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.230.100.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.37
description:
Feb  4 08:49:53 ait sshd[4001255]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.37 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Feb  4 08:49:15 ait sshd[4000995]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.69.195.7
description:
Feb  4 08:49:24 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.69.195.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.235.228
description:
2025-02-04 08:49:25 dovecot_plain authenticator failed for ([92.118.235.228]) [92.118.235.228]:56536: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.193.214.102
description:
[2025-02-04 08:49:43 +0100] info [webmaild] 177.193.214.102 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.120.246.48
description:
[2025-02-04 08:49:14 +0100] info [webmaild] 190.120.246.48 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Feb  4 08:49:15 ait sshd[4000995]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.37
description:
Feb  4 08:49:53 ait sshd[4001255]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.37  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.230.100.252
description:
2025-02-04 08:49:34 dovecot_plain authenticator failed for ([38.230.100.252]) [38.230.100.252]:62503: 535 Incorrect authentication data (set_id=bscs18bit0012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.237.135.98
description:
[2025-02-04 08:49:48 +0100] info [webmaild] 200.237.135.98 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.198.18.3
description:
Feb  4 08:51:06 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.198.18.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.201.140.227
description:
2025-02-04 08:50:08 dovecot_plain authenticator failed for ([45.201.140.227]) [45.201.140.227]:51428: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.144.82.250
description:
Feb  4 08:50:15 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.144.82.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.161.196.5
description:
Feb  4 08:50:20 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.161.196.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
description:
2025-02-04 08:50:22 dovecot_plain authenticator failed for ([46.161.196.5]) [46.161.196.5]:43900: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 08:50:43 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.188.103.179
description:
Feb  4 08:50:54 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.188.103.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.188.103.179
description:
2025-02-04 08:50:56 dovecot_login authenticator failed for (tagsdev.click) [199.188.103.179]:55772: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.144.82.250
description:
2025-02-04 08:50:17 dovecot_plain authenticator failed for syn-098-144-082-250.res.spectrum.com [98.144.82.250]:52738: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.26.102.213
description:
[2025-02-04 08:50:20 +0100] info [webmaild] 186.26.102.213 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.253.18.251
description:
Feb  4 08:50:31 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.253.18.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.253.18.251
description:
2025-02-04 08:50:33 dovecot_plain authenticator failed for ([120.253.18.251]) [120.253.18.251]:48335: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.18.3
description:
2025-02-04 08:51:08 dovecot_login authenticator failed for ([175.198.18.3]) [175.198.18.3]:58019: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.226
description:
Feb  4 08:51:40 ait sshd[4002259]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.226 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.226
description:
Feb  4 08:51:40 ait sshd[4002259]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.226  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.189.23.243
description:
[2025-02-04 08:51:47 +0100] info [webmaild] 200.189.23.243 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.83.205
description:
2025-02-04 08:52:57 dovecot_login authenticator failed for ([58.18.83.205]) [58.18.83.205]:57074: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.231.255.104
description:
[2025-02-04 08:52:21 +0100] info [webmaild] 45.231.255.104 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.255.231.10
description:
Feb  4 08:52:38 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.255.231.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.255.231.10
description:
2025-02-04 08:52:40 dovecot_login authenticator failed for ([106.255.231.10]) [106.255.231.10]:41127: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.22.37.184
description:
Feb  4 08:52:52 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.22.37.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.22.37.184
description:
2025-02-04 08:52:54 dovecot_plain authenticator failed for ([217.22.37.184]) [217.22.37.184]:51155: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.83.205
description:
Feb  4 08:52:55 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.83.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.171.195.70
description:
Feb  4 08:52:45 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.171.195.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.171.195.70
description:
2025-02-04 08:52:47 dovecot_login authenticator failed for ([216.171.195.70]) [216.171.195.70]:46147: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.29.158
description:
Feb  4 08:52:55 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.29.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.98.10.109
description:
2025-02-04 08:52:55 dovecot_login authenticator failed for ([46.98.10.109]) [46.98.10.109]:52020: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.158
description:
2025-02-04 08:52:57 dovecot_plain authenticator failed for 111-70-29-158.emome-ip.hinet.net [111.70.29.158]:52748: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.156.229.240
description:
[2025-02-04 08:52:14 +0100] info [webmaild] 38.156.229.240 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.98.10.109
description:
Feb  4 08:52:53 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.98.10.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.56.11.206
description:
Feb  4 08:52:54 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.56.11.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.53.37.214
description:
[2025-02-04 08:52:54 +0100] info [webmaild] 92.53.37.214 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.145.254
description:
Feb  4 08:52:41 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.145.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.245.145.254
description:
2025-02-04 08:52:43 dovecot_plain authenticator failed for ([157.245.145.254]) [157.245.145.254]:54210: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.56.11.206
description:
2025-02-04 08:52:56 dovecot_login authenticator failed for ([165.56.11.206]) [165.56.11.206]:38193: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.205.112.156
description:
Feb  4 08:53:10 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.205.112.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.65.117
description:
Feb  4 08:53:11 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.65.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.205.112.156
description:
2025-02-04 08:53:12 dovecot_plain authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:43849: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.65.117
description:
2025-02-04 08:53:13 dovecot_login authenticator failed for ([183.238.65.117]) [183.238.65.117]:51073: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.107.173.49
description:
Feb  4 08:54:20 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.107.173.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.107.173.49
description:
2025-02-04 08:54:22 dovecot_plain authenticator failed for (106.107.173.49.adsl.dynamic.seed.net.tw) [106.107.173.49]:9514: 535 Incorrect authentication data (set_id=eng19a00097y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.188.117
description:
2025-02-04 08:54:32 dovecot_plain authenticator failed for (82-102-188-117.orange.net.il) [82.102.188.117]:43204: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.98.237.4
description:
[2025-02-04 08:54:21 +0100] info [webmaild] 177.98.237.4 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.102.188.117
description:
Feb  4 08:54:30 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.102.188.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.234.65.55
description:
Feb  4 08:54:49 ait sshd[4003387]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.234.65.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.142.135
description:
2025-02-04 08:54:59 dovecot_login authenticator failed for ([171.244.142.135]) [171.244.142.135]:30132: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.0.235.40
description:
[2025-02-04 08:54:49 +0100] info [webmaild] 187.0.235.40 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.203.251.209
description:
2025-02-04 08:54:59 dovecot_plain authenticator failed for ([111.203.251.210]) [111.203.251.209]:36636: 535 Incorrect authentication data (set_id=eng19b00160y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.234.65.55
description:
Feb  4 08:54:49 ait sshd[4003387]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.234.65.55  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.142.135
description:
Feb  4 08:54:57 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.142.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.203.251.209
description:
Feb  4 08:54:57 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.203.251.209 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.41.115.94
description:
[2025-02-04 08:55:06 +0100] info [webmaild] 103.41.115.94 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
description:
Feb  4 08:55:09 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 08:55:31 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.76.106.226
description:
2025-02-04 08:55:41 dovecot_plain authenticator failed for (226.106.76.200.static.redip.topnet.com.mx) [200.76.106.226]:38585: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.232.78
description:
Feb  4 08:55:51 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.232.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.8.23.171
description:
Feb  4 08:55:08 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.8.23.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.23.171
description:
2025-02-04 08:55:10 dovecot_plain authenticator failed for ([59.8.23.171]) [59.8.23.171]:57905: 535 Incorrect authentication data (set_id=eng19b00160y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
description:
2025-02-04 08:55:11 dovecot_login authenticator failed for ([111.171.127.190]) [111.171.127.190]:35969: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.76.106.226
description:
Feb  4 08:55:39 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.76.106.226 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.196.215.216
description:
[2025-02-04 08:55:38 +0100] info [webmaild] 168.196.215.216 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.232.78
description:
2025-02-04 08:55:53 dovecot_plain authenticator failed for ([112.91.232.78]) [112.91.232.78]:37970: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.163.182.162
description:
Feb  4 08:56:38 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.163.182.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.116.226
description:
Feb  4 08:56:42 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.116.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.222.226.190
description:
Feb  4 08:56:46 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.222.226.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.10.65.27
description:
Feb  4 08:57:03 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.10.65.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.192.17
description:
Feb  4 08:56:09 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.192.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.116.158.238
description:
2025-02-04 08:56:28 dovecot_plain authenticator failed for ([123.116.158.238]) [123.116.158.238]:54924: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.52
description:
Feb  4 08:56:35 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.65.27
description:
2025-02-04 08:57:05 dovecot_plain authenticator failed for 46-10-65-27.ip.btc-net.bg [46.10.65.27]:52842: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Feb  4 08:56:38 ait sshd[4004143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.116.226
description:
2025-02-04 08:56:44 dovecot_plain authenticator failed for ([117.176.116.226]) [117.176.116.226]:38852: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
description:
2025-02-04 08:56:47 dovecot_plain authenticator failed for (148166.telemar.net.br) [200.165.148.166]:52677: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.253.159.131
description:
[2025-02-04 08:56:50 +0100] info [webmaild] 38.253.159.131 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.192.17
description:
2025-02-04 08:56:11 dovecot_login authenticator failed for ([191.59.192.17]) [191.59.192.17]:39810: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.100
description:
2025-02-04 08:56:21 dovecot_login authenticator failed for (m121-202-203-100.smartone.com) [121.202.203.100]:42960: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Feb  4 08:56:38 ait sshd[4004143]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.222.226.190
description:
2025-02-04 08:56:48 dovecot_login authenticator failed for ([58.222.226.190]) [58.222.226.190]:48536: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.182.162
description:
2025-02-04 08:56:40 dovecot_login authenticator failed for ([61.83.232.94]) [221.163.182.162]:40332: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.165.148.166
description:
Feb  4 08:56:45 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.165.148.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.100
description:
Feb  4 08:56:19 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.116.158.238
description:
Feb  4 08:56:26 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.116.158.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.52
description:
2025-02-04 08:56:37 dovecot_plain authenticator failed for ([178.178.222.52]) [178.178.222.52]:33896: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.14.191.130
description:
Feb  4 08:57:54 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.14.191.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.133.195
description:
Feb  4 08:57:54 ait sshd[4004616]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.72.133.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.147.64
description:
2025-02-04 08:57:13 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.147.64]:58881: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.66.113.58
description:
2025-02-04 08:57:20 dovecot_login authenticator failed for ([183.66.113.58]) [183.66.113.58]:37334: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.171.226
description:
2025-02-04 08:57:44 dovecot_login authenticator failed for ([83.239.171.226]) [83.239.171.226]:44934: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.93.177.228
description:
Feb  4 08:57:54 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.93.177.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.88.196.94
description:
Feb  4 08:57:14 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.88.196.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.110
description:
2025-02-04 08:57:25 dovecot_login authenticator failed for (110.20.167.124.adsl-pool.sx.cn) [124.167.20.110]:48711: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.124.145.199
description:
Feb  4 08:57:36 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.124.145.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
description:
2025-02-04 08:57:29 dovecot_login authenticator failed for ([203.128.181.121]) [203.128.181.121]:51766: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.124.145.199
description:
2025-02-04 08:57:38 dovecot_login authenticator failed for ([64.124.145.199]) [64.124.145.199]:40829: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.239.171.226
description:
Feb  4 08:57:42 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.239.171.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.14.191.130
description:
2025-02-04 08:57:56 dovecot_login authenticator failed for ([59.14.191.130]) [59.14.191.130]:50095: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.212.206
description:
Feb  4 08:57:06 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
description:
2025-02-04 08:57:08 dovecot_login authenticator failed for ([211.53.58.1]) [211.169.212.206]:61492: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.132.137.230
description:
2025-02-04 08:57:14 dovecot_plain authenticator failed for (static-137-230.pppoe.tmb.ru) [78.132.137.230]:49806: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.147.64
description:
Feb  4 08:57:11 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.147.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.132.137.230
description:
Feb  4 08:57:12 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.132.137.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.248.1.199
description:
2025-02-04 08:57:13 dovecot_plain authenticator failed for (ip-199-1-248-87.eidsiva.net) [87.248.1.199]:38388: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
description:
2025-02-04 08:57:56 dovecot_plain authenticator failed for ([111.93.177.228]) [111.93.177.228]:60764: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.88.196.94
description:
2025-02-04 08:57:16 dovecot_login authenticator failed for 69-88-196-94.cst.watchcomm.net [69.88.196.94]:42595: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.252.94.26
description:
Feb  4 08:57:08 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.252.94.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.66.113.58
description:
Feb  4 08:57:18 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.66.113.58 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.72.133.195
description:
Feb  4 08:57:54 ait sshd[4004616]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.72.133.195  user=adm


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.94.26
description:
2025-02-04 08:57:10 dovecot_login authenticator failed for ([211.252.94.26]) [211.252.94.26]:53487: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.135.212.113
description:
[2025-02-04 08:57:20 +0100] info [webmaild] 41.135.212.113 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.110
description:
Feb  4 08:57:23 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.204.125.250
description:
Feb  4 08:57:55 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.204.125.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.204.125.250
description:
2025-02-04 08:57:57 dovecot_plain authenticator failed for ([210.204.125.250]) [210.204.125.250]:53738: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.248.1.199
description:
Feb  4 08:57:11 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.248.1.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
description:
Feb  4 08:57:27 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.137.250.64
description:
[2025-02-04 08:57:47 +0100] info [webmaild] 143.137.250.64 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.245.147.39
description:
[2025-02-04 08:58:23 +0100] info [webmaild] 177.245.147.39 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 132.148.77.70
description:
Feb  4 08:58:48 ait sshd[4004923]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.148.77.70


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.75.233
description:
Feb  4 08:58:52 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.75.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.75.233
description:
2025-02-04 08:58:54 dovecot_login authenticator failed for 42-200-75-233.static.imsbiz.com [42.200.75.233]:46329: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.240
description:
Feb  4 08:58:56 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Feb  4 08:59:03 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.170.20
description:
Feb  4 08:58:06 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.170.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-02-04 08:59:05 dovecot_login authenticator failed for ([112.111.61.230]) [112.111.61.229]:36546: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 132.148.77.70
description:
Feb  4 08:58:48 ait sshd[4004923]: pam_imunify(sshd:auth): [IM360_RBL] The IP 132.148.77.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.240
description:
2025-02-04 08:58:58 dovecot_login authenticator failed for ([121.202.155.240]) [121.202.155.240]:1976: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.170.20
description:
2025-02-04 08:58:08 dovecot_plain authenticator failed for broadband-188-32-170-20.ip.moscow.rt.ru [188.32.170.20]:54250: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.214.127
description:
2025-02-04 09:00:01 dovecot_login authenticator failed for ([223.241.214.127]) [223.241.214.127]:45555: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.188.196.133
description:
Feb  4 08:59:19 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.188.196.133 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 89.187.32.118
description:
[2025-02-04 08:59:52 +0100] info [webmaild] 89.187.32.118 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.124.14
description:
Feb  4 08:59:08 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.124.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.93
description:
Feb  4 08:59:53 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.241.214.127
description:
Feb  4 08:59:59 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.241.214.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.201.140.227
description:
Feb  4 08:59:08 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.201.140.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.201.140.227
description:
2025-02-04 08:59:10 dovecot_plain authenticator failed for ([45.201.140.227]) [45.201.140.227]:52454: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
description:
2025-02-04 08:59:10 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:55762: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.225.185.154
description:
2025-02-04 08:59:49 dovecot_login authenticator failed for ([124.225.185.154]) [124.225.185.154]:51022: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.188.196.133
description:
2025-02-04 08:59:21 dovecot_plain authenticator failed for ([121.188.196.133]) [121.188.196.133]:41868: 535 Incorrect authentication data (set_id=ug88m8880009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.225.185.154
description:
Feb  4 08:59:47 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.225.185.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.93
description:
2025-02-04 08:59:55 dovecot_plain authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:2339: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.25
description:
Feb  4 09:00:06 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.25 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 83.255.155.246
description:
[2025-02-04 09:00:21 +0100] info [webmaild] 83.255.155.246 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.84.176.158
description:
[2025-02-04 09:00:49 +0100] info [webmaild] 189.84.176.158 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Feb  4 09:00:58 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.25
description:
2025-02-04 09:00:08 dovecot_plain authenticator failed for ([121.202.154.25]) [121.202.154.25]:19514: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.244.88
description:
Feb  4 09:00:17 ait sshd[4005665]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.244.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.195.179
description:
Feb  4 09:00:30 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.195.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.195.179
description:
2025-02-04 09:00:32 dovecot_login authenticator failed for ([183.109.195.179]) [183.109.195.179]:53720: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.244.88
description:
Feb  4 09:00:17 ait sshd[4005665]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.244.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.83
description:
Feb  4 09:01:03 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.83
description:
2025-02-04 09:01:05 dovecot_login authenticator failed for (m121-202-154-83.smartone.com) [121.202.154.83]:56977: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-02-04 09:01:00 dovecot_login authenticator failed for ([203.81.213.46]) [203.81.213.46]:51054: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.252.18.246
description:
Feb  4 09:01:05 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.252.18.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.231.251
description:
Feb  4 09:01:14 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.231.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.219.177.95
description:
Feb  4 09:01:18 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.219.177.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.43.254.214
description:
Feb  4 09:02:01 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.43.254.214 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-01.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.117.173
description:
[2025-02-04 09:01:08 +0100] info [cpaneld] 156.228.117.173 - yeboah "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yeboah (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.53.118
description:
[2025-02-04 09:01:11 +0100] info [whostmgrd] 104.207.53.118 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.168.67
description:
2025-02-04 09:01:17 dovecot_login authenticator failed for (189.218.168.67-clientes-izzi.mx) [189.218.168.67]:47699: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.252.18.246
description:
2025-02-04 09:01:07 dovecot_login authenticator failed for ([162.252.18.246]) [162.252.18.246]:52274: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.111.19
description:
[2025-02-04 09:01:12 +0100] info [whostmgrd] 156.228.111.19 - yeboah "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.252.57
description:
2025-02-04 09:01:12 dovecot_login authenticator failed for ([60.223.252.57]) [60.223.252.57]:36696: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.231.251
description:
2025-02-04 09:01:16 dovecot_login authenticator failed for ([47.149.231.251]) [47.149.231.251]:36126: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.119.197
description:
[2025-02-04 09:01:08 +0100] info [cpaneld] 156.228.119.197 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.117.65
description:
[2025-02-04 09:01:09 +0100] info [cpaneld] 156.228.117.65 - yeboah "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yeboah (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.106.105
description:
[2025-02-04 09:01:11 +0100] info [whostmgrd] 156.228.106.105 - yeboah "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.32.149
description:
[2025-02-04 09:01:12 +0100] info [whostmgrd] 104.207.32.149 - yeboah "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.229.1.186
description:
Feb  4 09:01:25 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.229.1.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.28.60.82
description:
Feb  4 09:01:37 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.28.60.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.252.57
description:
Feb  4 09:01:10 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.252.57 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.54.224
description:
[2025-02-04 09:01:10 +0100] info [whostmgrd] 104.207.54.224 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.219.177.95
description:
2025-02-04 09:01:20 dovecot_login authenticator failed for ([113.219.177.95]) [113.219.177.95]:36232: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.105.83
description:
[2025-02-04 09:01:07 +0100] info [cpaneld] 156.228.105.83 - yeboah "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yeboah (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.28.60.82
description:
2025-02-04 09:01:39 dovecot_login authenticator failed for ([60.28.60.82]) [60.28.60.82]:50232: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.57.119
description:
[2025-02-04 09:01:07 +0100] info [cpaneld] 104.207.57.119 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.218.168.67
description:
Feb  4 09:01:15 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.218.168.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
description:
2025-02-04 09:01:27 dovecot_login authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:36964: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.96.13
description:
[2025-02-04 09:01:11 +0100] info [whostmgrd] 156.228.96.13 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.10.6.205
description:
[2025-02-04 09:01:19 +0100] info [webmaild] 157.10.6.205 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
description:
2025-02-04 09:02:50 dovecot_plain authenticator failed for 95-87-248-223.ip.btc-net.bg (95-87-248-223.net1.bg) [95.87.248.223]:44276: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.51
description:
Feb  4 09:02:59 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.51
description:
2025-02-04 09:03:01 dovecot_plain authenticator failed for 111-70-32-51.emome-ip.hinet.net [111.70.32.51]:57707: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.232.193.44
description:
2025-02-04 09:02:32 dovecot_plain authenticator failed for ([186.232.193.44]) [186.232.193.44]:60121: 535 Incorrect authentication data (set_id=agbozume1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 09:02:44 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.232.193.44
description:
Feb  4 09:02:30 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.232.193.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.200.202
description:
2025-02-04 09:02:54 dovecot_login authenticator failed for ([161.35.200.202]) [161.35.200.202]:35252: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Feb  4 09:02:54 ait sshd[4006583]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  4 09:02:54 ait sshd[4006583]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 09:03:02 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.117.10.134
description:
Feb  4 09:02:14 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.117.10.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.117.10.134
description:
2025-02-04 09:02:16 dovecot_plain authenticator failed for ([45.117.10.134]) [45.117.10.134]:46978: 535 Incorrect authentication data (set_id=agbozume1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.6.133
description:
2025-02-04 09:02:21 dovecot_plain authenticator failed for ([106.246.6.133]) [106.246.6.133]:52182: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.143.30.155
description:
Feb  4 09:03:03 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.143.30.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.143.30.155
description:
2025-02-04 09:03:05 dovecot_login authenticator failed for ([222.143.30.155]) [222.143.30.155]:46776: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.19.108
description:
2025-02-04 09:02:32 dovecot_plain authenticator failed for ([149.0.19.108]) [149.0.19.108]:39114: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.121.147.110
description:
[2025-02-04 09:02:55 +0100] info [webmaild] 168.121.147.110 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.19.108
description:
Feb  4 09:02:30 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.19.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.248.223
description:
Feb  4 09:02:48 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.248.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.35.200.202
description:
Feb  4 09:02:52 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.35.200.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.6.133
description:
Feb  4 09:02:19 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.6.133 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.7.3.2
description:
[2025-02-04 09:02:26 +0100] info [webmaild] 191.7.3.2 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.106.73.223
description:
[2025-02-04 09:03:23 +0100] info [webmaild] 179.106.73.223 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
description:
Feb  4 09:03:38 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.123
description:
2025-02-04 09:04:04 dovecot_plain authenticator failed for ([196.28.226.123]) [196.28.226.123]:42111: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.121.193.126
description:
Feb  4 09:03:33 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.121.193.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 09:03:38 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
description:
2025-02-04 09:03:40 dovecot_login authenticator failed for ([96.79.174.131]) [96.79.174.131]:41566: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.249
description:
2025-02-04 09:03:44 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.152.249]:37672: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.112.107
description:
[2025-02-04 09:03:56 +0100] info [webmaild] 213.230.112.107 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  4 09:03:06 ait sshd[4006600]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.46.30.239
description:
2025-02-04 09:03:34 dovecot_login authenticator failed for ([14.46.30.239]) [14.46.30.239]:55780: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
description:
2025-02-04 09:03:35 dovecot_plain authenticator failed for ([190.121.193.126]) [190.121.193.126]:51184: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.152.249
description:
Feb  4 09:03:42 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.152.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.234.65.55
description:
Feb  4 09:04:03 ait sshd[4006938]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.234.65.55 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.234.65.55
description:
Feb  4 09:04:03 ait sshd[4006938]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.234.65.55  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.205.232
description:
2025-02-04 09:03:23 dovecot_plain authenticator failed for (abts-ap-dynamic-232.205.169.122.airtelbroadband.in) [122.169.205.232]:55342: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.205.232
description:
Feb  4 09:03:21 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.205.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.46.30.239
description:
Feb  4 09:03:32 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.46.30.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Feb  4 09:03:06 ait sshd[4006600]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.24.138.130
description:
2025-02-04 09:04:16 dovecot_login authenticator failed for syn-024-024-138-130.res.spectrum.com [24.24.138.130]:49506: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.59.227.142
description:
[2025-02-04 09:04:50 +0100] info [webmaild] 138.59.227.142 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.239.165.120
description:
Feb  4 09:04:12 ait sshd[4007004]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.239.165.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.19.149
description:
2025-02-04 09:04:12 dovecot_login authenticator failed for 111-70-19-149.emome-ip.hinet.net [111.70.19.149]:36974: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.113.3.87
description:
Feb  4 09:04:39 ait sshd[4007384]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.113.3.87 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.113.3.87
description:
Feb  4 09:04:39 ait sshd[4007384]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.113.3.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.190.87
description:
2025-02-04 09:04:08 dovecot_login authenticator failed for ([180.7.190.87]) [180.7.190.87]:46326: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.161.44.225
description:
Feb  4 09:05:48 ait sshd[4008037]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.161.44.225


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.161
description:
2025-02-04 09:05:29 dovecot_login authenticator failed for ([121.202.154.161]) [121.202.154.161]:28628: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.159.91.86
description:
Feb  4 09:05:47 ait sshd[4008034]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.159.91.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.44.225
description:
Feb  4 09:05:48 ait sshd[4008037]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.161.44.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.24.194.207
description:
2025-02-04 09:05:56 dovecot_plain authenticator failed for ([59.24.194.207]) [59.24.194.207]:33107: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.179.34
description:
2025-02-04 09:05:42 dovecot_plain authenticator failed for ([188.166.179.34]) [188.166.179.34]:40902: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
description:
2025-02-04 09:06:02 dovecot_plain authenticator failed for ([182.239.78.124]) [182.239.78.124]:45514: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.156.85
description:
2025-02-04 09:06:04 dovecot_plain authenticator failed for (abts-north-static-085.156.160.122.airtelbroadband.in) [122.160.156.85]:55530: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.127.182.222
description:
[2025-02-04 09:05:19 +0100] info [webmaild] 189.127.182.222 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.159.91.86
description:
Feb  4 09:05:47 ait sshd[4008034]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.159.91.86


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.30.127.9
description:
2025-02-04 09:05:40 dovecot_login authenticator failed for ([112.29.109.174]) [112.30.127.9]:43735: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.215.133.102
description:
Feb  4 09:07:05 ait sshd[4008483]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.215.133.102


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.199.19
description:
Feb  4 09:06:13 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.199.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.199.19
description:
2025-02-04 09:06:15 dovecot_plain authenticator failed for (ppp19-lumwana.zamnet.zm) [196.46.199.19]:40918: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.0.130
description:
2025-02-04 09:06:16 dovecot_plain authenticator failed for ([123.212.0.130]) [123.212.0.130]:53818: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.20.124.109
description:
[2025-02-04 09:06:30 +0100] info [webmaild] 201.20.124.109 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.133.102
description:
Feb  4 09:07:05 ait sshd[4008483]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.215.133.102 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.137.226.135
description:
[2025-02-04 09:06:07 +0100] info [webmaild] 143.137.226.135 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.248.116.230
description:
2025-02-04 09:06:11 dovecot_plain authenticator failed for data.autofrant.ru (chammal) [151.248.116.230]:56044: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.15.104
description:
2025-02-04 09:06:17 dovecot_plain authenticator failed for 95-31-15-104.static.corbina.ru [95.31.15.104]:58242: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.90.89.66
description:
2025-02-04 09:06:26 dovecot_plain authenticator failed for ([66.90.89.66]) [66.90.89.66]:39164: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.181.81.77
description:
Feb  4 09:07:45 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.181.81.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.181.81.77
description:
2025-02-04 09:07:47 dovecot_plain authenticator failed for ([125.181.81.77]) [125.181.81.77]:8998: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.102.198.30
description:
[2025-02-04 09:07:59 +0100] info [webmaild] 200.102.198.30 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.194.181.238
description:
Feb  4 09:08:03 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.194.181.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.194.181.238
description:
2025-02-04 09:08:05 dovecot_plain authenticator failed for ([175.194.181.238]) [175.194.181.238]:62007: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.129.200.113
description:
2025-02-04 09:07:21 dovecot_plain authenticator failed for (115-129-200-113.tpgi.com.au) [115.129.200.113]:56288: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.70.141.34
description:
[2025-02-04 09:07:30 +0100] info [webmaild] 103.70.141.34 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.234.245.7
description:
2025-02-04 09:07:32 dovecot_plain authenticator failed for (net245.234.188-7.ertelecom.ru) [188.234.245.7]:51132: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.20.134.78
description:
2025-02-04 09:07:43 dovecot_plain authenticator failed for ([115.20.134.78]) [115.20.134.78]:34894: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.165
description:
2025-02-04 09:07:57 dovecot_plain authenticator failed for ([121.202.152.165]) [121.202.152.165]:40913: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.151
description:
2025-02-04 09:07:34 dovecot_plain authenticator failed for ([36.134.78.151]) [36.134.78.151]:45062: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.215.133.102
description:
Feb  4 09:07:07 ait sshd[4008483]: Failed password for invalid user luisa from 162.215.133.102 port 35968 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.69.76.148
description:
2025-02-04 09:07:47 dovecot_plain authenticator failed for ([125.69.76.148]) [125.69.76.148]:41993: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.98.157
description:
2025-02-04 09:08:05 dovecot_plain authenticator failed for ([222.119.98.157]) [222.119.98.157]:35798: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.162.227
description:
2025-02-04 09:09:02 dovecot_plain authenticator failed for broadband-178-140-162-227.ip.moscow.rt.ru [178.140.162.227]:55612: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.227.200.201
description:
2025-02-04 09:08:19 dovecot_login authenticator failed for ([171.227.200.201]) [171.227.200.201]:54797: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.145.169.138
description:
2025-02-04 09:08:37 dovecot_login authenticator failed for ([58.145.169.138]) [58.145.169.138]:42464: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Feb  4 09:08:43 ait sshd[4009216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.204.13
description:
2025-02-04 09:08:43 dovecot_login authenticator failed for vps-45cb66f2.vps.ovh.net [135.125.204.13]:41178: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.217.70.151
description:
2025-02-04 09:08:48 dovecot_login authenticator failed for ([171.217.70.151]) [171.217.70.151]:34840: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
description:
2025-02-04 09:08:16 dovecot_plain authenticator failed for ([209.173.10.75]) [209.173.10.75]:53310: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
description:
2025-02-04 09:08:08 dovecot_login authenticator failed for ([89.101.36.159]) [89.101.36.159]:46987: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.225.162.97
description:
[2025-02-04 09:08:34 +0100] info [webmaild] 200.225.162.97 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.199.98.51
description:
2025-02-04 09:08:36 dovecot_login authenticator failed for ([185.199.98.51]) [185.199.98.51]:32844: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Feb  4 09:08:43 ait sshd[4009216]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.45.84
description:
47.128.45.84 - - [04/Feb/2025:09:09:07 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15913164 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/main/index.php?Itemid=124&id=24&option=com_joomgallery&task=download" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.45.84


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.84.49.35
description:
[2025-02-04 09:09:08 +0100] info [webmaild] 177.84.49.35 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.97
description:
2025-02-04 09:09:29 dovecot_plain authenticator failed for ([179.185.1.97]) [179.185.1.97]:47997: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.86.134.216
description:
2025-02-04 09:09:30 dovecot_plain authenticator failed for syn-097-086-134-216.res.spectrum.com [97.86.134.216]:4392: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.1.159
description:
2025-02-04 09:09:43 dovecot_plain authenticator failed for 111-70-1-159.emome-ip.hinet.net [111.70.1.159]:57219: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.249.167.45
description:
2025-02-04 09:09:09 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:37497: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
description:
2025-02-04 09:09:25 dovecot_plain authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:52014: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.39.230.40
description:
2025-02-04 09:09:47 dovecot_login authenticator failed for ([118.39.230.40]) [118.39.230.40]:1066: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.35.63.27
description:
2025-02-04 09:10:00 dovecot_login authenticator failed for ([110.35.63.27]) [110.35.63.27]:53416: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.199.20
description:
2025-02-04 09:10:35 dovecot_plain authenticator failed for ([157.122.199.20]) [157.122.199.20]:39846: 535 Incorrect authentication data (set_id=ads07b99022y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.233.157.92
description:
[2025-02-04 09:10:13 +0100] info [webmaild] 170.233.157.92 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.85.69.22
description:
2025-02-04 09:10:20 dovecot_plain authenticator failed for ([194.85.69.22]) [194.85.69.22]:50890: 535 Incorrect authentication data (set_id=ads07b99022y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.131.189.12
description:
[2025-02-04 09:10:44 +0100] info [webmaild] 177.131.189.12 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.42.85
description:
2025-02-04 09:11:04 dovecot_login authenticator failed for ([203.124.42.85]) [203.124.42.85]:42662: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.139.209
description:
[2025-02-04 09:11:44 +0100] info [webmaild] 157.100.139.209 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.170.81
description:
Feb  4 09:12:05 ait sshd[4010673]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.89.170.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
description:
2025-02-04 09:11:14 dovecot_login authenticator failed for ([164.164.117.23]) [164.164.117.23]:42366: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.241.188
description:
2025-02-04 09:11:37 dovecot_plain authenticator failed for (85.105.241.188.static.ttnet.com.tr) [85.105.241.188]:50022: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 09:11:39 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.10.228
description:
2025-02-04 09:11:49 dovecot_plain authenticator failed for (228.10.245.49.unknown.m1.com.sg) [49.245.10.228]:33125: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.76.106.226
description:
2025-02-04 09:11:57 dovecot_plain authenticator failed for (226.106.76.200.static.redip.topnet.com.mx) [200.76.106.226]:59418: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 09:11:09 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.201.7
description:
2025-02-04 09:11:47 dovecot_plain authenticator failed for ([59.12.201.7]) [59.12.201.7]:48381: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.89.170.81
description:
Feb  4 09:12:05 ait sshd[4010673]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.170.81


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.12.113.114
description:
[2025-02-04 09:11:09 +0100] info [webmaild] 189.12.113.114 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.21.140.222
description:
[2025-02-04 09:12:51 +0100] info [webmaild] 177.21.140.222 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.22.29
description:
47.128.22.29 - - [04/Feb/2025:09:13:04 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13664657 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/course-tag/manager/?filtering=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.22.29


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.170.81
description:
Feb  4 09:12:07 ait sshd[4010673]: Failed password for invalid user it from 159.89.170.81 port 34938 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.177.106
description:
2025-02-04 09:12:08 dovecot_plain authenticator failed for ([196.250.177.106]) [196.250.177.106]:44876: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.224.220
description:
2025-02-04 09:12:22 dovecot_plain authenticator failed for (220.224.221.60.adsl-pool.sx.cn) [60.221.224.220]:52507: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.159.99.67
description:
[2025-02-04 09:13:22 +0100] info [webmaild] 102.159.99.67 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.219.138.75
description:
[2025-02-04 09:13:54 +0100] info [webmaild] 186.219.138.75 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.29.176.41
description:
2025-02-04 09:14:42 dovecot_plain authenticator failed for 41.red-80-29-176.dynamicip.rima-tde.net [80.29.176.41]:58257: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.237.119
description:
Feb  4 09:14:43 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.237.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.110.70.2
description:
2025-02-04 09:14:08 dovecot_plain authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:48056: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.237.119
description:
2025-02-04 09:14:45 dovecot_plain authenticator failed for ([220.80.237.119]) [220.80.237.119]:34277: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Feb  4 09:14:36 ait sshd[4011511]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
description:
2025-02-04 09:14:56 dovecot_plain authenticator failed for ([96.79.174.131]) [96.79.174.131]:34655: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.9.74
description:
2025-02-04 09:14:10 dovecot_plain authenticator failed for (200151121049.user.veloxzone.com.br) [200.151.9.74]:48642: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.144.14.204
description:
2025-02-04 09:14:20 dovecot_plain authenticator failed for (14.204.bol-online.com) [122.144.14.204]:56087: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.255.145.116
description:
[2025-02-04 09:14:27 +0100] info [webmaild] 138.255.145.116 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.36.213.182
description:
[2025-02-04 09:15:27 +0100] info [webmaild] 177.36.213.182 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 09:15:54 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-16.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.14.111.102
description:
[2025-02-04 09:16:01 +0100] info [webmaild] 5.14.111.102 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 09:15:07 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.185.24.64
description:
[2025-02-04 09:16:33 +0100] info [webmaild] 103.185.24.64 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.35.237.38
description:
2025-02-04 09:16:55 dovecot_plain authenticator failed for ([211.35.237.38]) [211.35.237.38]:55148: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.76.96.83
description:
[2025-02-04 09:17:04 +0100] info [webmaild] 105.76.96.83 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 41.216.188.18
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:superadmin||WPU:superadmin||RSV:6.65||T:APACHE||MV:09-17.41.216.188.18


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.253.45.10
description:
Feb  4 09:17:24 ait sshd[4012933]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.253.45.10


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
description:
2025-02-04 09:17:27 dovecot_plain authenticator failed for (minness) [64.72.74.162]:60861: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.238.43.146
description:
Feb  4 09:17:34 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.238.43.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-02-04 09:17:13 dovecot_plain authenticator failed for ([218.150.170.10]) [218.150.170.10]:32834: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.180.162.26
description:
Feb  4 09:17:18 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.180.162.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 09:17:27 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Feb  4 09:17:11 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
description:
Feb  4 09:17:25 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.43.146
description:
2025-02-04 09:17:36 dovecot_plain authenticator failed for ([186.238.43.146]) [186.238.43.146]:52433: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.42.80
description:
Feb  4 09:18:01 ait sshd[4013186]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.42.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 09:17:21 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.253.45.10
description:
Feb  4 09:17:24 ait sshd[4012933]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.253.45.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.115.242.99
description:
[2025-02-04 09:18:00 +0100] info [webmaild] 103.115.242.99 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.42.80
description:
Feb  4 09:18:01 ait sshd[4013186]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.42.80


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.180.162.26
description:
2025-02-04 09:17:20 dovecot_plain authenticator failed for ([42.180.162.26]) [42.180.162.26]:60139: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.148.165
description:
Feb  4 09:18:35 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.148.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.239.231.61
description:
2025-02-04 09:18:38 dovecot_plain authenticator failed for ([222.239.231.61]) [222.239.231.61]:55931: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 09:18:45 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.63
description:
Feb  4 09:18:18 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
description:
2025-02-04 09:18:37 dovecot_plain authenticator failed for (lariang) [65.20.148.165]:52669: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Feb  4 09:18:39 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-02-04 09:18:41 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (paphic) [87.103.126.54]:16087: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 110.44.115.201
description:
[2025-02-04 09:18:30 +0100] info [webmaild] 110.44.115.201 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.231.61
description:
Feb  4 09:18:36 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.239.231.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.63
description:
2025-02-04 09:18:20 dovecot_plain authenticator failed for (m121-202-154-63.smartone.com) [121.202.154.63]:4029: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
description:
2025-02-04 09:19:42 dovecot_plain authenticator failed for ([186.239.41.74]) [186.239.41.74]:34174: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.75.204.179
description:
[2025-02-04 09:19:47 +0100] info [webmaild] 196.75.204.179 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.91.173.203
description:
Feb  4 09:19:51 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.91.173.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.74
description:
Feb  4 09:19:40 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.110.77
description:
Feb  4 09:19:09 ait sshd[4013577]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.110.77 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.110.77
description:
Feb  4 09:19:09 ait sshd[4013577]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.110.77


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.186.238.39
description:
[2025-02-04 09:19:15 +0100] info [webmaild] 103.186.238.39 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.123
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads18a00018y||WPU:ads18a00018y||RSV:6.65||T:APACHE||MV:09-19.170.205.31.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.91.173.203
description:
2025-02-04 09:19:53 dovecot_plain authenticator failed for (197-91-173-203.dyn.mweb.co.za) [197.91.173.203]:51096: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.177.167.208
description:
[2025-02-04 09:20:27 +0100] info [webmaild] 102.177.167.208 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.193.168.181
description:
Feb  4 09:20:54 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.193.168.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.181
description:
2025-02-04 09:20:56 dovecot_plain authenticator failed for ([203.193.168.181]) [203.193.168.181]:55588: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.233.51.12
description:
[2025-02-04 09:20:57 +0100] info [webmaild] 45.233.51.12 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.253.45.10
description:
Feb  4 09:21:28 ait sshd[4014761]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.253.45.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.253.45.10
description:
Feb  4 09:21:28 ait sshd[4014761]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.253.45.10


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.163.20.198
description:
[2025-02-04 09:21:43 +0100] info [webmaild] 188.163.20.198 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.226.255.240
description:
2025-02-04 09:21:55 dovecot_plain authenticator failed for ([58.226.255.240]) [58.226.255.240]:4269: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.85.12.142
description:
2025-02-04 09:21:58 dovecot_plain authenticator failed for ([61.85.12.142]) [61.85.12.142]:35420: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.207.76
description:
2025-02-04 09:21:44 dovecot_plain authenticator failed for wsip-70-166-207-76.ph.ph.cox.net ([70.166.207.65]) [70.166.207.76]:53798: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-02-04 09:21:13 dovecot_plain authenticator failed for ([2.57.219.14]) [2.57.219.2]:55384: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.36.108.223
description:
Feb  4 09:21:16 ait sshd[4014734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.36.108.223


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Feb  4 09:21:11 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Feb  4 09:21:16 ait sshd[4014734]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.166.207.76
description:
Feb  4 09:21:42 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.166.207.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.226.255.240
description:
Feb  4 09:21:53 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.226.255.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.85.12.142
description:
Feb  4 09:21:56 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.85.12.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.31.80.222
description:
Feb  4 09:22:11 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.31.80.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.79.91.142
description:
Feb  4 09:22:14 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.79.91.142 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.253.45.10
description:
Feb  4 09:22:40 ait sshd[4015154]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.253.45.10


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.230.229.65
description:
[2025-02-04 09:22:17 +0100] info [webmaild] 94.230.229.65 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.104
description:
Feb  4 09:22:42 ait sshd[4015160]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.253.45.10
description:
Feb  4 09:22:40 ait sshd[4015154]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.253.45.10 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.253.45.10
description:
Feb  4 09:22:41 ait sshd[4015154]: Failed password for invalid user shree from 46.253.45.10 port 60546 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.145.221.21
description:
Feb  4 09:22:12 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.145.221.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.80.222
description:
2025-02-04 09:22:13 dovecot_plain authenticator failed for ([1.31.80.222]) [1.31.80.222]:60768: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.145.221.21
description:
2025-02-04 09:22:14 dovecot_plain authenticator failed for ([219.145.221.21]) [219.145.221.21]:53720: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.79.91.142
description:
2025-02-04 09:22:16 dovecot_plain authenticator failed for wsip-174-79-91-142.br.br.cox.net [174.79.91.142]:64235: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.104
description:
Feb  4 09:22:42 ait sshd[4015160]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 09:23:44 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.251.96
description:
2025-02-04 09:23:57 dovecot_plain authenticator failed for (abts-kk-static-96.251.166.122.airtelbroadband.in) [122.166.251.96]:38152: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.76.194.159
description:
Feb  4 09:24:01 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.76.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.29.235.66
description:
Feb  4 09:23:22 ait sshd[4015466]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.29.235.66


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.217.205.23
description:
[2025-02-04 09:23:40 +0100] info [webmaild] 189.217.205.23 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.150.182
description:
2025-02-04 09:23:55 dovecot_plain authenticator failed for ([182.176.150.182]) [182.176.150.182]:35398: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.241.253
description:
Feb  4 09:24:02 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.241.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.71.101
description:
2025-02-04 09:23:54 dovecot_plain authenticator failed for ([82.208.71.101]) [82.208.71.101]:59996: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.251.96
description:
Feb  4 09:23:55 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.251.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.128.202
description:
Feb  4 09:23:55 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.128.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
description:
2025-02-04 09:23:57 dovecot_plain authenticator failed for ([192.34.128.202]) [192.34.128.202]:41746: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.224.251.73
description:
[2025-02-04 09:23:09 +0100] info [webmaild] 45.224.251.73 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.29.235.66
description:
Feb  4 09:23:22 ait sshd[4015466]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.29.235.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.241.253
description:
2025-02-04 09:24:04 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:52870: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
description:
2025-02-04 09:24:03 dovecot_plain authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:42081: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.208.71.101
description:
Feb  4 09:23:52 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.208.71.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.176.150.182
description:
Feb  4 09:23:53 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.176.150.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.37.179.83
description:
Feb  4 09:24:11 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.37.179.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.49.3.38
description:
Feb  4 09:24:13 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.49.3.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.253.246.84
description:
Feb  4 09:24:42 ait sshd[4015956]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.253.246.84


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.75.33.121
description:
Feb  4 09:24:09 ait sshd[4015747]: pam_imunify(sshd:auth): [IM360_RBL] The IP 109.75.33.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.17.46.166
description:
2025-02-04 09:24:09 dovecot_plain authenticator failed for (166.46.17.175.adsl-pool.jlccptt.net.cn) [175.17.46.166]:37126: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.119.253
description:
Feb  4 09:24:19 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.119.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.119.253
description:
2025-02-04 09:24:21 dovecot_plain authenticator failed for ([167.250.119.253]) [167.250.119.253]:38670: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.212.19.9
description:
Feb  4 09:24:30 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.212.19.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.212.19.9
description:
2025-02-04 09:24:32 dovecot_plain authenticator failed for ([116.212.19.9]) [116.212.19.9]:36676: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.13.1.123
description:
[2025-02-04 09:24:57 +0100] info [webmaild] 187.13.1.123 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 109.75.33.121
description:
Feb  4 09:24:09 ait sshd[4015747]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.75.33.121


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.253.246.84
description:
Feb  4 09:24:42 ait sshd[4015956]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.253.246.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.64.54
description:
Feb  4 09:24:56 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.64.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.64.54
description:
2025-02-04 09:24:58 dovecot_plain authenticator failed for ([58.18.64.54]) [58.18.64.54]:37335: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
description:
2025-02-04 09:24:13 dovecot_plain authenticator failed for ([200.37.179.83]) [200.37.179.83]:59034: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.49.3.38
description:
2025-02-04 09:24:15 dovecot_plain authenticator failed for ([181.49.3.38]) [181.49.3.38]:56090: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.199.38.71
description:
[2025-02-04 09:24:22 +0100] info [webmaild] 181.199.38.71 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.17.46.166
description:
Feb  4 09:24:07 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.17.46.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.68
description:
Feb  4 09:25:19 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.132.150.162
description:
Feb  4 09:25:36 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.132.150.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.35.242.51
description:
2025-02-04 09:25:07 dovecot_plain authenticator failed for host-79-35-242-51.retail.telecomitalia.it [79.35.242.51]:46537: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.61.183.212
description:
Feb  4 09:25:12 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.61.183.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.100
description:
2025-02-04 09:25:17 dovecot_plain authenticator failed for (m121-202-203-100.smartone.com) [121.202.203.100]:46275: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.92.192.154
description:
Feb  4 09:25:24 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.92.192.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.243.50
description:
2025-02-04 09:25:30 dovecot_plain authenticator failed for ([117.158.243.50]) [117.158.243.50]:50160: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.156.137
description:
2025-02-04 09:25:34 dovecot_plain authenticator failed for ([14.49.156.137]) [14.49.156.137]:59281: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.143.206
description:
Feb  4 09:25:12 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.143.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.140.90
description:
2025-02-04 09:25:15 dovecot_plain authenticator failed for ([183.237.140.90]) [183.237.140.90]:58258: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.241.161
description:
2025-02-04 09:25:31 dovecot_plain authenticator failed for ([115.23.241.161]) [115.23.241.161]:33041: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.1.210
description:
Feb  4 09:25:23 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.1.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.224.220
description:
2025-02-04 09:25:31 dovecot_plain authenticator failed for (220.224.221.60.adsl-pool.sx.cn) [60.221.224.220]:35458: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.94.219
description:
2025-02-04 09:25:24 dovecot_plain authenticator failed for ([124.246.94.219]) [124.246.94.219]:60303: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.234.165.73
description:
2025-02-04 09:25:26 dovecot_plain authenticator failed for ([58.234.165.73]) [58.234.165.73]:57400: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.102
description:
2025-02-04 09:25:30 dovecot_plain authenticator failed for ([121.202.152.102]) [121.202.152.102]:14579: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.155.16.231
description:
2025-02-04 09:25:31 dovecot_plain authenticator failed for ([121.155.16.231]) [121.155.16.231]:56560: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.140.240
description:
2025-02-04 09:25:34 dovecot_plain authenticator failed for ([111.48.140.240]) [111.48.140.240]:24896: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.242.86.203
description:
Feb  4 09:25:45 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.242.86.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.186.220.42
description:
2025-02-04 09:25:11 dovecot_plain authenticator failed for ([211.186.220.42]) [211.186.220.42]:56671: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.221.2.199
description:
2025-02-04 09:25:12 dovecot_plain authenticator failed for ([114.221.2.199]) [114.221.2.199]:34500: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.242.86.203
description:
2025-02-04 09:25:47 dovecot_plain authenticator failed for ([58.242.86.203]) [58.242.86.203]:54425: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.167.115.17
description:
Feb  4 09:25:51 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.167.115.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.252.57
description:
Feb  4 09:25:14 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.252.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.141.105.6
description:
Feb  4 09:25:26 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.141.105.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.92.192.154
description:
2025-02-04 09:25:26 dovecot_plain authenticator failed for (187-92-192-154.customer.tdatabrasil.net.br) [187.92.192.154]:43195: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.177.61
description:
Feb  4 09:25:21 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.177.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.246.94.219
description:
Feb  4 09:25:22 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.246.94.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.64.170
description:
2025-02-04 09:25:17 dovecot_plain authenticator failed for ([50.171.64.170]) [50.171.64.170]:55434: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.48.104.200
description:
2025-02-04 09:25:22 dovecot_plain authenticator failed for ([112.48.104.200]) [112.48.104.200]:39872: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.177.61
description:
2025-02-04 09:25:23 dovecot_plain authenticator failed for (61-177-53-194.mairnet.net) [194.53.177.61]:43956: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.154.94.85
description:
2025-02-04 09:25:41 dovecot_plain authenticator failed for ([43.154.94.85]) [43.154.94.85]:36638: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.40.72.101
description:
Feb  4 09:25:51 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.40.72.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.80.46.250
description:
Feb  4 09:25:09 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.80.46.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.171.64.170
description:
Feb  4 09:25:15 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.171.64.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.68
description:
2025-02-04 09:25:21 dovecot_plain authenticator failed for ([144.48.49.68]) [144.48.49.68]:46568: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.1.210
description:
2025-02-04 09:25:25 dovecot_plain authenticator failed for ([60.172.1.210]) [60.172.1.210]:51706: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.199.18
description:
2025-02-04 09:25:28 dovecot_plain authenticator failed for ([103.132.199.18]) [103.132.199.18]:8994: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.241.15
description:
Feb  4 09:25:35 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.241.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.179
description:
Feb  4 09:25:36 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.243.43.58
description:
2025-02-04 09:25:13 dovecot_plain authenticator failed for ([211.243.43.58]) [211.243.43.58]:39084: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.100.104
description:
Feb  4 09:25:14 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.100.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.177.106
description:
Feb  4 09:25:28 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.177.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.20.26.201
description:
2025-02-04 09:26:01 dovecot_plain authenticator failed for 211-20-26-201.hinet-ip.hinet.net [211.20.26.201]:44924: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Feb  4 09:25:06 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-02-04 09:25:08 dovecot_plain authenticator failed for (94-43-224-106.dsl.utg.ge) [2.57.219.2]:47482: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.40.18.220
description:
2025-02-04 09:25:30 dovecot_plain authenticator failed for ([179.40.18.220]) [179.40.18.220]:52335: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.222
description:
Feb  4 09:25:43 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.222 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.191.195.123
description:
[2025-02-04 09:25:44 +0100] info [webmaild] 45.191.195.123 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.121.193.191
description:
2025-02-04 09:25:09 dovecot_plain authenticator failed for syn-070-121-193-191.res.spectrum.com [70.121.193.191]:38809: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
description:
2025-02-04 09:25:20 dovecot_plain authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:58307: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.44.217.237
description:
2025-02-04 09:25:32 dovecot_plain authenticator failed for ([121.44.217.237]) [121.44.217.237]:47013: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.85.12.142
description:
Feb  4 09:25:12 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.85.12.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.91.144
description:
Feb  4 09:25:19 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.91.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.42.163.252
description:
Feb  4 09:25:13 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.42.163.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.100
description:
Feb  4 09:25:15 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.44.217.237
description:
Feb  4 09:25:30 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.44.217.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.45.44.204
description:
Feb  4 09:25:31 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.45.44.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.222
description:
2025-02-04 09:25:45 dovecot_plain authenticator failed for ([121.202.205.222]) [121.202.205.222]:48037: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 109.75.33.121
description:
Feb  4 09:25:51 ait sshd[4016593]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.75.33.121


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.235.5
description:
Feb  4 09:25:07 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.235.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.1.177
description:
Feb  4 09:25:07 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.1.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.160.128.46
description:
Feb  4 09:25:25 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.160.128.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.35.242.51
description:
Feb  4 09:25:05 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.35.242.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.105.3.221
description:
2025-02-04 09:25:25 dovecot_plain authenticator failed for ([183.105.3.221]) [183.105.3.221]:41214: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.241.15
description:
2025-02-04 09:25:37 dovecot_plain authenticator failed for broadband-5-228-241-15.ip.moscow.rt.ru [5.228.241.15]:58046: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.190.69
description:
Feb  4 09:25:50 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.255.190.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.191.230.34
description:
2025-02-04 09:25:10 dovecot_plain authenticator failed for (46.191.230.34.static.oktgs.ufanet.ru) [46.191.230.34]:46926: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.243.50
description:
Feb  4 09:25:28 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.243.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.61.183.212
description:
2025-02-04 09:25:14 dovecot_plain authenticator failed for host-82-61-183-212.retail.telecomitalia.it [82.61.183.212]:38088: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.42.163.252
description:
2025-02-04 09:25:15 dovecot_plain authenticator failed for ([185.42.163.252]) [185.42.163.252]:49210: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.125.196
description:
2025-02-04 09:25:26 dovecot_plain authenticator failed for ([36.135.125.196]) [36.135.125.196]:36866: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.225.240
description:
2025-02-04 09:25:27 dovecot_plain authenticator failed for ([94.204.225.240]) [94.204.225.240]:40595: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.175.110.3
description:
2025-02-04 09:25:32 dovecot_plain authenticator failed for ([222.175.110.3]) [222.175.110.3]:46874: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.103
description:
2025-02-04 09:25:11 dovecot_plain authenticator failed for (m121-202-195-103.smartone.com) [121.202.195.103]:17512: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.10
description:
2025-02-04 09:25:12 dovecot_plain authenticator failed for ([203.189.124.10]) [203.189.124.10]:50872: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.231.242
description:
Feb  4 09:25:10 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.231.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.221.224.220
description:
Feb  4 09:25:29 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.221.224.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.116.95.48
description:
2025-02-04 09:25:37 dovecot_plain authenticator failed for ([203.116.95.48]) [203.116.95.48]:48180: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.46.250
description:
2025-02-04 09:25:11 dovecot_plain authenticator failed for ([189.80.46.250]) [189.80.46.250]:43897: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.40.18.220
description:
Feb  4 09:25:28 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.40.18.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.177
description:
2025-02-04 09:25:09 dovecot_plain authenticator failed for (marvitel.static.gvt.net.br) [179.185.1.177]:33739: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.235.5
description:
2025-02-04 09:25:09 dovecot_plain authenticator failed for ([104.241.235.5]) [104.241.235.5]:59094: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.143.30.155
description:
Feb  4 09:25:10 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.143.30.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.10
description:
Feb  4 09:25:10 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.189
description:
Feb  4 09:25:10 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.243.43.58
description:
Feb  4 09:25:11 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.243.43.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.51.222.234
description:
Feb  4 09:25:07 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.51.222.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.195.103
description:
Feb  4 09:25:09 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.195.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
description:
2025-02-04 09:25:16 dovecot_plain authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:41880: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.141.105.6
description:
2025-02-04 09:25:28 dovecot_plain authenticator failed for (6.105.141.116.adsl-pool.jlccptt.net.cn) [116.141.105.6]:40148: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.241.161
description:
Feb  4 09:25:29 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.241.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.45.44.204
description:
2025-02-04 09:25:33 dovecot_plain authenticator failed for p384205-obmd01.tokyo.ocn.ne.jp [60.45.44.204]:42483: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.158.42
description:
Feb  4 09:25:41 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.158.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.79.247
description:
2025-02-04 09:25:11 dovecot_plain authenticator failed for ([14.37.79.247]) [14.37.79.247]:60860: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.14.83
description:
2025-02-04 09:25:18 dovecot_plain authenticator failed for (187.161.14.83-clientes-izzi.mx) [187.161.14.83]:42721: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.135.125.196
description:
Feb  4 09:25:24 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.135.125.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.155.16.231
description:
Feb  4 09:25:29 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.155.16.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.88.154.47
description:
2025-02-04 09:25:34 dovecot_plain authenticator failed for (47.154.88.116.starhub.net.sg) [116.88.154.47]:54769: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
description:
2025-02-04 09:25:38 dovecot_plain authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:45720: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.75.33.121
description:
Feb  4 09:25:51 ait sshd[4016593]: pam_imunify(sshd:auth): [IM360_RBL] The IP 109.75.33.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.190.69
description:
2025-02-04 09:25:52 dovecot_plain authenticator failed for ([92.255.190.69]) [92.255.190.69]:50568: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.85.12.142
description:
2025-02-04 09:25:14 dovecot_plain authenticator failed for ([61.85.12.142]) [61.85.12.142]:39628: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.161.14.83
description:
Feb  4 09:25:16 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.161.14.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.90.34.32
description:
Feb  4 09:25:19 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.90.34.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.26.197
description:
2025-02-04 09:25:28 dovecot_plain authenticator failed for ([61.184.26.197]) [61.184.26.197]:34474: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.182.171
description:
Feb  4 09:25:31 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.182.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.4.150
description:
Feb  4 09:25:36 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.4.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.178.251.33
description:
2025-02-04 09:25:14 dovecot_plain authenticator failed for ([210.178.251.33]) [210.178.251.33]:50914: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.88.91.22
description:
2025-02-04 09:25:17 dovecot_plain authenticator failed for syn-097-088-091-022.res.spectrum.com [97.88.91.22]:48785: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.88.91.22
description:
Feb  4 09:25:15 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.88.91.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.109.127.195
description:
Feb  4 09:25:24 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.109.127.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.102
description:
Feb  4 09:25:28 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.40.72.101
description:
2025-02-04 09:25:53 dovecot_plain authenticator failed for ([89.40.72.101]) [89.40.72.101]:33752: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.51.222.234
description:
2025-02-04 09:25:09 dovecot_plain authenticator failed for a109-51-222-234.cpe.netcabo.pt [109.51.222.234]:51359: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.221.2.199
description:
Feb  4 09:25:10 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.221.2.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.18.252.107
description:
Feb  4 09:25:23 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.18.252.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.90.115.227
description:
2025-02-04 09:25:36 dovecot_plain authenticator failed for ([165.90.115.227]) [165.90.115.227]:60283: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.154.94.85
description:
Feb  4 09:25:39 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.154.94.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.189
description:
2025-02-04 09:25:12 dovecot_plain authenticator failed for ([60.167.19.189]) [60.167.19.189]:55753: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.185.89.241
description:
2025-02-04 09:25:12 dovecot_plain authenticator failed for ([39.185.89.241]) [39.185.89.241]:59765: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.196.106
description:
Feb  4 09:25:22 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.196.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.196.106
description:
2025-02-04 09:25:24 dovecot_plain authenticator failed for 186-247-196-106.user.veloxzone.com.br [186.247.196.106]:47194: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.18.252.107
description:
2025-02-04 09:25:25 dovecot_plain authenticator failed for ([14.18.252.107]) [14.18.252.107]:21649: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.109.127.195
description:
2025-02-04 09:25:26 dovecot_plain authenticator failed for ([39.109.127.195]) [39.109.127.195]:35716: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.90.115.227
description:
Feb  4 09:25:34 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.90.115.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.143.30.155
description:
2025-02-04 09:25:12 dovecot_plain authenticator failed for ([222.143.30.155]) [222.143.30.155]:47674: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.192.94
description:
2025-02-04 09:25:16 dovecot_plain authenticator failed for 186-247-192-94.user.veloxzone.com.br ([179.236.122.153]) [186.247.192.94]:42098: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.143.115.18
description:
2025-02-04 09:25:48 dovecot_plain authenticator failed for (18.115.143.122.adsl-pool.jlccptt.net.cn) [122.143.115.18]:54972: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.167.115.17
description:
2025-02-04 09:25:53 dovecot_plain authenticator failed for (173-167-115-17-sfba.hfc.comcastbusiness.net) [173.167.115.17]:58281: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.158.42
description:
2025-02-04 09:25:43 dovecot_plain authenticator failed for ([186.200.158.42]) [186.200.158.42]:46432: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.143.115.18
description:
Feb  4 09:25:46 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.143.115.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.225.240
description:
Feb  4 09:25:25 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.225.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.49.156.137
description:
Feb  4 09:25:32 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.49.156.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.140.240
description:
Feb  4 09:25:32 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.140.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.164.147.150
description:
2025-02-04 09:25:11 dovecot_plain authenticator failed for ([181.164.147.150]) [181.164.147.150]:32546: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.48.104.200
description:
Feb  4 09:25:20 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.48.104.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.116.95.48
description:
Feb  4 09:25:35 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.116.95.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.4.150
description:
2025-02-04 09:25:38 dovecot_plain authenticator failed for ([222.180.4.150]) [222.180.4.150]:52609: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.191.230.34
description:
Feb  4 09:25:08 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.191.230.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.177.106
description:
2025-02-04 09:25:30 dovecot_plain authenticator failed for ([196.250.177.106]) [196.250.177.106]:46542: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.238.94
description:
2025-02-04 09:25:11 dovecot_plain authenticator failed for 186-247-238-94.user.veloxzone.com.br (186-247-238-241.user.veloxzone.com.br) [186.247.238.94]:52135: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.140.90
description:
Feb  4 09:25:13 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.140.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.105.3.221
description:
Feb  4 09:25:23 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.105.3.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
description:
2025-02-04 09:25:30 dovecot_plain authenticator failed for ([211.53.58.1]) [211.169.212.206]:64450: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.171
description:
2025-02-04 09:25:33 dovecot_plain authenticator failed for ([220.77.182.171]) [220.77.182.171]:34428: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.121.193.191
description:
Feb  4 09:25:07 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.121.193.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.164.147.150
description:
Feb  4 09:25:09 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.164.147.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.234.165.73
description:
Feb  4 09:25:24 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.234.165.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.132.199.18
description:
Feb  4 09:25:26 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.132.199.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.20.26.201
description:
Feb  4 09:25:59 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.20.26.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
description:
Feb  4 09:25:10 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.91.144
description:
2025-02-04 09:25:21 dovecot_plain authenticator failed for ([58.16.91.144]) [58.16.91.144]:34758: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.231.242
description:
2025-02-04 09:25:12 dovecot_plain authenticator failed for ([124.115.231.242]) [124.115.231.242]:59869: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.143.206
description:
2025-02-04 09:25:14 dovecot_plain authenticator failed for ([112.194.143.206]) [112.194.143.206]:51548: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.90.34.32
description:
2025-02-04 09:25:21 dovecot_plain authenticator failed for syn-071-090-034-032.res.spectrum.com [71.90.34.32]:42697: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.238.94
description:
Feb  4 09:25:09 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.238.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.178.251.33
description:
Feb  4 09:25:12 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.178.251.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.88.154.47
description:
Feb  4 09:25:32 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.88.154.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.179
description:
2025-02-04 09:25:38 dovecot_plain authenticator failed for ([182.135.66.179]) [182.135.66.179]:48452: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.192.94
description:
Feb  4 09:25:14 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.192.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.212.206
description:
Feb  4 09:25:28 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.185.89.241
description:
Feb  4 09:25:10 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.185.89.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.252.57
description:
2025-02-04 09:25:16 dovecot_plain authenticator failed for (57.252.223.60.adsl-pool.sx.cn) [60.223.252.57]:57765: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.97.253.246
description:
Feb  4 09:25:18 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.97.253.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.217.86
description:
Feb  4 09:25:22 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.217.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.160.128.46
description:
2025-02-04 09:25:27 dovecot_plain authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:57101: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.186.220.42
description:
Feb  4 09:25:09 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.186.220.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.79.247
description:
Feb  4 09:25:09 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.79.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.26.197
description:
Feb  4 09:25:26 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.26.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.175.110.3
description:
Feb  4 09:25:30 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.175.110.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
description:
2025-02-04 09:25:12 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:39518: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.217.86
description:
2025-02-04 09:25:24 dovecot_plain authenticator failed for ([183.167.217.86]) [183.167.217.86]:36272: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.128.246.7
description:
[2025-02-04 09:26:15 +0100] info [webmaild] 177.128.246.7 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.113.9.34
description:
Feb  4 09:26:39 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.113.9.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 09:27:00 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.116.19.117
description:
Feb  4 09:26:27 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.116.19.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.19.117
description:
2025-02-04 09:26:29 dovecot_plain authenticator failed for ([222.116.19.117]) [222.116.19.117]:39034: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.113.9.34
description:
2025-02-04 09:26:41 dovecot_plain authenticator failed for ([111.113.9.34]) [111.113.9.34]:44859: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 27.147.191.92
description:
[2025-02-04 09:26:57 +0100] info [webmaild] 27.147.191.92 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 09:27:48 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.207.76
description:
2025-02-04 09:27:54 dovecot_plain authenticator failed for wsip-70-166-207-76.ph.ph.cox.net ([70.166.207.65]) [70.166.207.76]:53254: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
description:
Feb  4 09:28:04 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.253.246.84
description:
Feb  4 09:27:39 ait sshd[4017342]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.253.246.84 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.253.246.84
description:
Feb  4 09:27:39 ait sshd[4017342]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.253.246.84


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.75.33.121
description:
Feb  4 09:27:10 ait sshd[4017060]: Failed password for invalid user debian from 109.75.33.121 port 44326 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.33.103
description:
[2025-02-04 09:27:30 +0100] info [webmaild] 45.70.33.103 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.166.207.76
description:
Feb  4 09:27:52 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.166.207.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.75.33.121
description:
Feb  4 09:27:08 ait sshd[4017060]: pam_imunify(sshd:auth): [IM360_RBL] The IP 109.75.33.121 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 109.75.33.121
description:
Feb  4 09:27:08 ait sshd[4017060]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.75.33.121


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
description:
2025-02-04 09:28:29 dovecot_plain authenticator failed for ([219.248.65.30]) [219.248.65.30]:59246: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.0.40.191
description:
[2025-02-04 09:28:33 +0100] info [webmaild] 170.0.40.191 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.41.94.106
description:
[2025-02-04 09:29:05 +0100] info [webmaild] 103.41.94.106 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
description:
2025-02-04 09:28:06 dovecot_plain authenticator failed for ([41.220.3.113]) [41.220.3.101]:3845: 535 Incorrect authentication data (set_id=ds18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.116
description:
Feb  4 09:28:09 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
description:
2025-02-04 09:28:24 dovecot_plain authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:51472: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.116
description:
2025-02-04 09:28:11 dovecot_plain authenticator failed for ([103.190.91.116]) [103.190.91.116]:42485: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.127.124.229
description:
2025-02-04 09:28:11 dovecot_plain authenticator failed for 229.red-217-127-124.staticip.rima-tde.net [217.127.124.229]:42274: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Feb  4 09:28:39 ait sshd[4017838]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
description:
Feb  4 09:28:22 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.152.91.221
description:
Feb  4 09:28:25 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.152.91.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.105.113
description:
Feb  4 09:28:36 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.105.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.127.124.229
description:
Feb  4 09:28:09 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.127.124.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.107.192.176
description:
Feb  4 09:28:27 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.107.192.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.88.186.142
description:
Feb  4 09:28:57 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.88.186.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.227
description:
2025-02-04 09:28:12 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.227]:60825: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.152.91.221
description:
2025-02-04 09:28:27 dovecot_plain authenticator failed for ([124.152.91.221]) [124.152.91.221]:54818: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.227.31.58
description:
2025-02-04 09:28:33 dovecot_plain authenticator failed for ([91.227.31.58]) [91.227.31.58]:34851: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.182.162
description:
2025-02-04 09:28:32 dovecot_plain authenticator failed for ([61.83.232.94]) [221.163.182.162]:36562: 535 Incorrect authentication data (set_id=ds18b00116y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.88.186.142
description:
2025-02-04 09:28:59 dovecot_plain authenticator failed for ([201.88.186.142]) [201.88.186.142]:45552: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.248.65.30
description:
Feb  4 09:28:27 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.248.65.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.107.192.176
description:
2025-02-04 09:28:29 dovecot_plain authenticator failed for ([211.107.192.176]) [211.107.192.176]:47738: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.227.31.58
description:
Feb  4 09:28:31 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.227.31.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.105.113
description:
2025-02-04 09:28:38 dovecot_plain authenticator failed for (177-174-105-113.user.vivozap.com.br) [177.174.105.113]:56434: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.227
description:
Feb  4 09:28:10 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.163.182.162
description:
Feb  4 09:28:30 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.163.182.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
description:
Feb  4 09:28:39 ait sshd[4017838]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.253.246.84
description:
Feb  4 09:29:19 ait sshd[4018049]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.253.246.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.56.11.148
description:
Feb  4 09:29:22 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.56.11.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.173
description:
2025-02-04 09:29:46 dovecot_plain authenticator failed for ([182.135.66.173]) [182.135.66.173]:57614: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.81
description:
2025-02-04 09:29:53 dovecot_plain authenticator failed for ([183.249.1.81]) [183.249.1.81]:56719: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.176.46.239
description:
Feb  4 09:30:02 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.176.46.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.56.11.148
description:
2025-02-04 09:29:24 dovecot_plain authenticator failed for 93-56-11-148.ip287.fastwebnet.it [93.56.11.148]:44337: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.72.128.185
description:
Feb  4 09:29:40 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.72.128.185 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.164.255.34
description:
[2025-02-04 09:29:41 +0100] info [webmaild] 103.164.255.34 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.81
description:
Feb  4 09:29:51 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.46.239
description:
2025-02-04 09:30:04 dovecot_plain authenticator failed for (abts-north-static-239.46.176.122.airtelbroadband.in) [122.176.46.239]:51245: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.173
description:
Feb  4 09:29:44 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.161.111
description:
Feb  4 09:29:16 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.161.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.253.246.84
description:
Feb  4 09:29:19 ait sshd[4018049]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.253.246.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.161.111
description:
2025-02-04 09:29:18 dovecot_plain authenticator failed for p90112-obmd01.osaka.ocn.ne.jp [180.7.161.111]:41750: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.72.128.185
description:
2025-02-04 09:29:42 dovecot_plain authenticator failed for (187-072-128-185.static.ctbctelecom.com.br) [187.72.128.185]:58164: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.196.184.120
description:
Feb  4 09:29:55 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.196.184.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.120
description:
2025-02-04 09:29:57 dovecot_plain authenticator failed for ([74.196.184.120]) [74.196.184.120]:44186: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.253.50
description:
2025-02-04 09:30:08 dovecot_plain authenticator failed for ([112.91.253.50]) [112.91.253.50]:48312: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.77.211.174
description:
Feb  4 09:30:09 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.77.211.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.134.31.193
description:
Feb  4 09:30:10 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.134.31.193 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.48.191.52
description:
[2025-02-04 09:30:14 +0100] info [webmaild] 186.48.191.52 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.77.211.174
description:
2025-02-04 09:30:11 dovecot_plain authenticator failed for (host-174.211.77.5.ucom.am) [5.77.211.174]:35777: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.37.169.160
description:
Feb  4 09:30:28 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.37.169.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
description:
2025-02-04 09:30:12 dovecot_plain authenticator failed for ([121.134.31.193]) [121.134.31.193]:51542: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.134.94.201
description:
Feb  4 09:30:20 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.134.94.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.134.94.201
description:
2025-02-04 09:30:22 dovecot_plain authenticator failed for ([128.134.94.201]) [128.134.94.201]:42175: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.37.169.160
description:
2025-02-04 09:30:30 dovecot_plain authenticator failed for ([59.37.169.160]) [59.37.169.160]:54318: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.179.161
description:
Feb  4 09:31:05 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.179.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.253.50
description:
Feb  4 09:30:06 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.253.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.95.195.152
description:
[2025-02-04 09:31:40 +0100] info [webmaild] 177.95.195.152 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-31.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.250.128.5
description:
Feb  4 09:31:34 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.250.128.5 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.53.222
description:
[2025-02-04 09:31:27 +0100] info [whostmgrd] 104.207.53.222 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.211.97.51
description:
Feb  4 09:31:28 ait sshd[4019032]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.211.97.51


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.39.128
description:
2025-02-04 09:31:31 dovecot_plain authenticator failed for ([158.140.39.128]) [158.140.39.128]:57421: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.97.139.38
description:
2025-02-04 09:31:47 dovecot_plain authenticator failed for ([59.97.139.38]) [59.97.139.38]:55049: 535 Incorrect authentication data (set_id=ads20b00294y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 09:32:03 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.19.123.54
description:
[2025-02-04 09:31:09 +0100] info [webmaild] 186.19.123.54 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.97.51
description:
Feb  4 09:31:28 ait sshd[4019032]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.211.97.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.39.128
description:
Feb  4 09:31:29 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.39.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.128.5
description:
2025-02-04 09:31:36 dovecot_plain authenticator failed for ([170.250.128.5]) [170.250.128.5]:50802: 535 Incorrect authentication data (set_id=ads20b00294y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.97.139.38
description:
Feb  4 09:31:45 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.97.139.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.179.161
description:
2025-02-04 09:31:07 dovecot_plain authenticator failed for (161-179-53-194.mairnet.net) [194.53.179.161]:42851: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 172.111.181.249
description:
[2025-02-04 09:32:19 +0100] info [cpaneld] 172.111.181.249 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.178.29.37
description:
[2025-02-04 09:32:21 +0100] info [webmaild] 179.178.29.37 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.230.57.227
description:
[2025-02-04 09:32:55 +0100] info [webmaild] 45.230.57.227 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.79.15.118
description:
Feb  4 09:33:15 ait sshd[4019649]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.79.15.118 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.79.15.118
description:
Feb  4 09:33:15 ait sshd[4019649]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.79.15.118


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.159.242
description:
[2025-02-04 09:33:40 +0100] info [webmaild] 170.239.159.242 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 41.216.188.18
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:superadmin||WPU:superadmin||RSV:6.65||T:APACHE||MV:09-34.41.216.188.18


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.212.81.98
description:
[2025-02-04 09:34:59 +0100] info [webmaild] 177.212.81.98 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.5.38.61
description:
[2025-02-04 09:34:11 +0100] info [webmaild] 190.5.38.61 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.83
description:
2025-02-04 09:35:48 dovecot_plain authenticator failed for (m121-202-154-83.smartone.com) [121.202.154.83]:29528: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.52.110
description:
47.128.52.110 - - [04/Feb/2025:09:36:00 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15053246 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/6a1447?panel=swiftmailer" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.52.110


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.36.42
description:
Feb  4 09:36:03 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.36.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
description:
2025-02-04 09:36:05 dovecot_plain authenticator failed for 042.36.246.220.static.netvigator.com [220.246.36.42]:55894: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.167.35.29
description:
Feb  4 09:35:19 ait sshd[4020515]: pam_imunify(sshd:auth): [IM360_RBL] The IP 72.167.35.29 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.75.169.255
description:
[2025-02-04 09:35:33 +0100] info [webmaild] 201.75.169.255 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 72.167.35.29
description:
Feb  4 09:35:19 ait sshd[4020515]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=72.167.35.29


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.83
description:
Feb  4 09:35:46 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.24.37.27
description:
Feb  4 09:35:52 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.24.37.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
description:
Feb  4 09:35:27 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
description:
2025-02-04 09:35:29 dovecot_plain authenticator failed for ([121.202.155.10]) [121.202.155.10]:23640: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.24.37.27
description:
2025-02-04 09:35:54 dovecot_plain authenticator failed for (192-24-37-27.nftctelecom.com) [192.24.37.27]:32821: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
description:
Feb  4 09:37:14 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.79
description:
Feb  4 09:37:14 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.35.63.27
description:
Feb  4 09:37:20 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.35.63.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.241.150
description:
2025-02-04 09:37:26 dovecot_plain authenticator failed for ([61.143.241.150]) [61.143.241.150]:58374: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.192.168
description:
2025-02-04 09:37:07 dovecot_plain authenticator failed for ([220.80.192.168]) [220.80.192.168]:56702: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.119.2
description:
2025-02-04 09:37:11 dovecot_plain authenticator failed for ([180.168.119.2]) [180.168.119.2]:32892: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-02-04 09:38:00 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (sheary) [91.56.31.167]:62139: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Feb  4 09:37:58 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
description:
2025-02-04 09:37:16 dovecot_plain authenticator failed for ([218.149.235.152]) [218.149.235.152]:43910: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.142.242
description:
Feb  4 09:37:18 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.142.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.142.197
description:
2025-02-04 09:37:28 dovecot_plain authenticator failed for ([120.236.142.197]) [120.236.142.197]:46021: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.45.37.20
description:
2025-02-04 09:37:29 dovecot_plain authenticator failed for (kholy) [41.45.37.20]:54597: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 138.68.99.33
description:
Feb  4 09:37:33 ait sshd[4021424]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.99.33


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.55.5.34
description:
[2025-02-04 09:37:37 +0100] info [webmaild] 187.55.5.34 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.241.161
description:
2025-02-04 09:37:08 dovecot_plain authenticator failed for ([115.23.241.161]) [115.23.241.161]:53880: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.137.56.216
description:
2025-02-04 09:37:16 dovecot_plain authenticator failed for ([185.137.56.216]) [185.137.56.216]:34696: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.241.150
description:
Feb  4 09:37:24 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.241.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 09:37:34 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.126.247
description:
Feb  4 09:37:09 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.126.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.245.95.11
description:
2025-02-04 09:37:07 dovecot_plain authenticator failed for ([210.245.95.11]) [210.245.95.11]:35824: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-02-04 09:37:11 dovecot_plain authenticator failed for (189-56-79-105.customer.tdatabrasil.net.br) [186.200.249.162]:49735: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
description:
Feb  4 09:37:17 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
description:
2025-02-04 09:37:17 dovecot_plain authenticator failed for ([203.172.213.166]) [203.172.213.166]:44663: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.15.222.74
description:
2025-02-04 09:37:22 dovecot_plain authenticator failed for ([58.63.214.213]) [218.15.222.74]:28939: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.142.197
description:
Feb  4 09:37:26 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.142.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.119.2
description:
Feb  4 09:37:09 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.119.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.118.162.194
description:
Feb  4 09:37:14 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.118.162.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.203.210.119
description:
Feb  4 09:37:21 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.203.210.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.29.109.174
description:
2025-02-04 09:37:21 dovecot_plain authenticator failed for ([112.29.109.174]) [112.29.109.174]:60904: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.124.66
description:
2025-02-04 09:37:11 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:51925: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.172.213.166
description:
Feb  4 09:37:15 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.172.213.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.79
description:
2025-02-04 09:37:26 dovecot_plain authenticator failed for (m121-202-155-79.smartone.com) [121.202.155.79]:58270: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.126.247
description:
2025-02-04 09:37:11 dovecot_plain authenticator failed for ([112.172.126.247]) [112.172.126.247]:36458: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.165.83
description:
2025-02-04 09:37:15 dovecot_plain authenticator failed for ([65.20.165.83]) [65.20.165.83]:55601: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.203.210.119
description:
2025-02-04 09:37:23 dovecot_plain authenticator failed for ([103.203.210.119]) [103.203.210.119]:35641: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.79
description:
Feb  4 09:37:24 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.165.83
description:
Feb  4 09:37:13 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.165.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.68.99.33
description:
Feb  4 09:37:33 ait sshd[4021424]: pam_imunify(sshd:auth): [IM360_RBL] The IP 138.68.99.33 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.79.15.118
description:
Feb  4 09:37:51 ait sshd[4021462]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.79.15.118


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
description:
2025-02-04 09:37:16 dovecot_plain authenticator failed for ([154.118.162.194]) [154.118.162.194]:53678: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
description:
2025-02-04 09:37:19 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:30262: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.45.37.20
description:
Feb  4 09:37:27 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.45.37.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.137.56.216
description:
Feb  4 09:37:14 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.137.56.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.79
description:
2025-02-04 09:37:16 dovecot_plain authenticator failed for 079.42.246.220.static.netvigator.com [220.246.42.79]:53840: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.142.242
description:
2025-02-04 09:37:20 dovecot_plain authenticator failed for 242.142.48.116.static.netvigator.com [116.48.142.242]:40658: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.15.222.74
description:
Feb  4 09:37:20 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.15.222.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Feb  4 09:37:09 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.69.243.130
description:
Feb  4 09:37:09 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.69.243.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.29.109.174
description:
Feb  4 09:37:19 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.29.109.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 09:37:19 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.79.15.118
description:
Feb  4 09:37:51 ait sshd[4021462]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.79.15.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.35.63.27
description:
2025-02-04 09:37:22 dovecot_plain authenticator failed for ([110.35.63.27]) [110.35.63.27]:42270: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.124.66
description:
Feb  4 09:37:09 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.124.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.69.243.130
description:
2025-02-04 09:37:11 dovecot_plain authenticator failed for ([39.69.243.130]) [39.69.243.130]:40456: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.225.46.166
description:
[2025-02-04 09:38:12 +0100] info [webmaild] 45.225.46.166 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 119.160.215.3
description:
[2025-02-04 09:38:53 +0100] info [webmaild] 119.160.215.3 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.124.227.123
description:
[2025-02-04 09:39:28 +0100] info [webmaild] 103.124.227.123 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.79.15.118
description:
Feb  4 09:39:30 ait sshd[4022058]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.79.15.118


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.79.15.118
description:
Feb  4 09:39:32 ait sshd[4022058]: Failed password for invalid user testUser from 182.79.15.118 port 60106 ssh2


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.41.190
description:
47.128.41.190 - - [04/Feb/2025:09:40:01 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=5694142 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/c8b11c?panel=router" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.41.190


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.98.125
description:
Feb  4 09:39:26 ait sshd[4022043]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.98.125


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.79.15.118
description:
Feb  4 09:39:30 ait sshd[4022058]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.79.15.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.48.98.125
description:
Feb  4 09:39:26 ait sshd[4022043]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.48.98.125 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.24.126.25
description:
[2025-02-04 09:40:21 +0100] info [webmaild] 213.24.126.25 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  4 09:40:33 ait sshd[4022855]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  4 09:40:33 ait sshd[4022855]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.197.151.254
description:
[2025-02-04 09:40:58 +0100] info [webmaild] 168.197.151.254 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 09:41:00 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.57.154.146
description:
Feb  4 09:41:43 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.57.154.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.57.154.146
description:
2025-02-04 09:41:45 dovecot_plain authenticator failed for ([58.57.154.146]) [58.57.154.146]:41972: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.178.158.132
description:
Feb  4 09:41:53 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.178.158.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.178.158.132
description:
2025-02-04 09:41:55 dovecot_plain authenticator failed for ([103.178.158.133]) [103.178.158.132]:38094: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.68.119
description:
[2025-02-04 09:41:37 +0100] info [webmaild] 170.239.68.119 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.208.58.87
description:
[2025-02-04 09:43:01 +0100] info [webmaild] 154.208.58.87 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.70.63.206
description:
[2025-02-04 09:42:10 +0100] info [webmaild] 188.70.63.206 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.238.6.168
description:
[2025-02-04 09:43:35 +0100] info [webmaild] 45.238.6.168 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.53.8.225
description:
[2025-02-04 09:44:19 +0100] info [webmaild] 177.53.8.225 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 193.163.92.180
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads1700155y@ait.edu.gh||WPU:ads1700155y@ait.edu.gh||RSV:6.65||T:APACHE||MV:09-44.193.163.92.180


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.176.79.110
description:
[2025-02-04 09:44:50 +0100] info [webmaild] 160.176.79.110 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.250
description:
2025-02-04 09:45:06 dovecot_plain authenticator failed for ([27.40.100.250]) [27.40.100.250]:49697: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.104.245
description:
2025-02-04 09:45:42 dovecot_plain authenticator failed for ([179.125.104.245]) [179.125.104.245]:44639: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.187.191.77
description:
[2025-02-04 09:45:43 +0100] info [webmaild] 45.187.191.77 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.233
description:
Feb  4 09:45:14 ait auth[4024192]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.233
description:
2025-02-04 09:45:16 dovecot_plain authenticator failed for (nsg-corporate-233.227.187.122.airtel.in) [122.187.227.233]:59277: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.104.245
description:
Feb  4 09:45:40 ait auth[4024192]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.104.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Feb  4 09:46:36 ait auth[4024192]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-02-04 09:46:38 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-177.static.tpgi.com.au) [110.175.220.250]:44051: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.30.104
description:
Feb  4 09:46:47 ait auth[4024192]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.30.104 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.25.39.83
description:
[2025-02-04 09:46:18 +0100] info [webmaild] 78.25.39.83 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.30.104
description:
2025-02-04 09:46:49 dovecot_plain authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:55622: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.251.194.208
description:
[2025-02-04 09:46:58 +0100] info [webmaild] 46.251.194.208 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.68.50
description:
Feb  4 09:47:25 ait auth[4024192]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.68.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.114.171
description:
[2025-02-04 09:47:50 +0100] info [cpaneld] 156.228.114.171 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awadzie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.91.239
description:
[2025-02-04 09:47:51 +0100] info [cpaneld] 156.228.91.239 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-47.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.124.119.7
description:
2025-02-04 09:47:57 dovecot_plain authenticator failed for ([118.122.255.5]) [118.124.119.7]:14763: 535 Incorrect authentication data (set_id=paakow2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.34.174.90
description:
2025-02-04 09:47:41 dovecot_plain authenticator failed for (90.174.34.58.broad.xw.sh.dynamic.163data.com.cn) [58.34.174.90]:35466: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
description:
2025-02-04 09:47:49 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (difile) [94.45.76.149]:54128: 535 Incorrect authentication data (set_id=freeman@jaster.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.82.182
description:
[2025-02-04 09:47:52 +0100] info [cpaneld] 156.228.82.182 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awadzie (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.187.213.29
description:
Feb  4 09:47:28 ait auth[4024192]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.187.213.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
description:
2025-02-04 09:47:30 dovecot_plain authenticator failed for (made-again.tmesis.com) [24.187.213.29]:46194: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.128.178.199
description:
[2025-02-04 09:47:31 +0100] info [webmaild] 177.128.178.199 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.34.174.90
description:
Feb  4 09:47:39 ait auth[4024192]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.34.174.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.210.250
description:
Feb  4 09:47:38 ait auth[4024192]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.210.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.210.250
description:
2025-02-04 09:47:40 dovecot_plain authenticator failed for ([187.12.210.250]) [187.12.210.250]:47103: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.57.52
description:
[2025-02-04 09:47:51 +0100] info [cpaneld] 104.207.57.52 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awadzie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.37.68
description:
[2025-02-04 09:47:52 +0100] info [whostmgrd] 104.207.37.68 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.125.173
description:
[2025-02-04 09:47:59 +0100] info [whostmgrd] 156.228.125.173 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.68.50
description:
2025-02-04 09:47:27 dovecot_plain authenticator failed for ([61.185.68.50]) [61.185.68.50]:41098: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Feb  4 09:47:47 ait auth[4024192]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.56.171
description:
[2025-02-04 09:47:50 +0100] info [cpaneld] 104.207.56.171 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.124.119.7
description:
Feb  4 09:47:55 ait auth[4024192]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.124.119.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.54.11
description:
[2025-02-04 09:48:02 +0100] info [whostmgrd] 104.207.54.11 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.111.118
description:
[2025-02-04 09:48:03 +0100] info [whostmgrd] 156.228.111.118 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.79.183
description:
[2025-02-04 09:48:09 +0100] info [whostmgrd] 156.228.79.183 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.105.97
description:
[2025-02-04 09:48:12 +0100] info [cpaneld] 156.228.105.97 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.48.197
description:
[2025-02-04 09:48:15 +0100] info [whostmgrd] 104.207.48.197 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.61.85
description:
[2025-02-04 09:48:16 +0100] info [whostmgrd] 104.207.61.85 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.56.180
description:
[2025-02-04 09:48:13 +0100] info [cpaneld] 104.207.56.180 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awadzie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.60.12
description:
[2025-02-04 09:48:14 +0100] info [cpaneld] 104.207.60.12 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awadzie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.48.252
description:
[2025-02-04 09:48:14 +0100] info [whostmgrd] 104.207.48.252 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.34.96
description:
[2025-02-04 09:48:15 +0100] info [whostmgrd] 104.207.34.96 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.38.56
description:
[2025-02-04 09:48:15 +0100] info [whostmgrd] 104.207.38.56 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.139.189
description:
2025-02-04 09:48:16 dovecot_plain authenticator failed for ([180.188.139.189]) [180.188.139.189]:37204: 535 Incorrect authentication data (set_id=paakow2)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.124.15
description:
[2025-02-04 09:48:18 +0100] info [whostmgrd] 156.228.124.15 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.83.8.2
description:
[2025-02-04 09:49:06 +0100] info [webmaild] 190.83.8.2 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.44.30
description:
[2025-02-04 09:48:13 +0100] info [cpaneld] 104.207.44.30 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.47.85
description:
[2025-02-04 09:48:16 +0100] info [whostmgrd] 104.207.47.85 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 120.89.64.41
description:
[2025-02-04 09:48:31 +0100] info [webmaild] 120.89.64.41 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.78.3
description:
[2025-02-04 09:48:11 +0100] info [cpaneld] 156.228.78.3 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awadzie (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.188.139.189
description:
Feb  4 09:48:14 ait auth[4024192]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.188.139.189 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.190.65.33
description:
[2025-02-04 09:49:46 +0100] info [webmaild] 177.190.65.33 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.156.14
description:
2025-02-04 09:50:30 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.156.14]:41087: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
description:
2025-02-04 09:50:30 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:50270: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.223.203
description:
Feb  4 09:51:04 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.223.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.23.95.14
description:
2025-02-04 09:50:48 dovecot_plain authenticator failed for ([218.23.95.14]) [218.23.95.14]:50691: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.223.203
description:
2025-02-04 09:51:06 dovecot_plain authenticator failed for ([210.99.223.203]) [210.99.223.203]:40254: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.253.148.40
description:
[2025-02-04 09:50:17 +0100] info [webmaild] 38.253.148.40 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.156.14
description:
Feb  4 09:50:28 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.156.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
description:
Feb  4 09:50:28 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 51.89.54.10
description:
[2025-02-04 09:51:00 +0100] info [cpaneld] 51.89.54.10 - ads20b00337y "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20b00337y (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.89.54.10
description:
2025-02-04 09:51:05 dovecot_plain authenticator failed for ip10.ip-51-89-54.eu [51.89.54.10]:65305: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.86.167.42
description:
Feb  4 09:50:12 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.86.167.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.86.167.42
description:
2025-02-04 09:50:14 dovecot_plain authenticator failed for ppp-210-86-167-42.revip.asianet.co.th [210.86.167.42]:58777: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.23.95.14
description:
Feb  4 09:50:46 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.23.95.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.45.37.20
description:
2025-02-04 09:51:49 dovecot_plain authenticator failed for (isess) [41.45.37.20]:38599: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.89.54.10
description:
2025-02-04 09:51:11 dovecot_login authenticator failed for ip10.ip-51-89-54.eu [51.89.54.10]:65305: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.45.37.20
description:
Feb  4 09:51:47 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.45.37.20 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.89.54.10
description:
Feb  4 09:51:13 ait sshd[4027234]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.89.54.10


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
description:
2025-02-04 09:51:18 dovecot_plain authenticator failed for (187-8-163-70.customer.tdatabrasil.net.br) [187.8.163.70]:49813: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.195
description:
Feb  4 09:51:25 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.16.195
description:
2025-02-04 09:51:27 dovecot_plain authenticator failed for ([27.71.16.195]) [27.71.16.195]:63494: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 114.130.122.22
description:
[2025-02-04 09:51:46 +0100] info [webmaild] 114.130.122.22 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.223.92.169
description:
[2025-02-04 09:51:09 +0100] info [webmaild] 179.223.92.169 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.97
description:
Feb  4 09:51:35 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
description:
Feb  4 09:51:16 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
description:
2025-02-04 09:51:37 dovecot_plain authenticator failed for ([65.20.191.97]) [65.20.191.97]:59792: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.16.135
description:
2025-02-04 09:52:46 dovecot_plain authenticator failed for ([5.31.16.135]) [5.31.16.135]:33029: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.195.179
description:
Feb  4 09:52:24 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.195.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.16.135
description:
Feb  4 09:52:44 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.16.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.73.121.209
description:
Feb  4 09:53:04 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.73.121.209 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.38.115.229
description:
[2025-02-04 09:52:22 +0100] info [webmaild] 102.38.115.229 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.195.179
description:
2025-02-04 09:52:26 dovecot_plain authenticator failed for ([183.109.195.179]) [183.109.195.179]:33850: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.250.93.159
description:
Feb  4 09:52:53 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.250.93.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.250.93.159
description:
2025-02-04 09:52:55 dovecot_plain authenticator failed for ([114.250.93.159]) [114.250.93.159]:50581: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.2.36.112
description:
[2025-02-04 09:52:56 +0100] info [webmaild] 181.2.36.112 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.151.51.223
description:
Feb  4 09:53:04 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.151.51.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
description:
2025-02-04 09:53:06 dovecot_plain authenticator failed for (diersedly) [62.73.121.209]:60057: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  4 09:53:39 ait sshd[4028357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.78.232.173
description:
[2025-02-04 09:53:44 +0100] info [webmaild] 185.78.232.173 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.151.51.223
description:
2025-02-04 09:53:06 dovecot_plain authenticator failed for customer-ip-193-151-51-223.ipv.net.pl [193.151.51.223]:60494: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  4 09:53:39 ait sshd[4028357]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.126.195.176
description:
Feb  4 09:54:17 ait sshd[4028553]: Invalid user universitypublishing from 175.126.195.176 port 47736


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Feb  4 09:54:18 ait sshd[4028553]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
description:
2025-02-04 09:55:03 dovecot_plain authenticator failed for ([211.106.126.27]) [211.106.126.27]:60031: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.170.0.201
description:
[2025-02-04 09:54:21 +0100] info [webmaild] 45.170.0.201 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.106.126.27
description:
Feb  4 09:55:01 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.106.126.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.139.185.210
description:
[2025-02-04 09:55:02 +0100] info [webmaild] 37.139.185.210 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 09:55:03 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.221.59
description:
Feb  4 09:55:12 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.221.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.71.101
description:
2025-02-04 09:55:25 dovecot_plain authenticator failed for ([82.208.71.101]) [82.208.71.101]:60102: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Feb  4 09:55:26 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.23.142.222
description:
[2025-02-04 09:55:34 +0100] info [webmaild] 187.23.142.222 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.32.250.174
description:
Feb  4 09:55:38 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.32.250.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.188.241.57
description:
Feb  4 09:55:40 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.188.241.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.221.59
description:
2025-02-04 09:55:14 dovecot_plain authenticator failed for (abts-north-static-059.221.160.122.airtelbroadband.in) [122.160.221.59]:37840: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.204.52.137
description:
2025-02-04 09:55:15 dovecot_plain authenticator failed for ([88.204.52.137]) [88.204.52.137]:57466: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.208.71.101
description:
Feb  4 09:55:23 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.208.71.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.32.250.174
description:
2025-02-04 09:55:40 dovecot_plain authenticator failed for ([117.32.250.174]) [117.32.250.174]:44626: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.188.241.57
description:
2025-02-04 09:55:42 dovecot_plain authenticator failed for ([121.188.241.57]) [121.188.241.57]:49354: 535 Incorrect authentication data (set_id=ads19b00188y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.66.153.194
description:
2025-02-04 09:55:51 dovecot_plain authenticator failed for ([95.66.153.194]) [95.66.153.194]:40881: 535 Incorrect authentication data (set_id=ads19b00188y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.204.52.137
description:
Feb  4 09:55:13 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.204.52.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.212.190.170
description:
Feb  4 09:55:20 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.212.190.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.212.190.170
description:
2025-02-04 09:55:22 dovecot_plain authenticator failed for (176x212x190x170.dynamic.ryazan.ertelecom.ru) [176.212.190.170]:51636: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-02-04 09:55:28 dovecot_plain authenticator failed for ([186.200.8.115]) [186.200.249.162]:33561: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.191.129
description:
Feb  4 09:55:45 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.191.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.191.129
description:
2025-02-04 09:55:47 dovecot_plain authenticator failed for ([5.30.191.129]) [5.30.191.129]:46281: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.66.153.194
description:
Feb  4 09:55:49 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.66.153.194 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.44.157
description:
47.128.44.157 - - [04/Feb/2025:09:56:00 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17178606 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/d57f03?panel=logger" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.44.157


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.43.208.99
description:
[2025-02-04 09:56:23 +0100] info [webmaild] 186.43.208.99 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
description:
2025-02-04 09:56:27 dovecot_plain authenticator failed for ([122.187.230.154]) [122.187.230.154]:56325: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.234.165.73
description:
Feb  4 09:56:40 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.234.165.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.234.165.73
description:
2025-02-04 09:56:42 dovecot_plain authenticator failed for ([58.234.165.73]) [58.234.165.73]:43280: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.253.125.205
description:
Feb  4 09:56:51 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.253.125.205 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.242.177.193
description:
[2025-02-04 09:57:01 +0100] info [webmaild] 191.242.177.193 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.154
description:
Feb  4 09:56:25 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.253.125.205
description:
2025-02-04 09:56:53 dovecot_plain authenticator failed for ([183.253.125.205]) [183.253.125.205]:53679: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.6.56.226
description:
Feb  4 09:56:55 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.6.56.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.56.226
description:
2025-02-04 09:56:57 dovecot_plain authenticator failed for ([187.6.56.226]) [187.6.56.226]:43983: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.111.161.132
description:
[2025-02-04 09:57:52 +0100] info [webmaild] 187.111.161.132 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.237
description:
Feb  4 09:58:01 ait sshd[4030277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.237  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.11.78
description:
2025-02-04 09:57:15 dovecot_plain authenticator failed for 111-70-11-78.emome-ip.hinet.net [111.70.11.78]:38614: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.188.204.213
description:
Feb  4 09:57:17 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.188.204.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
description:
2025-02-04 09:57:19 dovecot_plain authenticator failed for ([50.188.204.213]) [50.188.204.213]:46749: 535 Incorrect authentication data (set_id=eng20b00167y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 09:57:50 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.24.210.27
description:
Feb  4 09:57:11 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.24.210.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.24.210.27
description:
2025-02-04 09:57:13 dovecot_plain authenticator failed for ([1.24.210.27]) [1.24.210.27]:47686: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.11.78
description:
Feb  4 09:57:13 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.11.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.103.248.120
description:
2025-02-04 09:58:41 dovecot_plain authenticator failed for ([91.103.248.120]) [91.103.248.120]:48495: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.124.54.6
description:
2025-02-04 09:58:17 dovecot_plain authenticator failed for ([179.124.54.6]) [179.124.54.6]:55619: 535 Incorrect authentication data (set_id=eng19a00097y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.37.80.86
description:
[2025-02-04 09:58:24 +0100] info [webmaild] 189.37.80.86 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.139.35.161
description:
2025-02-04 09:58:31 dovecot_plain authenticator failed for 161.sm-u1.dialup.garlic.net [216.139.35.161]:38286: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.237
description:
Feb  4 09:58:15 ait sshd[4030333]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.237  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.124.54.6
description:
Feb  4 09:58:15 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.124.54.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.224.55.22
description:
2025-02-04 09:58:38 dovecot_plain authenticator failed for ([58.224.55.22]) [58.224.55.22]:36694: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.224.55.22
description:
Feb  4 09:58:36 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.224.55.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.103.248.120
description:
Feb  4 09:58:39 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.103.248.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.139.35.161
description:
Feb  4 09:58:29 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.139.35.161 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  4 09:58:29 ait sshd[4030529]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.99.88.7
description:
[2025-02-04 09:59:50 +0100] info [webmaild] 179.99.88.7 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 81.213.179.120
description:
[2025-02-04 09:59:08 +0100] info [webmaild] 81.213.179.120 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 10:00:20 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.108.88.121
description:
2025-02-04 10:00:38 dovecot_plain authenticator failed for ([113.108.88.121]) [113.108.88.121]:42456: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.90.7
description:
[2025-02-04 10:00:44 +0100] info [cpaneld] 156.228.90.7 - abs4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs4 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.224.221
description:
2025-02-04 10:01:03 dovecot_plain authenticator failed for ([103.57.224.221]) [103.57.224.221]:33322: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.122.31.214
description:
2025-02-04 10:00:22 dovecot_plain authenticator failed for ([91.122.31.214]) [91.122.31.214]:43190: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.185.212.53
description:
[2025-02-04 10:00:33 +0100] info [webmaild] 138.185.212.53 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.114.207
description:
[2025-02-04 10:00:42 +0100] info [cpaneld] 156.228.114.207 - abs4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs4 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.45.43
description:
[2025-02-04 10:00:43 +0100] info [cpaneld] 104.207.45.43 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.89.164
description:
[2025-02-04 10:00:49 +0100] info [whostmgrd] 156.228.89.164 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.54.241
description:
[2025-02-04 10:00:52 +0100] info [whostmgrd] 104.207.54.241 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.116.141
description:
[2025-02-04 10:00:52 +0100] info [whostmgrd] 156.228.116.141 - abs4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.224.221
description:
Feb  4 10:01:01 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.224.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.122.31.214
description:
Feb  4 10:00:20 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.122.31.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.108.88.121
description:
Feb  4 10:00:36 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.108.88.121 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.103.85
description:
[2025-02-04 10:00:43 +0100] info [cpaneld] 156.228.103.85 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.111.32
description:
[2025-02-04 10:00:50 +0100] info [whostmgrd] 156.228.111.32 - abs4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.81.195
description:
[2025-02-04 10:00:51 +0100] info [whostmgrd] 156.228.81.195 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.105.83
description:
[2025-02-04 10:00:53 +0100] info [whostmgrd] 156.228.105.83 - abs4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.253.178
description:
Feb  4 10:01:12 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.253.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
description:
2025-02-04 10:01:38 dovecot_plain authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.50.150]:43446: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.234.65.55
description:
Feb  4 10:01:53 ait sshd[4032102]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.234.65.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.178
description:
2025-02-04 10:01:14 dovecot_plain authenticator failed for ([116.113.253.178]) [116.113.253.178]:54433: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.48.39.18
description:
Feb  4 10:01:17 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.48.39.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.48.39.18
description:
2025-02-04 10:01:19 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:60692: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.207.92.19
description:
[2025-02-04 10:01:08 +0100] info [webmaild] 94.207.92.19 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.50.150
description:
Feb  4 10:01:36 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.50.150 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 90.156.161.34
description:
[2025-02-04 10:01:44 +0100] info [webmaild] 90.156.161.34 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.234.65.55
description:
Feb  4 10:01:53 ait sshd[4032102]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.234.65.55  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.218.168.192
description:
Feb  4 10:02:49 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.218.168.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.168.192
description:
2025-02-04 10:02:51 dovecot_plain authenticator failed for (189.218.168.192-clientes-izzi.mx) [189.218.168.192]:40482: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.122
description:
2025-02-04 10:03:02 dovecot_plain authenticator failed for ([103.79.175.122]) [103.79.175.122]:60872: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.192.93.129
description:
[2025-02-04 10:02:22 +0100] info [webmaild] 181.192.93.129 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.122
description:
Feb  4 10:03:00 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.122 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.117.98.135
description:
[2025-02-04 10:03:51 +0100] info [webmaild] 196.117.98.135 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:10-03.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.153.143
description:
Feb  4 10:03:17 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.153.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
description:
2025-02-04 10:03:19 dovecot_plain authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:52790: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.0.234.138
description:
[2025-02-04 10:03:20 +0100] info [webmaild] 138.0.234.138 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.25.103
description:
47.128.25.103 - - [04/Feb/2025:10:04:36 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12501048 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/8/?duration=short%2CextraLong&filtering=1&level=intermediate%2Cbeginner" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.25.103


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.73.241
description:
[2025-02-04 10:04:42 +0100] info [webmaild] 84.54.73.241 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.87.7
description:
Feb  4 10:04:50 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.87.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
description:
2025-02-04 10:04:52 dovecot_plain authenticator failed for 177-72-87-7.static.as262543.net.br (7.lifedns.com.br) [177.72.87.7]:58578: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.222.233.59
description:
[2025-02-04 10:05:16 +0100] info [webmaild] 179.222.233.59 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.240
description:
2025-02-04 10:05:21 dovecot_plain authenticator failed for ([121.202.155.240]) [121.202.155.240]:27158: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-02-04 10:05:31 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:37822: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.233.93.66
description:
Feb  4 10:05:08 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.233.93.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.122.31.214
description:
2025-02-04 10:05:15 dovecot_plain authenticator failed for ([91.122.31.214]) [91.122.31.214]:55074: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Feb  4 10:05:29 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Feb  4 10:06:05 ait sshd[4034071]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.93.66
description:
2025-02-04 10:05:10 dovecot_plain authenticator failed for ([181.233.93.3]) [181.233.93.66]:58098: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.122.31.214
description:
Feb  4 10:05:13 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.122.31.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.240
description:
Feb  4 10:05:19 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.225.185.148
description:
2025-02-04 10:06:22 dovecot_login authenticator failed for ([124.225.185.148]) [124.225.185.148]:56676: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.5.32.42
description:
[2025-02-04 10:06:45 +0100] info [webmaild] 191.5.32.42 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.125
domain: www.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:kwekuklem@gmail.com||WPU:kwekuklem@gmail.com||RSV:6.65||T:APACHE||MV:10-07.170.205.31.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.7.86.144
description:
2025-02-04 10:06:46 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [123.7.86.144]:48432: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.7.86.144
description:
Feb  4 10:06:44 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.7.86.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.184.50.185
description:
Feb  4 10:06:55 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.184.50.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.225.185.148
description:
Feb  4 10:06:20 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.225.185.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.165.36.99
description:
Feb  4 10:06:29 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.165.36.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.165.36.99
description:
2025-02-04 10:06:31 dovecot_plain authenticator failed for ([121.165.36.99]) [121.165.36.99]:54337: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.164.147.150
description:
Feb  4 10:06:37 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.164.147.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.50.185
description:
2025-02-04 10:06:57 dovecot_login authenticator failed for ([112.184.50.185]) [112.184.50.185]:36876: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.0.33.85
description:
[2025-02-04 10:06:14 +0100] info [webmaild] 170.0.33.85 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.164.147.150
description:
2025-02-04 10:06:39 dovecot_plain authenticator failed for ([181.164.147.150]) [181.164.147.150]:61913: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.156.254
description:
Feb  4 10:06:49 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.156.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.156.254
description:
2025-02-04 10:06:51 dovecot_plain authenticator failed for mail.toptronicsinc.com [218.4.156.254]:56810: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 119.160.179.231
description:
[2025-02-04 10:07:36 +0100] info [webmaild] 119.160.179.231 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.192.82.243
description:
[2025-02-04 10:08:10 +0100] info [webmaild] 181.192.82.243 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.188.227.56
description:
[2025-02-04 10:08:46 +0100] info [webmaild] 187.188.227.56 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.108.186.10
description:
Feb  4 10:09:31 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.108.186.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.174.248
description:
Feb  4 10:09:44 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.174.248 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.8.53.252
description:
[2025-02-04 10:09:17 +0100] info [webmaild] 177.8.53.252 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.177.106
description:
Feb  4 10:09:34 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.177.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
description:
2025-02-04 10:09:44 dovecot_plain authenticator failed for ([41.224.62.206]) [41.224.62.206]:55749: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.65.203.82
description:
Feb  4 10:09:54 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.65.203.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.65.203.82
description:
2025-02-04 10:09:56 dovecot_plain authenticator failed for ([63.65.203.82]) [63.65.203.82]:38025: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.177.106
description:
2025-02-04 10:09:36 dovecot_plain authenticator failed for ([196.250.177.106]) [196.250.177.106]:58954: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.224.62.206
description:
Feb  4 10:09:42 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.224.62.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.174.248
description:
2025-02-04 10:09:46 dovecot_plain authenticator failed for broadband-77-37-174-248.ip.moscow.rt.ru [77.37.174.248]:49288: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.108.186.10
description:
2025-02-04 10:09:33 dovecot_plain authenticator failed for (videoifolder.ru) [78.108.186.10]:37930: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.233.25.176
description:
[2025-02-04 10:10:42 +0100] info [webmaild] 45.233.25.176 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.0.199.165
description:
Feb  4 10:10:06 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.0.199.165 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.176.241.53
description:
[2025-02-04 10:10:07 +0100] info [webmaild] 160.176.241.53 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.199.165
description:
2025-02-04 10:10:08 dovecot_plain authenticator failed for 14-0-199-165.static.pccw-hkt.com [14.0.199.165]:32640: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.57.4
description:
2025-02-04 10:11:56 dovecot_plain authenticator failed for ([219.159.57.4]) [219.159.57.4]:46596: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.178.158
description:
2025-02-04 10:11:56 dovecot_plain authenticator failed for (200-168-190-25.customer.tdatabrasil.net.br) [189.56.178.158]:52150: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.202.154.245
description:
Feb  4 10:12:05 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.202.154.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.204.158.2
description:
2025-02-04 10:11:41 dovecot_plain authenticator failed for 2.189-204-158.bestelclientes.com.mx [189.204.158.2]:39337: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.178.158
description:
Feb  4 10:11:54 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.178.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.159.57.4
description:
Feb  4 10:11:54 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.159.57.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
description:
2025-02-04 10:11:40 dovecot_plain authenticator failed for ([94.131.211.168]) [94.131.211.168]:53806: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.144
description:
Feb  4 10:11:53 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.144
description:
2025-02-04 10:11:55 dovecot_plain authenticator failed for (nsg-corporate-144.230.187.122.airtel.in) [122.187.230.144]:40179: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.229.1.186
description:
Feb  4 10:11:30 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.229.1.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
description:
2025-02-04 10:11:32 dovecot_plain authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:49348: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.131.211.168
description:
Feb  4 10:11:38 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.131.211.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.204.158.2
description:
Feb  4 10:11:39 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.204.158.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.108.193.54
description:
[2025-02-04 10:11:41 +0100] info [webmaild] 85.108.193.54 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.72.4.98
description:
Feb  4 10:12:06 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.72.4.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.92.192.154
description:
2025-02-04 10:12:28 dovecot_plain authenticator failed for (200-153-56-145.sgsnet.com.br) [187.92.192.154]:37929: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.60.74.213
description:
[2025-02-04 10:12:12 +0100] info [webmaild] 179.60.74.213 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.255.112.6
description:
Feb  4 10:12:17 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.255.112.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.170.28
description:
2025-02-04 10:12:37 dovecot_plain authenticator failed for ([103.207.170.28]) [103.207.170.28]:35904: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.24.93
description:
2025-02-04 10:12:51 dovecot_plain authenticator failed for ([218.149.24.93]) [218.149.24.93]:45024: 535 Incorrect authentication data (set_id=jessica1234@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.103.235.223
description:
2025-02-04 10:12:11 dovecot_plain authenticator failed for ([222.103.235.223]) [222.103.235.223]:58398: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.151.148
description:
Feb  4 10:12:32 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.151.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.72.4.98
description:
2025-02-04 10:12:08 dovecot_plain authenticator failed for ([112.72.4.98]) [112.72.4.98]:15492: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.230
description:
Feb  4 10:12:13 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.230 has been locked due to Imunify RBL


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 102.22.15.203
domain: helpdesk.ait-ext.com
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/admin/admin_main.php||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.191.129
description:
Feb  4 10:12:59 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.191.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.202.154.245
description:
2025-02-04 10:12:07 dovecot_plain authenticator failed for ([94.202.154.245]) [94.202.154.245]:52637: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.230
description:
2025-02-04 10:12:15 dovecot_plain authenticator failed for (nsg-corporate-230.228.187.122.airtel.in) [122.187.228.230]:34725: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.28.26.250
description:
Feb  4 10:12:23 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.28.26.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.170.28
description:
Feb  4 10:12:35 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.170.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.24.93
description:
Feb  4 10:12:49 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.24.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.191.129
description:
2025-02-04 10:13:01 dovecot_plain authenticator failed for ([5.30.191.129]) [5.30.191.129]:49504: 535 Incorrect authentication data (set_id=jessica1234)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.27.161
description:
47.128.27.161 - - [04/Feb/2025:10:13:04 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20621604 HTTP/1.1" 302 0 jaster.us "http://jaster.us/index.php?option=com_content&view=article&id=184&Itemid=222&showall=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.27.161


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.45.114.161
description:
Feb  4 10:12:09 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.45.114.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.103.235.223
description:
Feb  4 10:12:09 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.103.235.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.45.114.161
description:
2025-02-04 10:12:11 dovecot_plain authenticator failed for 121-45-114-161.tpgi.com.au [121.45.114.161]:33532: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.151.148
description:
2025-02-04 10:12:34 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.151.148]:54865: 535 Incorrect authentication data (set_id=jessica1234@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 115.186.118.157
description:
[2025-02-04 10:12:52 +0100] info [webmaild] 115.186.118.157 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.255.112.6
description:
2025-02-04 10:12:19 dovecot_plain authenticator failed for 6.112.255.173.bc.googleusercontent.com [173.255.112.6]:41046: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.28.26.250
description:
2025-02-04 10:12:25 dovecot_plain authenticator failed for (201-28-26-250.customer.tdatabrasil.net.br) [201.28.26.250]:50042: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.122.203
description:
2025-02-04 10:13:37 dovecot_plain authenticator failed for (ppp-82-84-122-203.dialup.tiscali.it) [82.84.122.203]:61698: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.156.203
description:
2025-02-04 10:13:38 dovecot_plain authenticator failed for ([120.197.156.203]) [120.197.156.203]:57922: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.238.192.121
description:
Feb  4 10:13:16 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.238.192.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.170.50.2
description:
Feb  4 10:13:16 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.170.50.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.249
description:
2025-02-04 10:13:19 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.152.249]:52854: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.210.232
description:
Feb  4 10:13:13 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.210.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.85.107.135
description:
2025-02-04 10:13:18 dovecot_plain authenticator failed for ([222.85.107.135]) [222.85.107.135]:56226: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.148.186.186
description:
Feb  4 10:13:43 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.148.186.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.196.130.184
description:
2025-02-04 10:13:38 dovecot_plain authenticator failed for ([120.196.130.184]) [120.196.130.184]:58428: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.188.204.213
description:
Feb  4 10:13:14 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.188.204.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.239.241.194
description:
2025-02-04 10:13:24 dovecot_plain authenticator failed for ([121.239.241.194]) [121.239.241.194]:33145: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.164.235.208
description:
Feb  4 10:13:33 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.164.235.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.6.160.15
description:
2025-02-04 10:13:53 dovecot_plain authenticator failed for ([218.6.160.15]) [218.6.160.15]:57732: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.41.69.130
description:
Feb  4 10:13:27 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.41.69.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
description:
Feb  4 10:13:28 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.84.11.180
description:
2025-02-04 10:13:33 dovecot_plain authenticator failed for ([59.84.11.180]) [59.84.11.180]:26570: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.70.100
description:
2025-02-04 10:13:46 dovecot_plain authenticator failed for ([122.166.70.100]) [122.166.70.100]:58304: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.72.83.179
description:
Feb  4 10:13:11 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.72.83.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Feb  4 10:13:16 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.230.100.252
description:
2025-02-04 10:13:29 dovecot_plain authenticator failed for ([38.230.100.252]) [38.230.100.252]:17968: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.138.196.194
description:
2025-02-04 10:13:19 dovecot_plain authenticator failed for ([200.138.196.194]) [200.138.196.194]:59669: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.135.93
description:
Feb  4 10:13:37 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.135.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.207.226.228
description:
Feb  4 10:13:56 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.207.226.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.163.154
description:
2025-02-04 10:13:35 dovecot_plain authenticator failed for ([103.231.163.154]) [103.231.163.154]:6553: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.247.159.106
description:
Feb  4 10:13:39 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.247.159.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.214.115
description:
2025-02-04 10:13:41 dovecot_plain authenticator failed for ([218.4.214.115]) [218.4.214.115]:35440: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
description:
2025-02-04 10:13:41 dovecot_plain authenticator failed for ([115.247.159.106]) [115.247.159.106]:42540: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.203.210.119
description:
Feb  4 10:13:54 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.203.210.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.85.107.135
description:
Feb  4 10:13:16 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.85.107.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.76.106.226
description:
Feb  4 10:13:18 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.76.106.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.156.203
description:
Feb  4 10:13:36 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.156.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.124.94
description:
2025-02-04 10:13:22 dovecot_plain authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:49109: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.218.168.67
description:
Feb  4 10:13:28 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.218.168.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.13.237.163
description:
Feb  4 10:13:37 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.13.237.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Feb  4 10:13:44 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
description:
2025-02-04 10:13:16 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:60064: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.206.76
description:
Feb  4 10:13:17 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.206.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.227.248.225
description:
Feb  4 10:13:18 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.227.248.225 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.135.255.37
description:
[2025-02-04 10:13:27 +0100] info [webmaild] 103.135.255.37 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.84.11.180
description:
Feb  4 10:13:31 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.84.11.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.225.185.148
description:
Feb  4 10:13:32 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.225.185.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.161.138.244
description:
Feb  4 10:13:10 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.161.138.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.206.76
description:
2025-02-04 10:13:19 dovecot_plain authenticator failed for ([14.37.206.76]) [14.37.206.76]:53389: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.7.52.183
description:
2025-02-04 10:13:24 dovecot_plain authenticator failed for ([110.7.52.183]) [110.7.52.183]:35930: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.168.67
description:
2025-02-04 10:13:30 dovecot_plain authenticator failed for (189.218.168.67-clientes-izzi.mx) [189.218.168.67]:53826: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.172.120.32
description:
Feb  4 10:13:33 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.172.120.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.59.214.21
description:
2025-02-04 10:13:54 dovecot_plain authenticator failed for s142-59-214-21.ab.hsia.telus.net [142.59.214.21]:44632: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.148.186.186
description:
2025-02-04 10:13:45 dovecot_plain authenticator failed for ([116.148.186.186]) [116.148.186.186]:47012: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.203.210.119
description:
2025-02-04 10:13:56 dovecot_plain authenticator failed for ([103.203.210.119]) [103.203.210.119]:50930: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.238.206
description:
2025-02-04 10:13:12 dovecot_plain authenticator failed for ([95.221.238.206]) [95.221.238.206]:42744: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.53.82
description:
2025-02-04 10:13:32 dovecot_plain authenticator failed for ([60.172.53.82]) [60.172.53.82]:52572: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.166.207.76
description:
Feb  4 10:13:33 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.166.207.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.93.183
description:
Feb  4 10:13:32 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.93.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.164.235.208
description:
2025-02-04 10:13:35 dovecot_plain authenticator failed for (208.235.164.124.adsl-pool.sx.cn) [124.164.235.208]:53678: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.69.30.93
description:
2025-02-04 10:13:44 dovecot_plain authenticator failed for ([180.69.30.93]) [180.69.30.93]:32884: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Feb  4 10:13:25 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.230.100.252
description:
Feb  4 10:13:27 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.230.100.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.41.69.130
description:
2025-02-04 10:13:29 dovecot_plain authenticator failed for syn-047-041-069-130.res.spectrum.com [47.41.69.130]:47035: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.72.17.75
description:
2025-02-04 10:13:30 dovecot_plain authenticator failed for (h75-192-72-17.seed.net.tw) [192.72.17.75]:34255: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.233.77.125
description:
Feb  4 10:13:34 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.233.77.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.160.70
description:
2025-02-04 10:13:34 dovecot_plain authenticator failed for ([183.238.160.70]) [183.238.160.70]:34045: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.72.103.74
description:
Feb  4 10:13:39 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.72.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.6.160.15
description:
Feb  4 10:13:51 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.6.160.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.210.232
description:
2025-02-04 10:13:15 dovecot_plain authenticator failed for ([87.103.210.232]) [87.103.210.232]:58672: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.96.91.71
description:
2025-02-04 10:13:16 dovecot_plain authenticator failed for ([27.96.91.71]) [27.96.91.71]:57602: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.50.48.86
description:
Feb  4 10:13:30 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.50.48.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
description:
Feb  4 10:13:22 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.53
description:
2025-02-04 10:13:23 dovecot_plain authenticator failed for ([65.20.251.53]) [65.20.251.53]:53683: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.53.82
description:
Feb  4 10:13:30 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.53.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.221.59
description:
2025-02-04 10:13:29 dovecot_plain authenticator failed for (abts-north-static-059.221.160.122.airtelbroadband.in) [122.160.221.59]:40762: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
description:
Feb  4 10:13:33 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
description:
Feb  4 10:13:14 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
description:
2025-02-04 10:13:16 dovecot_plain authenticator failed for ([50.188.204.213]) [50.188.204.213]:44777: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-02-04 10:13:18 dovecot_plain authenticator failed for ([112.111.61.230]) [112.111.61.229]:36740: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.124.137.205
description:
Feb  4 10:13:49 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.124.137.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
description:
2025-02-04 10:14:01 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:53090: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.125.94
description:
2025-02-04 10:13:32 dovecot_plain authenticator failed for (94.125.156.175.unknown.m1.com.sg) [175.156.125.94]:41414: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.225.185.148
description:
2025-02-04 10:13:34 dovecot_plain authenticator failed for ([124.225.185.148]) [124.225.185.148]:33726: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.226.228
description:
2025-02-04 10:13:58 dovecot_plain authenticator failed for ([175.207.226.228]) [175.207.226.228]:46671: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.29.203.126
description:
Feb  4 10:13:14 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.29.203.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.39.187.16
description:
Feb  4 10:13:15 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.39.187.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
description:
2025-02-04 10:13:29 dovecot_plain authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:53650: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.199.57.220
description:
2025-02-04 10:13:17 dovecot_plain authenticator failed for ([192.199.57.220]) [192.199.57.220]:50501: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.150.37.249
description:
Feb  4 10:13:20 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.150.37.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.124.94
description:
Feb  4 10:13:20 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.124.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.235.126
description:
Feb  4 10:13:35 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.235.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.31.47.232
description:
2025-02-04 10:13:23 dovecot_plain authenticator failed for syn-065-031-047-232.res.spectrum.com [65.31.47.232]:35517: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.33.204.130
description:
Feb  4 10:13:27 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.33.204.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.221.59
description:
Feb  4 10:13:27 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.221.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-02-04 10:13:28 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:42429: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.125.94
description:
Feb  4 10:13:30 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
description:
Feb  4 10:13:16 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.31.47.232
description:
Feb  4 10:13:21 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.31.47.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
description:
2025-02-04 10:13:21 dovecot_plain authenticator failed for ([196.191.212.236]) [213.55.85.202]:23219: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.231.163.154
description:
Feb  4 10:13:33 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.231.163.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.138.196.194
description:
Feb  4 10:13:17 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.138.196.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.207.76
description:
2025-02-04 10:13:35 dovecot_plain authenticator failed for wsip-70-166-207-76.ph.ph.cox.net [70.166.207.76]:45330: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.221.2.199
description:
Feb  4 10:13:37 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.221.2.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.238.192.121
description:
2025-02-04 10:13:18 dovecot_plain authenticator failed for host-5l.vsg1-a.v4.dfn.nl (host-5l.vsg1-a.dfn.nl) [62.238.192.121]:35544: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
description:
Feb  4 10:13:19 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.240.58.132
description:
Feb  4 10:13:11 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.240.58.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.96.91.71
description:
Feb  4 10:13:14 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.96.91.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.39.187.16
description:
2025-02-04 10:13:17 dovecot_plain authenticator failed for ([189.39.187.16]) [189.39.187.16]:35462: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
description:
2025-02-04 10:13:34 dovecot_plain authenticator failed for (corporativo.gvt.net.br) [189.115.93.183]:54830: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.172.120.32
description:
2025-02-04 10:13:35 dovecot_plain authenticator failed for ([111.172.120.32]) [111.172.120.32]:59872: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.82.196.131
description:
2025-02-04 10:13:37 dovecot_plain authenticator failed for ([120.82.196.131]) [120.82.196.131]:39622: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.59.125
description:
2025-02-04 10:14:05 dovecot_plain authenticator failed for ([103.171.59.125]) [103.171.59.125]:57218: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.37.17
description:
Feb  4 10:13:13 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.37.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
description:
Feb  4 10:13:14 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-02-04 10:13:27 dovecot_plain authenticator failed for ([203.177.65.26]) [58.69.17.18]:56340: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.160.70
description:
Feb  4 10:13:32 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.160.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-02-04 10:13:46 dovecot_plain authenticator failed for ([218.150.170.10]) [218.150.170.10]:49584: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.240.58.132
description:
2025-02-04 10:13:13 dovecot_plain authenticator failed for broadband-87-240-58-132.ip.moscow.rt.ru [87.240.58.132]:39458: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.152.249
description:
Feb  4 10:13:17 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.152.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.76.106.226
description:
2025-02-04 10:13:20 dovecot_plain authenticator failed for (226.106.76.200.static.redip.topnet.com.mx) [200.76.106.226]:53094: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.164.188
description:
2025-02-04 10:13:19 dovecot_plain authenticator failed for ([223.197.164.188]) [223.197.164.188]:61948: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.117.144.158
description:
Feb  4 10:13:21 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.117.144.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
description:
2025-02-04 10:13:29 dovecot_plain authenticator failed for ([103.55.89.5]) [116.75.218.103]:49224: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.103.74
description:
2025-02-04 10:13:41 dovecot_plain authenticator failed for ([27.72.103.74]) [27.72.103.74]:57500: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.109.33.120
description:
Feb  4 10:13:53 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.109.33.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.238.206
description:
Feb  4 10:13:10 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.238.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.203.126
description:
2025-02-04 10:13:16 dovecot_plain authenticator failed for 126-203-29-85.dyn.estpak.ee [85.29.203.126]:58396: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.164.188
description:
Feb  4 10:13:17 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.164.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.109.33.120
description:
2025-02-04 10:13:55 dovecot_plain authenticator failed for rplus.dp.ua [77.109.33.120]:46798: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.0.157.78
description:
Feb  4 10:14:05 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.0.157.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.72.83.179
description:
2025-02-04 10:13:13 dovecot_plain authenticator failed for ([178.72.83.179]) [178.72.83.179]:59958: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.104.103.146
description:
Feb  4 10:13:25 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.104.103.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Feb  4 10:13:26 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.84.122.203
description:
Feb  4 10:13:35 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.84.122.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
description:
2025-02-04 10:13:18 dovecot_plain authenticator failed for ([111.171.127.190]) [111.171.127.190]:37550: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.104.103.146
description:
2025-02-04 10:13:27 dovecot_plain authenticator failed for ([180.104.103.146]) [180.104.103.146]:46213: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.77.125
description:
2025-02-04 10:13:36 dovecot_plain authenticator failed for ([80.233.77.125]) [80.233.77.125]:35176: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.13.237.163
description:
2025-02-04 10:13:39 dovecot_plain authenticator failed for ([59.13.237.163]) [59.13.237.163]:56440: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.161.138.244
description:
2025-02-04 10:13:12 dovecot_plain authenticator failed for 244.79-161-138.customer.lyse.net [79.161.138.244]:44362: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.37.17
description:
2025-02-04 10:13:15 dovecot_plain authenticator failed for ([49.245.37.17]) [49.245.37.17]:39624: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
description:
2025-02-04 10:13:18 dovecot_plain authenticator failed for ([45.170.50.2]) [45.170.50.2]:37778: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.249.167.45
description:
Feb  4 10:13:14 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.249.167.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.50.48.86
description:
2025-02-04 10:13:32 dovecot_plain authenticator failed for ([212.50.48.86]) [212.50.48.86]:58728: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Feb  4 10:13:50 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.235.126
description:
2025-02-04 10:13:37 dovecot_plain authenticator failed for ([220.189.235.126]) [220.189.235.126]:33088: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.69.30.93
description:
Feb  4 10:13:42 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.69.30.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.188.85
description:
2025-02-04 10:13:51 dovecot_plain authenticator failed for ([120.234.188.85]) [120.234.188.85]:45930: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.117.144.158
description:
2025-02-04 10:13:23 dovecot_plain authenticator failed for ([175.117.144.158]) [175.117.144.158]:36306: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.30
description:
2025-02-04 10:13:26 dovecot_plain authenticator failed for ([60.167.19.30]) [60.167.19.30]:43152: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.75.218.103
description:
Feb  4 10:13:27 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.75.218.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.150.37.249
description:
2025-02-04 10:13:22 dovecot_plain authenticator failed for ([217.150.37.249]) [217.150.37.249]:56882: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.188.85
description:
Feb  4 10:13:49 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.188.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.124.137.205
description:
2025-02-04 10:13:51 dovecot_plain authenticator failed for ([92.124.137.205]) [92.124.137.205]:37811: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
description:
2025-02-04 10:13:16 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:39284: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.249.167.45
description:
2025-02-04 10:13:16 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:36934: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.157.246.26
description:
2025-02-04 10:13:18 dovecot_plain authenticator failed for ([117.157.246.26]) [117.157.246.26]:49072: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
description:
2025-02-04 10:13:30 dovecot_plain authenticator failed for ([222.92.61.242]) [222.92.61.242]:47810: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.214.115
description:
Feb  4 10:13:39 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.214.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.70.100
description:
Feb  4 10:13:44 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.70.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.157.246.26
description:
Feb  4 10:13:16 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.157.246.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.227.248.225
description:
2025-02-04 10:13:20 dovecot_plain authenticator failed for ([139.227.248.225]) [139.227.248.225]:47026: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.82.196.131
description:
Feb  4 10:13:35 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.82.196.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
description:
2025-02-04 10:13:35 dovecot_plain authenticator failed for ([171.244.63.170]) [171.244.63.170]:52600: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.135.93
description:
2025-02-04 10:13:39 dovecot_plain authenticator failed for 93.135.220.111.sta.wbroadband.net.au [111.220.135.93]:45503: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.221.2.199
description:
2025-02-04 10:13:39 dovecot_plain authenticator failed for ([114.221.2.199]) [114.221.2.199]:50744: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
description:
2025-02-04 10:13:42 dovecot_plain authenticator failed for ([58.216.101.166]) [58.216.101.162]:51016: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.150.100.139
description:
Feb  4 10:13:14 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.150.100.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.30
description:
Feb  4 10:13:24 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.72.17.75
description:
Feb  4 10:13:28 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.72.17.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
description:
Feb  4 10:13:59 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
description:
Feb  4 10:13:40 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.59.214.21
description:
Feb  4 10:13:52 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.59.214.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-02-04 10:13:52 dovecot_plain authenticator failed for ([2.57.219.6]) [2.57.219.2]:34246: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.59.125
description:
Feb  4 10:14:03 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.59.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.150.100.139
description:
2025-02-04 10:13:16 dovecot_plain authenticator failed for ([107.150.100.139]) [107.150.100.139]:47448: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.53
description:
Feb  4 10:13:21 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.196.130.184
description:
Feb  4 10:13:36 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.196.130.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.254.47
description:
Feb  4 10:14:13 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.12.254.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.247.207.98
description:
Feb  4 10:14:14 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.247.207.98 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.254.202.218
description:
[2025-02-04 10:14:27 +0100] info [webmaild] 179.254.202.218 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.29.199.6
description:
[2025-02-04 10:14:57 +0100] info [webmaild] 201.29.199.6 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.157.78
description:
2025-02-04 10:14:07 dovecot_plain authenticator failed for c-73-0-157-78.hsd1.fl.comcast.net [73.0.157.78]:41474: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.232
description:
Feb  4 10:14:11 ait sshd[4036902]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.232  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.12.254.47
description:
2025-02-04 10:14:15 dovecot_plain authenticator failed for ([106.12.254.47]) [106.12.254.47]:9408: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.247.207.98
description:
2025-02-04 10:14:16 dovecot_plain authenticator failed for ([114.247.207.98]) [114.247.207.98]:42353: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
description:
2025-02-04 10:15:46 dovecot_plain authenticator failed for ([103.55.89.5]) [116.75.218.103]:55738: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.37.251.48
description:
[2025-02-04 10:16:00 +0100] info [webmaild] 5.37.251.48 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.139.116.184
description:
2025-02-04 10:16:05 dovecot_plain authenticator failed for ([123.139.116.184]) [123.139.116.184]:40336: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.190
description:
2025-02-04 10:15:58 dovecot_plain authenticator failed for (nsg-corporate-190.227.187.122.airtel.in) [122.187.227.190]:34666: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.139.116.184
description:
Feb  4 10:16:03 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.139.116.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.75.218.103
description:
Feb  4 10:15:44 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.75.218.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.211.130.219
description:
Feb  4 10:15:49 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.211.130.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.211.130.219
description:
2025-02-04 10:15:51 dovecot_plain authenticator failed for ([185.211.130.219]) [185.211.130.219]:41211: 535 Incorrect authentication data (set_id=amadam@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.190
description:
Feb  4 10:15:56 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.97.114.149
description:
Feb  4 10:16:54 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.97.114.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.31.8.202
description:
2025-02-04 10:16:59 dovecot_plain authenticator failed for (113-11-34-221-smile.com.bd) [114.31.8.202]:32964: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.24.194.207
description:
Feb  4 10:16:13 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.24.194.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.132.232
description:
2025-02-04 10:16:48 dovecot_plain authenticator failed for ([75.110.132.232]) [75.110.132.232]:62502: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.182.89.19
description:
Feb  4 10:16:53 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.182.89.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.181.52
description:
2025-02-04 10:16:36 dovecot_plain authenticator failed for ([60.31.181.52]) [60.31.181.52]:51777: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.110.132.232
description:
Feb  4 10:16:46 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.110.132.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.182.89.19
description:
2025-02-04 10:16:55 dovecot_plain authenticator failed for ([123.182.89.19]) [123.182.89.19]:51311: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.181.52
description:
Feb  4 10:16:34 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.181.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.139.55
description:
2025-02-04 10:16:48 dovecot_plain authenticator failed for ([112.194.139.55]) [112.194.139.55]:35234: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 223.123.38.39
description:
[2025-02-04 10:17:03 +0100] info [webmaild] 223.123.38.39 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.24.194.207
description:
2025-02-04 10:16:15 dovecot_plain authenticator failed for ([59.24.194.207]) [59.24.194.207]:37287: 535 Incorrect authentication data (set_id=amadam)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 147.45.44.84
description:
[2025-02-04 10:16:54 +0100] info [whostmgrd] 147.45.44.84 - lemassne "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
description:
Feb  4 10:16:53 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.97.114.149
description:
2025-02-04 10:16:56 dovecot_plain authenticator failed for c-73-97-114-149.hsd1.wa.comcast.net [73.97.114.149]:35172: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.31.8.202
description:
Feb  4 10:16:57 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.31.8.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.66.63.187
description:
Feb  4 10:17:01 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.66.63.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.108.165
description:
Feb  4 10:16:21 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.108.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.108.165
description:
2025-02-04 10:16:23 dovecot_plain authenticator failed for ([116.116.108.165]) [116.116.108.165]:38587: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 129.122.155.24
description:
[2025-02-04 10:16:34 +0100] info [webmaild] 129.122.155.24 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.139.55
description:
Feb  4 10:16:46 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.139.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.66.63.187
description:
2025-02-04 10:17:03 dovecot_plain authenticator failed for ([121.66.63.187]) [121.66.63.187]:38401: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.238.94
description:
Feb  4 10:16:33 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.238.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.238.94
description:
2025-02-04 10:16:35 dovecot_plain authenticator failed for 186-247-238-94.user.veloxzone.com.br [186.247.238.94]:40605: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
description:
2025-02-04 10:16:55 dovecot_plain authenticator failed for (18776174254.telemar.net.br) [187.76.174.254]:46861: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.9.74
description:
2025-02-04 10:17:19 dovecot_plain authenticator failed for (200151009074.userdial.telemar.net.br) [200.151.9.74]:38383: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.217.183
description:
2025-02-04 10:17:10 dovecot_plain authenticator failed for ([186.200.71.115]) [189.56.217.183]:45454: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
description:
2025-02-04 10:17:10 dovecot_plain authenticator failed for ([96.79.174.131]) [96.79.174.131]:40235: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.226.240
description:
Feb  4 10:17:12 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.226.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.124.10.62
description:
2025-02-04 10:17:11 dovecot_plain authenticator failed for ool-457c0a3e.dyn.optonline.net [69.124.10.62]:34754: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
description:
2025-02-04 10:17:14 dovecot_plain authenticator failed for (nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:56333: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.9.74
description:
Feb  4 10:17:17 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.9.74 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 136.169.174.229
description:
[2025-02-04 10:17:32 +0100] info [webmaild] 136.169.174.229 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.217.183
description:
Feb  4 10:17:08 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.217.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
description:
Feb  4 10:17:08 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.124.10.62
description:
Feb  4 10:17:09 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.124.10.62 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Feb  4 10:18:24 ait sshd[4038569]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.177.105.166
description:
[2025-02-04 10:18:32 +0100] info [webmaild] 45.177.105.166 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:10-18.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.134.126.162
description:
2025-02-04 10:18:53 dovecot_plain authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:4290: 535 Incorrect authentication data (set_id=aabdulrahaman@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.150.52.221
description:
2025-02-04 10:18:30 dovecot_plain authenticator failed for c188-150-52-221.bredband.tele2.se (werearr) [188.150.52.221]:43326: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.152.225.154
description:
Feb  4 10:18:38 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.152.225.154 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  4 10:18:48 ait sshd[4038782]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.232
description:
Feb  4 10:18:49 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.134.126.162
description:
Feb  4 10:18:51 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.134.126.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.232
description:
2025-02-04 10:18:51 dovecot_plain authenticator failed for ([196.191.212.232]) [196.191.212.232]:45144: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.126
description:
Feb  4 10:18:59 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.126
description:
2025-02-04 10:19:01 dovecot_plain authenticator failed for (m121-202-153-126.smartone.com) [121.202.153.126]:52867: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.6.151.194
description:
Feb  4 10:19:05 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.6.151.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.150.52.221
description:
Feb  4 10:18:28 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.150.52.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.133.205
description:
Feb  4 10:18:39 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.133.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
description:
2025-02-04 10:18:40 dovecot_plain authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:63223: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.133.205
description:
2025-02-04 10:18:41 dovecot_plain authenticator failed for ([45.238.133.205]) [45.238.133.205]:35231: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.164.246.53
description:
Feb  4 10:19:02 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.164.246.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.164.246.53
description:
2025-02-04 10:19:04 dovecot_plain authenticator failed for 53.246.164.109.static.wline.lns.sme.cust.swisscom.ch (norapic) [109.164.246.53]:53297: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.143.245.194
description:
2025-02-04 10:19:12 dovecot_plain authenticator failed for ([5.143.245.194]) [5.143.245.194]:37518: 535 Incorrect authentication data (set_id=aabdulrahaman)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.232
description:
Feb  4 10:19:15 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.99.153.21
description:
Feb  4 10:19:17 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.99.153.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
description:
2025-02-04 10:19:37 dovecot_plain authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:47234: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.219.71.26
description:
[2025-02-04 10:20:03 +0100] info [webmaild] 190.219.71.26 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.184.56.199
description:
Feb  4 10:19:11 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.184.56.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.41.197.10
description:
2025-02-04 10:19:11 dovecot_plain authenticator failed for ([59.41.197.10]) [59.41.197.10]:47225: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.52.22
description:
47.128.52.22 - - [04/Feb/2025:10:20:05 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=3669499 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/7/?instructor=2&level=intermediate%2Cbeginner" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.52.22


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.143.245.194
description:
Feb  4 10:19:10 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.143.245.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.151.194
description:
2025-02-04 10:19:07 dovecot_plain authenticator failed for ([187.6.151.177]) [187.6.151.194]:34615: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.41.197.10
description:
Feb  4 10:19:09 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.41.197.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.56.199
description:
2025-02-04 10:19:13 dovecot_plain authenticator failed for ([112.184.56.199]) [112.184.56.199]:39955: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
description:
2025-02-04 10:19:19 dovecot_plain authenticator failed for ([59.99.153.21]) [59.99.153.21]:4071: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.125
description:
2025-02-04 10:19:31 dovecot_plain authenticator failed for ([130.185.96.125]) [130.185.96.125]:57395: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.166.148.163
description:
[2025-02-04 10:19:32 +0100] info [webmaild] 45.166.148.163 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.126.232.232
description:
[2025-02-04 10:19:08 +0100] info [webmaild] 177.126.232.232 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.185.96.125
description:
Feb  4 10:19:29 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.185.96.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
description:
Feb  4 10:19:35 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.95.13.185
description:
Feb  4 10:19:45 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.95.13.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
description:
2025-02-04 10:19:47 dovecot_plain authenticator failed for ([74.95.13.185]) [74.95.13.185]:35490: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.232
description:
2025-02-04 10:19:17 dovecot_plain authenticator failed for ([196.191.212.232]) [196.191.212.232]:50018: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.56.255
description:
47.128.56.255 - - [04/Feb/2025:10:20:57 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=8756610 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/d57f03?panel=swiftmailer" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.56.255


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Feb  4 10:20:30 ait sshd[4039335]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Feb  4 10:20:30 ait sshd[4039335]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.22.192.98
description:
[2025-02-04 10:21:12 +0100] info [webmaild] 177.22.192.98 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.221.185.130
description:
[2025-02-04 10:21:50 +0100] info [webmaild] 131.221.185.130 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.152.103.90
description:
[2025-02-04 10:22:06 +0100] info [webmaild] 177.152.103.90 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.125.67.109
description:
2025-02-04 10:23:03 dovecot_plain authenticator failed for ([39.125.67.109]) [39.125.67.109]:58601: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 116.71.105.190
description:
[2025-02-04 10:22:41 +0100] info [webmaild] 116.71.105.190 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.250.191.189
description:
Feb  4 10:22:52 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.250.191.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
description:
2025-02-04 10:22:54 dovecot_plain authenticator failed for (willik) [178.250.191.189]:38646: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.125.67.109
description:
Feb  4 10:23:01 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.125.67.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.110.70.2
description:
Feb  4 10:23:09 ait auth[4026334]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.110.70.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.110.70.2
description:
2025-02-04 10:23:11 dovecot_plain authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:51291: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.195.102.110
description:
[2025-02-04 10:25:02 +0100] info [webmaild] 186.195.102.110 - help@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.139.86
description:
[2025-02-04 10:24:13 +0100] info [webmaild] 157.100.139.86 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.9.65.122
description:
[2025-02-04 10:24:50 +0100] info [webmaild] 190.9.65.122 - help@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 202.79.186.109
description:
[2025-02-04 10:25:21 +0100] info [webmaild] 202.79.186.109 - help@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.124.143.165
description:
Feb  4 10:26:01 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.124.143.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.124.143.165
description:
2025-02-04 10:26:03 dovecot_plain authenticator failed for ([92.124.143.165]) [92.124.143.165]:58464: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.110.46.41
description:
[2025-02-04 10:26:58 +0100] info [webmaild] 185.110.46.41 - help@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.7.100
description:
2025-02-04 10:26:30 dovecot_plain authenticator failed for 100.7.61.94.rev.vodafone.pt [94.61.7.100]:49700: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.154.10
description:
Feb  4 10:26:45 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.154.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.106.154.10
description:
2025-02-04 10:26:47 dovecot_plain authenticator failed for ([103.106.154.10]) [103.106.154.10]:34060: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Feb  4 10:26:54 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.243.43.58
description:
Feb  4 10:26:59 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.243.43.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.61.7.100
description:
Feb  4 10:26:28 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.61.7.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-02-04 10:26:56 dovecot_plain authenticator failed for ([112.111.61.231]) [112.111.61.229]:44808: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.243.43.58
description:
2025-02-04 10:27:01 dovecot_plain authenticator failed for ([211.243.43.58]) [211.243.43.58]:52418: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.210.232
description:
2025-02-04 10:27:07 dovecot_plain authenticator failed for ([87.103.210.232]) [87.103.210.232]:50493: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.196.106
description:
Feb  4 10:27:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.196.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.216.125
description:
2025-02-04 10:27:42 dovecot_plain authenticator failed for (nl125-twinpalm-216-lk.zamnet.zm) [196.46.216.125]:47121: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.89.199
description:
Feb  4 10:27:45 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.89.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.90.34.32
description:
2025-02-04 10:27:49 dovecot_plain authenticator failed for syn-071-090-034-032.res.spectrum.com [71.90.34.32]:52455: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Feb  4 10:27:20 ait sshd[4041998]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.195.225.182
description:
Feb  4 10:27:46 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.195.225.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.104.166.110
description:
Feb  4 10:27:48 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.104.166.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
description:
2025-02-04 10:27:52 dovecot_plain authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:44652: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.188.40.123
description:
2025-02-04 10:27:12 dovecot_plain authenticator failed for ([90.188.40.123]) [90.188.40.123]:49824: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.217.255.171
description:
Feb  4 10:27:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.217.255.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
description:
Feb  4 10:27:58 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.110.120.96
description:
Feb  4 10:27:14 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.110.120.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.175.39.76
description:
2025-02-04 10:27:23 dovecot_plain authenticator failed for ([111.175.39.76]) [111.175.39.76]:60056: 535 Incorrect authentication data (set_id=abio17@ait.edu.gh)


