# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 165.165.174.186
description:
[2025-02-04 22:27:20 +0100] info [webmaild] 165.165.174.186 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.104.199.27
description:
2025-02-04 22:27:22 dovecot_plain authenticator failed for ([120.24.83.156]) [223.104.199.27]:26461: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.224.58.243
description:
2025-02-04 22:26:49 dovecot_plain authenticator failed for ([1.224.58.243]) [1.224.58.243]:52426: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.51.0.170
description:
Feb  4 22:26:59 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.51.0.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.217.162
description:
2025-02-04 22:27:00 dovecot_plain authenticator failed for ([124.115.217.162]) [124.115.217.162]:37283: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.129.114.190
description:
2025-02-04 22:27:00 dovecot_plain authenticator failed for ([185.129.114.190]) [185.129.114.190]:37346: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.23
description:
2025-02-04 22:27:23 dovecot_plain authenticator failed for ([121.202.152.23]) [121.202.152.23]:1929: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.246.49.99
description:
2025-02-04 22:27:08 dovecot_plain authenticator failed for (abts-mp-static-185.120.168.122.airtelbroadband.in) [115.246.49.99]:56508: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.104.199.27
description:
Feb  4 22:27:20 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.104.199.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
description:
2025-02-04 22:26:48 dovecot_plain authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:41902: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.16.20
description:
2025-02-04 22:26:55 dovecot_plain authenticator failed for 217-211-16-20-no600.tbcn.telia.com [217.211.16.20]:41482: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.112.194.160
description:
2025-02-04 22:26:58 dovecot_plain authenticator failed for ([106.112.194.160]) [106.112.194.160]:52616: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.0.170
description:
2025-02-04 22:27:01 dovecot_plain authenticator failed for ([179.51.0.170]) [179.51.0.170]:44044: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-02-04 22:27:04 dovecot_plain authenticator failed for ([1.28.192.118]) [1.28.192.118]:35045: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.140.244.144
description:
Feb  4 22:27:03 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.140.244.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.235.203.63
description:
Feb  4 22:27:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.235.203.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.121.53.76
description:
2025-02-04 22:26:47 dovecot_plain authenticator failed for ([24.121.53.76]) [24.121.53.76]:40397: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
description:
Feb  4 22:27:02 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.193.122.91
description:
Feb  4 22:27:02 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.193.122.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.9.74
description:
Feb  4 22:27:08 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.9.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.178.132
description:
2025-02-04 22:27:23 dovecot_login authenticator failed for (132-178-53-194.mairnet.net) [194.53.178.132]:49422: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.67.218
description:
Feb  4 22:26:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.67.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.185.204.10
description:
2025-02-04 22:26:59 dovecot_plain authenticator failed for syn-107-185-204-010.res.spectrum.com [107.185.204.10]:32797: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
description:
2025-02-04 22:26:58 dovecot_plain authenticator failed for ([196.190.43.139]) [196.190.41.137]:16923: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.129.114.190
description:
Feb  4 22:26:58 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.129.114.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.9.74
description:
2025-02-04 22:27:10 dovecot_plain authenticator failed for (200151009074.userdial.telemar.net.br) [200.151.9.74]:58513: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.32.11.3
description:
2025-02-04 22:26:41 dovecot_plain authenticator failed for ([119.32.11.3]) [119.32.11.3]:64245: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 22:26:46 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.85.114
description:
2025-02-04 22:26:49 dovecot_plain authenticator failed for (186-200-85-114.customer.tdatabrasil.net.br) [186.200.85.114]:40939: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.58.67.218
description:
2025-02-04 22:26:49 dovecot_plain authenticator failed for ([103.58.67.218]) [103.58.67.218]:33584: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.115.164
description:
2025-02-04 22:26:49 dovecot_plain authenticator failed for ([218.94.115.164]) [218.94.115.164]:37106: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.235.203.63
description:
2025-02-04 22:27:25 dovecot_plain authenticator failed for 108-235-203-63.lightspeed.chrlnc.sbcglobal.net [108.235.203.63]:53021: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
description:
2025-02-04 22:26:47 dovecot_plain authenticator failed for ([92.126.223.175]) [92.126.223.175]:51948: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.77.97.146
description:
2025-02-04 22:26:57 dovecot_plain authenticator failed for (adsl.viettel.vn) [115.77.97.146]:43685: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.128.211
description:
2025-02-04 22:27:03 dovecot_plain authenticator failed for ([112.27.128.211]) [112.27.128.211]:44180: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.206.136.24
description:
2025-02-04 22:27:22 dovecot_login authenticator failed for ([218.206.136.24]) [218.206.136.24]:56204: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.169.144.176
description:
2025-02-04 22:26:35 dovecot_login authenticator failed for 136.169.144.176.dynamic.ufanet.ru [136.169.144.176]:58014: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.77.97.146
description:
Feb  4 22:26:55 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.77.97.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.128.211
description:
Feb  4 22:27:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.128.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
description:
2025-02-04 22:27:04 dovecot_plain authenticator failed for ([82.193.122.91]) [82.193.122.91]:35997: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.81.24
description:
2025-02-04 22:26:35 dovecot_plain authenticator failed for (24.81.41.31.ip4.feromedia.eu) [31.41.81.24]:43554: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.202.94.131
description:
2025-02-04 22:26:40 dovecot_plain authenticator failed for ([120.202.94.136]) [120.202.94.131]:24406: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.215.228.18
description:
Feb  4 22:26:41 ait sshd[189781]: pam_imunify(sshd:auth): [IM360_RBL] The IP 81.215.228.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.34.254
description:
2025-02-04 22:26:58 dovecot_plain authenticator failed for broadband-5-228-34-254.ip.moscow.rt.ru [5.228.34.254]:50926: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.14.33
description:
Feb  4 22:26:59 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.14.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.211.16.20
description:
Feb  4 22:26:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.211.16.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.249.167.45
description:
Feb  4 22:27:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.249.167.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.15.101.6
description:
Feb  4 22:27:21 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.15.101.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
description:
2025-02-04 22:26:55 dovecot_plain authenticator failed for ([200.37.179.83]) [200.37.179.83]:57282: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.113
description:
2025-02-04 22:27:00 dovecot_plain authenticator failed for ([103.190.91.113]) [103.190.91.113]:34011: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.249.167.45
description:
2025-02-04 22:27:09 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:48402: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 22:27:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
description:
2025-02-04 22:27:14 dovecot_plain authenticator failed for ([218.22.187.68]) [218.22.187.66]:47355: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.156.63.212
description:
Feb  4 22:27:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.156.63.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.15.101.6
description:
2025-02-04 22:27:23 dovecot_plain authenticator failed for ([190.15.101.6]) [190.15.101.6]:50316: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
description:
2025-02-04 22:26:47 dovecot_plain authenticator failed for (70-90-99-29-ma-ne.hfc.comcastbusiness.net) [70.90.99.29]:56067: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.80.166
description:
2025-02-04 22:26:54 dovecot_plain authenticator failed for (166.80.156.175.unknown.m1.com.sg) [175.156.80.166]:54500: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.247.159.106
description:
Feb  4 22:27:00 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.247.159.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
description:
2025-02-04 22:27:02 dovecot_plain authenticator failed for ([115.247.159.106]) [115.247.159.106]:37486: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.187.66
description:
Feb  4 22:27:12 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.187.66 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 81.215.228.18
description:
Feb  4 22:26:41 ait sshd[189781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.215.228.18


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 22:26:57 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.23
description:
Feb  4 22:27:21 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.29.196.170
description:
2025-02-04 22:27:11 dovecot_plain authenticator failed for ([71.29.196.170]) [71.29.196.170]:38192: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.215.228.18
description:
Feb  4 22:26:43 ait sshd[189781]: Failed password for invalid user kklai from 81.215.228.18 port 60500 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.174.226
description:
2025-02-04 22:26:56 dovecot_plain authenticator failed for ([58.216.174.226]) [58.216.174.226]:38164: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.0.240.126
description:
2025-02-04 22:26:56 dovecot_plain authenticator failed for ([113.0.240.126]) [113.0.240.126]:57088: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.29.196.170
description:
Feb  4 22:27:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.29.196.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.39.158
description:
2025-02-04 22:27:10 dovecot_plain authenticator failed for 95-31-39-158.broadband.corbina.ru [95.31.39.158]:57188: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.122.37.81
description:
[2025-02-04 22:28:07 +0100] info [webmaild] 138.122.37.81 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.243.2
description:
2025-02-04 22:28:22 dovecot_plain authenticator failed for ([183.220.243.2]) [183.220.243.2]:59124: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.47.48.178
description:
2025-02-04 22:27:47 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:39948: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.132.43.94
description:
2025-02-04 22:27:45 dovecot_plain authenticator failed for ([116.132.43.94]) [116.132.43.94]:41280: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.236.213.190
description:
2025-02-04 22:27:36 dovecot_login authenticator failed for 179-236-213-190.user.veloxzone.com.br [179.236.213.190]:43935: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
description:
2025-02-04 22:27:42 dovecot_plain authenticator failed for 89-253-90-113.customers.ownit.se [89.253.90.113]:59660: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.47.48.178
description:
Feb  4 22:27:45 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.47.48.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.207.226.113
description:
Feb  4 22:27:56 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.207.226.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.116.158.238
description:
2025-02-04 22:27:57 dovecot_plain authenticator failed for ([123.116.158.238]) [123.116.158.238]:42330: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.30.20.98
description:
Feb  4 22:28:00 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.30.20.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.243.2
description:
Feb  4 22:28:20 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.243.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.253.90.113
description:
Feb  4 22:27:40 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.253.90.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.116.158.238
description:
Feb  4 22:27:55 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.116.158.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.226.113
description:
2025-02-04 22:27:58 dovecot_plain authenticator failed for ([94.207.226.113]) [94.207.226.113]:48114: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.236.213.190
description:
Feb  4 22:27:34 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.236.213.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.191.94.106
description:
Feb  4 22:28:24 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.191.94.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.94.106
description:
2025-02-04 22:28:26 dovecot_plain authenticator failed for ([60.191.94.106]) [60.191.94.106]:44252: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.232.19.79
description:
Feb  4 22:28:28 ait sshd[190594]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.232.19.79  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.203.23.172
description:
Feb  4 22:28:30 ait sshd[190597]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.23.172


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.127
description:
Feb  4 22:27:33 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
description:
2025-02-04 22:28:02 dovecot_plain authenticator failed for ([1.30.20.98]) [1.30.20.98]:33200: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.159.164.28
description:
Feb  4 22:28:08 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.159.164.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.232.19.79
description:
Feb  4 22:28:28 ait sshd[190594]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.232.19.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.127
description:
2025-02-04 22:27:35 dovecot_login authenticator failed for (m121-202-154-127.smartone.com) [121.202.154.127]:61658: 535 Incorrect authentication data (set_id=21m1150009)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.164.28
description:
2025-02-04 22:28:10 dovecot_plain authenticator failed for ([85.159.164.28]) [85.159.164.28]:57796: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.87.38
description:
Feb  4 22:28:16 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.87.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.87.38
description:
2025-02-04 22:28:18 dovecot_plain authenticator failed for ([1.28.87.38]) [1.28.87.38]:40082: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.23.172
description:
Feb  4 22:28:30 ait sshd[190597]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.203.23.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.132.43.94
description:
Feb  4 22:27:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.132.43.94 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.2.133.209
description:
[2025-02-04 22:29:06 +0100] info [cpaneld] 182.2.133.209 - lemsas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 82.146.184.13
description:
[2025-02-04 22:29:21 +0100] info [webmaild] 82.146.184.13 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.172.203.43
description:
Feb  4 22:28:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.172.203.43 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.203.23.172
description:
Feb  4 22:28:31 ait sshd[190597]: Failed password for invalid user goudirect from 159.203.23.172 port 57990 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.172.203.43
description:
2025-02-04 22:28:34 dovecot_plain authenticator failed for ([220.172.203.43]) [220.172.203.43]:51965: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.252.92.19
description:
[2025-02-04 22:28:44 +0100] info [webmaild] 182.252.92.19 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.132.7.7
description:
Feb  4 22:30:19 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.132.7.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.44.225
description:
Feb  4 22:29:32 ait sshd[190965]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.161.44.225 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.161.44.225
description:
Feb  4 22:29:32 ait sshd[190965]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.161.44.225  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
description:
Feb  4 22:30:20 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
description:
2025-02-04 22:30:22 dovecot_plain authenticator failed for ([61.81.151.97]) [61.81.151.97]:56948: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.173
description:
2025-02-04 22:30:29 dovecot_plain authenticator failed for ([182.135.66.173]) [182.135.66.173]:53540: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.78.119.104
description:
Feb  4 22:30:03 ait sshd[191311]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.78.119.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.3.16.128
description:
Feb  4 22:30:17 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.3.16.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.166.140.172
description:
Feb  4 22:30:18 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.166.140.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.62.227.127
description:
Feb  4 22:29:53 ait sshd[191144]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.62.227.127 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.62.227.127
description:
Feb  4 22:29:53 ait sshd[191144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.62.227.127  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.78.119.104
description:
Feb  4 22:30:03 ait sshd[191311]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.78.119.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.49.179.157
description:
Feb  4 22:30:20 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.49.179.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.49.179.157
description:
2025-02-04 22:30:22 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:55689: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.156.198
description:
Feb  4 22:30:24 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.156.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.49.225.218
description:
Feb  4 22:30:26 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.49.225.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
description:
2025-02-04 22:30:28 dovecot_plain authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:34260: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.102
description:
2025-02-04 22:30:20 dovecot_plain authenticator failed for (nsg-corporate-102.234.187.122.airtel.in) [122.187.234.102]:39929: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.166.140.172
description:
2025-02-04 22:30:20 dovecot_plain authenticator failed for h198-166-140-172.ptr.cidc.telus.com [198.166.140.172]:59124: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.103.248.120
description:
Feb  4 22:30:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.103.248.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.156.198
description:
2025-02-04 22:30:26 dovecot_plain authenticator failed for ([116.116.156.198]) [116.116.156.198]:33365: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.173
description:
Feb  4 22:30:27 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.132.7.7
description:
2025-02-04 22:30:21 dovecot_plain authenticator failed for (customer-PUE-MCA-7-7.megared.net.mx) [201.132.7.7]:39440: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.33.204.130
description:
Feb  4 22:30:26 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.33.204.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.196.76.197
description:
[2025-02-04 22:29:52 +0100] info [webmaild] 131.196.76.197 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.102
description:
Feb  4 22:30:18 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.3.16.128
description:
2025-02-04 22:30:19 dovecot_plain authenticator failed for 128.16.3.213.static.wline.lns.sme.cust.swisscom.ch [213.3.16.128]:48683: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.103.248.120
description:
2025-02-04 22:30:25 dovecot_plain authenticator failed for ([91.103.248.120]) [91.103.248.120]:37240: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.49.225.218
description:
2025-02-04 22:30:28 dovecot_plain authenticator failed for (161.49.225.218.convergeict.com) [161.49.225.218]:35623: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.144.140
description:
2025-02-04 22:30:34 dovecot_plain authenticator failed for ([112.15.144.140]) [112.15.144.140]:38320: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.100.104
description:
Feb  4 22:30:35 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.100.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.99.242.32
description:
2025-02-04 22:30:35 dovecot_plain authenticator failed for ([103.98.21.22]) [125.99.242.32]:34431: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
description:
2025-02-04 22:30:38 dovecot_plain authenticator failed for ([213.230.64.246]) [213.230.64.246]:44480: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.7.203.177
description:
2025-02-04 22:30:40 dovecot_plain authenticator failed for ([59.7.203.177]) [59.7.203.177]:59688: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.39.41.171
description:
Feb  4 22:30:41 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.39.41.171 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 59.56.18.8
description:
Feb  4 22:30:32 ait sshd[191535]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.56.18.8


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.154.149
description:
Feb  4 22:30:42 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.154.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 22:30:50 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
description:
2025-02-04 22:31:08 dovecot_plain authenticator failed for ([154.118.162.194]) [154.118.162.194]:42700: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.253.119
description:
Feb  4 22:30:39 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.253.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.39.41.171
description:
2025-02-04 22:30:43 dovecot_plain authenticator failed for ([14.39.41.171]) [14.39.41.171]:45896: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.118.162.194
description:
Feb  4 22:31:06 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.118.162.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.144.140
description:
Feb  4 22:30:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.144.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.56.18.8
description:
Feb  4 22:30:32 ait sshd[191535]: pam_imunify(sshd:auth): [IM360_RBL] The IP 59.56.18.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.7.203.177
description:
Feb  4 22:30:38 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.7.203.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.253.119
description:
2025-02-04 22:30:41 dovecot_plain authenticator failed for ([31.141.253.119]) [31.141.253.119]:59626: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.225.174.202
description:
[2025-02-04 22:31:17 +0100] info [webmaild] 41.225.174.202 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.64.246
description:
Feb  4 22:30:36 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.64.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.154.149
description:
2025-02-04 22:30:44 dovecot_plain authenticator failed for ([175.156.154.149]) [175.156.154.149]:56646: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-02-04 22:30:47 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-173.static.tpgi.com.au) [110.175.220.250]:49681: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.95.67.92
description:
Feb  4 22:31:03 ait sshd[191842]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.95.67.92


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Feb  4 22:30:45 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.99.242.32
description:
Feb  4 22:30:33 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.99.242.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
description:
2025-02-04 22:30:37 dovecot_plain authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:58346: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.89.247.171
description:
[2025-02-04 22:30:42 +0100] info [webmaild] 189.89.247.171 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.95.67.92
description:
Feb  4 22:31:03 ait sshd[191842]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.95.67.92 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.59.204.188
description:
Feb  4 22:32:08 ait sshd[192184]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.59.204.188


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.238.92.245
description:
Feb  4 22:32:12 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.238.92.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.65.238.250
description:
Feb  4 22:32:17 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.65.238.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
description:
2025-02-04 22:32:19 dovecot_plain authenticator failed for (phizatic) [185.65.238.250]:34797: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Feb  4 22:31:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-02-04 22:31:34 dovecot_plain authenticator failed for (189-56-79-105.customer.tdatabrasil.net.br) [186.200.249.162]:36009: 535 Incorrect authentication data (set_id=7606e1dcc1da@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.51.120.61
description:
[2025-02-04 22:31:59 +0100] info [webmaild] 38.51.120.61 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
description:
2025-02-04 22:32:14 dovecot_plain authenticator failed for (jesibleral) [84.238.92.245]:55640: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.128.254.210
description:
Feb  4 22:31:40 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.128.254.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.128.254.210
description:
2025-02-04 22:31:42 dovecot_plain authenticator failed for h-98-128-254-210.a240.priv.bahnhof.se [98.128.254.210]:46827: 535 Incorrect authentication data (set_id=7606e1dcc1da)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.192.90.71
description:
[2025-02-04 22:32:31 +0100] info [webmaild] 189.192.90.71 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.10
description:
2025-02-04 22:32:48 dovecot_plain authenticator failed for ([203.189.124.10]) [203.189.124.10]:34752: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.180.114.229
description:
Feb  4 22:33:21 ait sshd[192503]: pam_imunify(sshd:auth): [IM360_RBL] The IP 47.180.114.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.252.153.14
description:
Feb  4 22:33:24 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.252.153.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.175.194.139
description:
Feb  4 22:32:34 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.175.194.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.175.194.139
description:
2025-02-04 22:32:36 dovecot_plain authenticator failed for syn-072-175-194-139.res.spectrum.com [72.175.194.139]:30678: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 47.180.114.229
description:
Feb  4 22:33:21 ait sshd[192503]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.180.114.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.252.153.14
description:
2025-02-04 22:33:26 dovecot_plain authenticator failed for (localhost) [5.252.153.14]:55957: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.54.16.62
description:
Feb  4 22:33:28 ait sshd[192641]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.54.16.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.10
description:
Feb  4 22:32:46 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.54.16.62
description:
Feb  4 22:33:28 ait sshd[192641]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.54.16.62


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.54.16.62
description:
Feb  4 22:33:31 ait sshd[192641]: Disconnected from invalid user ajarami 103.54.16.62 port 57142 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.238.81.99
description:
[2025-02-04 22:34:08 +0100] info [webmaild] 170.238.81.99 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.84.181.93
description:
[2025-02-04 22:33:32 +0100] info [webmaild] 187.84.181.93 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.79.234.83
domain: ijbit.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/admin/upload/css.php||SC:/home/titlemas/public_html/ijbit.us/admin


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 13.79.234.83
domain: ijbit.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:22-33.13.79.234.83||RSV:6.65||T:APACHE||


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-34.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.231.34.22
description:
[2025-02-04 22:34:36 +0100] info [webmaild] 170.231.34.22 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.96.218.12
description:
[2025-02-04 22:35:08 +0100] info [webmaild] 179.96.218.12 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.127.197.89
description:
Feb  4 22:35:26 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.127.197.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.127.197.89
description:
2025-02-04 22:35:28 dovecot_login authenticator failed for (179.127.197.89.afinet.com.br) [179.127.197.89]:58424: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.226.122
description:
Feb  4 22:35:56 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.226.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.200.51
description:
2025-02-04 22:36:05 dovecot_plain authenticator failed for mail.infologic.co.il [85.130.200.51]:60374: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.207.24
description:
2025-02-04 22:36:12 dovecot_login authenticator failed for syn-076-176-207-024.res.spectrum.com [76.176.207.24]:49677: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.1.40.151
description:
Feb  4 22:35:39 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.1.40.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
description:
2025-02-04 22:35:41 dovecot_login authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:39617: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.122
description:
2025-02-04 22:35:58 dovecot_login authenticator failed for ([61.185.226.122]) [61.185.226.122]:59653: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
description:
2025-02-04 22:36:16 dovecot_login authenticator failed for ([117.247.239.202]) [117.247.239.202]:58960: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Feb  4 22:35:39 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.63.175
description:
2025-02-04 22:35:57 dovecot_login authenticator failed for ([182.135.63.175]) [182.135.63.175]:60391: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.168.226
description:
2025-02-04 22:36:00 dovecot_login authenticator failed for (200-217-53-25.host.telemar.net.br) [200.216.168.226]:55385: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.239.202
description:
Feb  4 22:36:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.239.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.63.175
description:
Feb  4 22:35:55 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.63.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.200.51
description:
Feb  4 22:36:03 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.200.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.189.232
description:
2025-02-04 22:35:41 dovecot_plain authenticator failed for (host-232.185.15.189.0.0xffffff00.STERLING.stercom.ru) [185.15.189.232]:58684: 535 Incorrect authentication data (set_id=ds18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.177.88.96
description:
Feb  4 22:35:54 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.177.88.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.96
description:
2025-02-04 22:35:56 dovecot_login authenticator failed for ([186.177.88.96]) [186.177.88.96]:57591: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.189
description:
2025-02-04 22:36:14 dovecot_login authenticator failed for ([60.167.19.189]) [60.167.19.189]:55299: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.232.114.71
description:
Feb  4 22:36:28 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.232.114.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.115.76.186
description:
Feb  4 22:35:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.115.76.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.115.76.186
description:
2025-02-04 22:35:33 dovecot_plain authenticator failed for ool-45734cba.dyn.optonline.net [69.115.76.186]:37894: 535 Incorrect authentication data (set_id=ds18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.216.168.226
description:
Feb  4 22:35:58 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.216.168.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.207.24
description:
Feb  4 22:36:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.207.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.134.3.252
description:
Feb  4 22:36:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.134.3.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.3.252
description:
2025-02-04 22:36:16 dovecot_plain authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:32900: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.198.68.146
description:
[2025-02-04 22:36:18 +0100] info [webmaild] 181.198.68.146 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.232.114.71
description:
2025-02-04 22:36:30 dovecot_plain authenticator failed for (189-108-96-183.customer.tdatabrasil.net.br) [200.232.114.71]:57394: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.189.232
description:
Feb  4 22:35:39 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.189.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-02-04 22:35:41 dovecot_login authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:47926: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.189
description:
Feb  4 22:36:12 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.167.59
description:
Feb  4 22:36:44 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.167.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.54.16.62
description:
Feb  4 22:36:45 ait sshd[194083]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.54.16.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.180.114.229
description:
Feb  4 22:36:49 ait sshd[194207]: pam_imunify(sshd:auth): [IM360_RBL] The IP 47.180.114.229 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 47.180.114.229
description:
Feb  4 22:36:49 ait sshd[194207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.180.114.229


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.54.16.62
description:
Feb  4 22:36:45 ait sshd[194083]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.54.16.62


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.167.59
description:
2025-02-04 22:36:46 dovecot_plain authenticator failed for ([111.39.167.59]) [111.39.167.59]:33375: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.205.29.217
description:
[2025-02-04 22:36:52 +0100] info [webmaild] 168.205.29.217 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.32.111.108
description:
[2025-02-04 22:37:11 +0100] info [webmaild] 190.32.111.108 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.54.16.62
description:
Feb  4 22:37:52 ait sshd[194516]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.54.16.62 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.54.16.62
description:
Feb  4 22:37:54 ait sshd[194516]: Failed password for invalid user abdel from 103.54.16.62 port 55176 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
description:
2025-02-04 22:38:16 dovecot_plain authenticator failed for ([196.191.212.236]) [213.55.85.202]:23225: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.75.227.38
description:
2025-02-04 22:38:21 dovecot_plain authenticator failed for 128-75-227-38.broadband.corbina.ru [128.75.227.38]:40920: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.50.134.183
description:
Feb  4 22:38:22 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.50.134.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.127.114
description:
2025-02-04 22:38:29 dovecot_plain authenticator failed for ([178.178.127.114]) [178.178.127.114]:52214: 535 Incorrect authentication data (set_id=ads21a00042y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.180.114.229
description:
Feb  4 22:37:59 ait sshd[194592]: pam_imunify(sshd:auth): [IM360_RBL] The IP 47.180.114.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.250.225.23
description:
Feb  4 22:38:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.250.225.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.50.134.183
description:
2025-02-04 22:38:24 dovecot_login authenticator failed for ([77.50.134.183]) [77.50.134.183]:51512: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.127.114
description:
Feb  4 22:38:27 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.127.114 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 81.200.16.175
description:
[2025-02-04 22:37:43 +0100] info [webmaild] 81.200.16.175 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.54.16.62
description:
Feb  4 22:37:52 ait sshd[194516]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.54.16.62


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
description:
Feb  4 22:38:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.120.192.105
description:
Feb  4 22:38:24 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.120.192.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.120.192.105
description:
2025-02-04 22:38:26 dovecot_plain authenticator failed for (109-120-192-105.ip.btc-net.bg) [109.120.192.105]:35741: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 47.180.114.229
description:
Feb  4 22:37:59 ait sshd[194592]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.180.114.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.250.225.23
description:
2025-02-04 22:38:12 dovecot_login authenticator failed for syn-172-250-225-023.res.spectrum.com [172.250.225.23]:36280: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.75.227.38
description:
Feb  4 22:38:19 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.75.227.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.177.247.242
description:
Feb  4 22:38:48 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.177.247.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.218.134.95
description:
Feb  4 22:39:00 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.218.134.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.100.186.71
description:
2025-02-04 22:39:28 dovecot_plain authenticator failed for syn-172-100-186-071.res.spectrum.com [172.100.186.71]:36506: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-02-04 22:39:31 dovecot_login authenticator failed for ([14.88.228.202]) [14.88.228.202]:51052: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.177.247.242
description:
2025-02-04 22:38:50 dovecot_login authenticator failed for (host-247342.fivenetwork.com) [202.177.247.242]:56324: 535 Incorrect authentication data (set_id=eng38b22452y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.114.180.50
description:
Feb  4 22:39:22 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.114.180.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.100.186.71
description:
Feb  4 22:39:26 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.100.186.71 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.83.211.234
description:
[2025-02-04 22:38:59 +0100] info [webmaild] 189.83.211.234 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.38.211.155
description:
2025-02-04 22:39:28 dovecot_login authenticator failed for p383156-obmd01.tokyo.ocn.ne.jp [60.38.211.155]:33470: 535 Incorrect authentication data (set_id=ads39a22282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Feb  4 22:39:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.218.134.95
description:
2025-02-04 22:39:02 dovecot_login authenticator failed for 32-218-134-95.bng02.trtn.ct.frontiernet.net [32.218.134.95]:45132: 535 Incorrect authentication data (set_id=eng38b22452y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.180.50
description:
2025-02-04 22:39:24 dovecot_plain authenticator failed for ([124.114.180.50]) [124.114.180.50]:50920: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.38.211.155
description:
Feb  4 22:39:26 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.38.211.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.183.72.25
description:
Feb  4 22:40:05 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.183.72.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.39.128
description:
Feb  4 22:40:16 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.39.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.164.235.208
description:
2025-02-04 22:39:45 dovecot_plain authenticator failed for (208.235.164.124.adsl-pool.sx.cn) [124.164.235.208]:49842: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.132.229.196
description:
2025-02-04 22:39:56 dovecot_login authenticator failed for ([185.132.229.196]) [185.132.229.196]:51344: 535 Incorrect authentication data (set_id=abs65b11556y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.132.229.196
description:
Feb  4 22:39:54 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.132.229.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.183.72.25
description:
2025-02-04 22:40:07 dovecot_login authenticator failed for (triband-mum-59.183.72.25.mtnl.net.in) [59.183.72.25]:38591: 535 Incorrect authentication data (set_id=abs65b11556y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.237.145.18
description:
2025-02-04 22:40:16 dovecot_login authenticator failed for ([186.237.145.18]) [186.237.145.18]:33025: 535 Incorrect authentication data (set_id=ads39a22282y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.123.216.2
description:
[2025-02-04 22:39:35 +0100] info [webmaild] 38.123.216.2 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.60.13
description:
2025-02-04 22:39:45 dovecot_plain authenticator failed for ([112.196.60.13]) [112.196.60.13]:59600: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 22:40:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 67.230.43.154
description:
[2025-02-04 22:40:13 +0100] info [webmaild] 67.230.43.154 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.196.30.122
description:
Feb  4 22:40:20 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.196.30.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.196.30.122
description:
2025-02-04 22:40:22 dovecot_login authenticator failed for ([103.196.30.122]) [103.196.30.122]:37491: 535 Incorrect authentication data (set_id=ads76a66686y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.196.60.13
description:
Feb  4 22:39:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.196.60.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.95.150.16
description:
2025-02-04 22:40:03 dovecot_login authenticator failed for syn-070-095-150-016.res.spectrum.com [70.95.150.16]:53802: 535 Incorrect authentication data (set_id=eng19b00195y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.72.103.74
description:
Feb  4 22:39:45 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.72.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.103.74
description:
2025-02-04 22:39:47 dovecot_login authenticator failed for ([27.72.103.74]) [27.72.103.74]:62776: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.95.150.16
description:
Feb  4 22:40:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.95.150.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.237.145.18
description:
Feb  4 22:40:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.237.145.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.39.128
description:
2025-02-04 22:40:18 dovecot_login authenticator failed for ([158.140.39.128]) [158.140.39.128]:36540: 535 Incorrect authentication data (set_id=eng19b00195y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.106.195.20
description:
[2025-02-04 22:39:40 +0100] info [webmaild] 200.106.195.20 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.164.235.208
description:
Feb  4 22:39:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.164.235.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.210.74.19
description:
Feb  4 22:40:45 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.210.74.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.210.74.19
description:
2025-02-04 22:40:47 dovecot_login authenticator failed for ([175.210.74.19]) [175.210.74.19]:60160: 535 Incorrect authentication data (set_id=ads76a66686y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.103.142
description:
2025-02-04 22:41:28 dovecot_plain authenticator failed for ([58.18.103.142]) [58.18.103.142]:46648: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.91.74.187
description:
2025-02-04 22:41:29 dovecot_plain authenticator failed for ([103.91.74.187]) [103.91.74.187]:44840: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.212.19.9
description:
Feb  4 22:41:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.212.19.9 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.178.200.239
description:
Feb  4 22:41:23 ait sshd[196047]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.178.200.239  user=lemsas


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.91.74.187
description:
Feb  4 22:41:27 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.91.74.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.58
description:
Feb  4 22:41:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.200.239
description:
Feb  4 22:41:23 ait sshd[196047]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.178.200.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.103.142
description:
Feb  4 22:41:26 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.103.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.35.66.243
description:
2025-02-04 22:41:21 dovecot_plain authenticator failed for ([4.35.66.243]) [4.35.66.243]:53841: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.24.154.232
description:
Feb  4 22:40:59 ait sshd[195963]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.24.154.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.58
description:
2025-02-04 22:41:12 dovecot_plain authenticator failed for ([178.178.222.58]) [178.178.222.58]:42232: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.100
description:
Feb  4 22:41:12 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
description:
Feb  4 22:41:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.212.19.9
description:
2025-02-04 22:41:16 dovecot_plain authenticator failed for ([116.212.19.9]) [116.212.19.9]:52268: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 22:41:19 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.24.154.232
description:
Feb  4 22:40:59 ait sshd[195963]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.24.154.232  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-02-04 22:41:16 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:40648: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.100
description:
2025-02-04 22:41:14 dovecot_plain authenticator failed for (m121-202-154-100.smartone.com) [121.202.154.100]:62349: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.35.66.243
description:
Feb  4 22:41:19 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 4.35.66.243 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.97.132.7
description:
Feb  4 22:41:21 ait sshd[196041]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.97.132.7


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.145.108.234
description:
Feb  4 22:41:52 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.145.108.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.146
description:
2025-02-04 22:42:07 dovecot_plain authenticator failed for ([185.255.212.146]) [185.255.212.146]:59445: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.200.227.194
description:
Feb  4 22:42:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.200.227.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.87.152.161
description:
2025-02-04 22:42:20 dovecot_plain authenticator failed for (194.87.152.161-FTTB.planeta.tc) [194.87.152.161]:58518: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.9.74
description:
Feb  4 22:42:22 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.9.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.112.207.146
description:
Feb  4 22:41:38 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.112.207.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.221.133.6
description:
2025-02-04 22:41:55 dovecot_login authenticator failed for 6-133-221-131.dynamic.v1telecom.com.br [131.221.133.6]:40026: 535 Incorrect authentication data (set_id=eng19b00195y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.18.55.49
description:
Feb  4 22:42:17 ait sshd[196387]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.18.55.49  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
description:
2025-02-04 22:42:16 dovecot_plain authenticator failed for ([106.245.246.26]) [106.245.246.26]:40806: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
description:
Feb  4 22:42:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.245.246.26
description:
Feb  4 22:42:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.245.246.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.131
description:
2025-02-04 22:42:22 dovecot_plain authenticator failed for ([27.40.100.131]) [27.40.100.131]:57207: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.11.207
description:
Feb  4 22:42:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.11.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.203.245.102
description:
Feb  4 22:42:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.203.245.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
description:
2025-02-04 22:42:11 dovecot_plain authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:57814: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.126.185
description:
Feb  4 22:42:17 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.126.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.245.102
description:
2025-02-04 22:42:25 dovecot_plain authenticator failed for ([175.203.245.102]) [175.203.245.102]:34104: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.81.208.4
description:
2025-02-04 22:42:29 dovecot_plain authenticator failed for ([103.81.208.4]) [103.81.208.4]:58162: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.201.37
description:
Feb  4 22:41:46 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.201.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.233.77.125
description:
Feb  4 22:42:18 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.233.77.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.133.10.204
description:
Feb  4 22:42:22 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.133.10.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.77.25.247
description:
Feb  4 22:41:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.77.25.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.29.196.170
description:
2025-02-04 22:42:09 dovecot_plain authenticator failed for ([71.29.196.170]) [71.29.196.170]:51040: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.243.43.30
description:
2025-02-04 22:42:16 dovecot_plain authenticator failed for ([211.243.43.30]) [211.243.43.30]:59568: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.131
description:
Feb  4 22:42:20 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.77.25.247
description:
2025-02-04 22:41:34 dovecot_plain authenticator failed for (static-76-77-25-247.networklubbock.net) [76.77.25.247]:51040: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.229.202
description:
Feb  4 22:42:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.229.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.208.71.101
description:
Feb  4 22:42:15 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.208.71.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.87.152.161
description:
Feb  4 22:42:18 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.87.152.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.126.227
description:
Feb  4 22:41:56 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.126.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.193.83
description:
2025-02-04 22:42:13 dovecot_plain authenticator failed for (mobile-166-195-193-083.mycingular.net) [166.195.193.83]:35574: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.124.241.142
description:
2025-02-04 22:42:14 dovecot_plain authenticator failed for ([116.124.241.142]) [116.124.241.142]:54034: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.122.138
description:
2025-02-04 22:42:26 dovecot_plain authenticator failed for (abts-north-static-x.138.122.163.122.airtelbroadband.in) [122.163.122.138]:49588: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.27.234.178
description:
Feb  4 22:42:27 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.27.234.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.53
description:
Feb  4 22:42:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.29.196.170
description:
Feb  4 22:42:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.29.196.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.187.146.68
description:
2025-02-04 22:42:09 dovecot_plain authenticator failed for ([38.187.146.68]) [38.187.146.68]:50987: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.178.251.33
description:
Feb  4 22:42:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.178.251.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.9.74
description:
2025-02-04 22:42:24 dovecot_plain authenticator failed for (200151009074.userdial.telemar.net.br) [200.151.9.74]:46110: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.223.154.170
description:
Feb  4 22:41:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.223.154.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.124.241.142
description:
Feb  4 22:42:12 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.124.241.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.210.170
description:
Feb  4 22:42:25 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.210.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.27.234.178
description:
2025-02-04 22:42:29 dovecot_login authenticator failed for ([71.27.234.178]) [71.27.234.178]:48272: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.112.207.146
description:
2025-02-04 22:41:40 dovecot_login authenticator failed for p164147-obmd01.osaka.ocn.ne.jp [61.112.207.146]:38709: 535 Incorrect authentication data (set_id=eng19b00195y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.233.21.109
description:
Feb  4 22:42:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.233.21.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.20.9
description:
2025-02-04 22:42:20 dovecot_plain authenticator failed for (dynamicip-95-79-20-9.pppoe.nn.ertelecom.ru) [95.79.20.9]:59712: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
description:
2025-02-04 22:42:27 dovecot_plain authenticator failed for ([185.255.212.178]) [185.255.212.178]:2400: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.218.133.106
description:
Feb  4 22:42:30 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.218.133.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.223.154.170
description:
2025-02-04 22:41:34 dovecot_plain authenticator failed for ([102.223.154.170]) [102.223.154.170]:56876: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.253.90.113
description:
Feb  4 22:42:11 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.253.90.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.71.101
description:
2025-02-04 22:42:17 dovecot_plain authenticator failed for ([82.208.71.101]) [82.208.71.101]:50012: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.224.159.218
description:
2025-02-04 22:42:23 dovecot_plain authenticator failed for ([221.224.159.218]) [221.224.159.218]:49918: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.82.12.128
description:
Feb  4 22:42:11 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.82.12.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.86.48
description:
2025-02-04 22:42:31 dovecot_plain authenticator failed for ([94.205.86.48]) [94.205.86.48]:35003: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.121
description:
Feb  4 22:42:04 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.255.45
description:
Feb  4 22:42:12 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.255.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.255.45
description:
2025-02-04 22:42:14 dovecot_plain authenticator failed for (27-123-255-45-mcnbd.com) [27.123.255.45]:41469: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.224.159.218
description:
Feb  4 22:42:21 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.224.159.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.138
description:
Feb  4 22:42:22 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.145.108.234
description:
2025-02-04 22:41:54 dovecot_login authenticator failed for ([216.145.108.234]) [216.145.108.234]:58389: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.53
description:
2025-02-04 22:42:09 dovecot_plain authenticator failed for ([65.20.251.53]) [65.20.251.53]:59621: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.82
description:
2025-02-04 22:42:11 dovecot_plain authenticator failed for (m121-202-152-82.smartone.com) [121.202.152.82]:10059: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.58.130.22
description:
2025-02-04 22:42:11 dovecot_plain authenticator failed for ([58.58.130.22]) [58.58.130.22]:57018: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.229.202
description:
2025-02-04 22:42:11 dovecot_plain authenticator failed for ([124.115.229.202]) [124.115.229.202]:59023: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.82
description:
Feb  4 22:42:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
description:
2025-02-04 22:42:11 dovecot_plain authenticator failed for ([186.247.238.25]) [200.149.51.186]:34472: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-02-04 22:42:17 dovecot_login authenticator failed for ([203.81.213.46]) [203.81.213.46]:38456: 535 Incorrect authentication data (set_id=ads22a00155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
description:
2025-02-04 22:42:29 dovecot_plain authenticator failed for ([203.128.181.121]) [203.128.181.121]:43267: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.141.194.159
description:
Feb  4 22:42:12 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.141.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.101.204.242
description:
Feb  4 22:42:30 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.101.204.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.187.146.68
description:
Feb  4 22:42:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.187.146.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.193.168.181
description:
Feb  4 22:42:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.193.168.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.178.251.33
description:
2025-02-04 22:42:12 dovecot_plain authenticator failed for ([210.178.251.33]) [210.178.251.33]:58646: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.86.48
description:
Feb  4 22:42:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.86.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.65.1.179
description:
Feb  4 22:42:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.65.1.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.53.126.112
description:
2025-02-04 22:42:24 dovecot_plain authenticator failed for ([14.53.126.112]) [14.53.126.112]:56602: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.146
description:
Feb  4 22:42:05 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.175
description:
Feb  4 22:42:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.121
description:
2025-02-04 22:42:06 dovecot_plain authenticator failed for ([185.167.58.121]) [185.167.58.121]:55832: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 85.130.150.71
description:
Feb  4 22:42:12 ait sshd[196350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.130.150.71  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.247.85
description:
2025-02-04 22:42:20 dovecot_login authenticator failed for ([183.220.247.85]) [183.220.247.85]:34990: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.126.227
description:
2025-02-04 22:41:58 dovecot_plain authenticator failed for ([114.108.126.227]) [114.108.126.227]:33214: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.92.248
description:
Feb  4 22:42:16 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.92.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.210.170
description:
2025-02-04 22:42:27 dovecot_plain authenticator failed for ([113.64.210.170]) [113.64.210.170]:39745: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.211
description:
Feb  4 22:42:20 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.215.241
description:
Feb  4 22:42:08 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.215.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.181
description:
2025-02-04 22:42:09 dovecot_plain authenticator failed for ([203.193.168.181]) [203.193.168.181]:55170: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.243.43.30
description:
Feb  4 22:42:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.243.43.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.230.214
description:
Feb  4 22:42:18 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.230.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.185
description:
2025-02-04 22:42:19 dovecot_plain authenticator failed for ([196.189.126.185]) [196.189.126.185]:46002: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.206.24.234
description:
Feb  4 22:42:08 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.206.24.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.93
description:
2025-02-04 22:42:10 dovecot_plain authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:46711: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.138
description:
2025-02-04 22:42:24 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:40531: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.24.185.98
description:
Feb  4 22:42:28 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.24.185.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.93.134
description:
2025-02-04 22:42:31 dovecot_plain authenticator failed for ([211.109.93.134]) [211.109.93.134]:35002: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.58.130.22
description:
Feb  4 22:42:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.58.130.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.121.199.203
description:
Feb  4 22:42:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.121.199.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
description:
2025-02-04 22:42:13 dovecot_plain authenticator failed for 89-253-90-113.customers.ownit.se [89.253.90.113]:48890: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
description:
Feb  4 22:42:25 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.18.55.49
description:
Feb  4 22:42:17 ait sshd[196387]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.18.55.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.188.246.161
description:
[2025-02-04 22:42:28 +0100] info [webmaild] 181.188.246.161 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.175
description:
2025-02-04 22:42:09 dovecot_plain authenticator failed for ([121.202.153.175]) [121.202.153.175]:52494: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.247.85
description:
Feb  4 22:42:18 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.247.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
description:
2025-02-04 22:42:22 dovecot_plain authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:43964: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
description:
Feb  4 22:42:27 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.93.134
description:
Feb  4 22:42:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.93.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.82.12.128
description:
2025-02-04 22:42:13 dovecot_plain authenticator failed for (50-82-12-128.client.mchsi.com) [50.82.12.128]:39624: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Feb  4 22:42:15 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.20.9
description:
Feb  4 22:42:18 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.20.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.53.126.112
description:
Feb  4 22:42:22 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.53.126.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.163.122.138
description:
Feb  4 22:42:24 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.163.122.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.133.10.204
description:
2025-02-04 22:42:24 dovecot_plain authenticator failed for ([61.133.10.205]) [61.133.10.204]:51840: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.209.214.51
description:
[2025-02-04 22:41:53 +0100] info [webmaild] 186.209.214.51 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.169.209.141
description:
Feb  4 22:42:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.169.209.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.169.209.141
description:
2025-02-04 22:42:11 dovecot_plain authenticator failed for 141.sub-166-169-209.myvzw.com [166.169.209.141]:45605: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.11.207
description:
2025-02-04 22:42:15 dovecot_plain authenticator failed for broadband-5-228-11-207.ip.moscow.rt.ru [5.228.11.207]:54852: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.92.248
description:
2025-02-04 22:42:18 dovecot_plain authenticator failed for ([106.51.92.248]) [106.51.92.248]:51230: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.93
description:
Feb  4 22:42:08 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.215.241
description:
2025-02-04 22:42:10 dovecot_plain authenticator failed for ([58.16.215.241]) [58.16.215.241]:51084: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.81.208.4
description:
Feb  4 22:42:27 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.81.208.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.147.98.39
description:
Feb  4 22:42:28 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.147.98.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.98.39
description:
2025-02-04 22:42:30 dovecot_plain authenticator failed for ([203.147.98.39]) [203.147.98.39]:47399: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.65.1.179
description:
2025-02-04 22:42:31 dovecot_plain authenticator failed for ([49.65.1.179]) [49.65.1.179]:3777: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.146.201.37
description:
2025-02-04 22:41:48 dovecot_plain authenticator failed for ([221.146.201.37]) [221.146.201.37]:46938: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.227.194
description:
2025-02-04 22:42:09 dovecot_plain authenticator failed for ([196.200.227.78]) [196.200.227.194]:52920: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
description:
2025-02-04 22:42:11 dovecot_plain authenticator failed for ([109.233.21.109]) [109.233.21.109]:33208: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
description:
2025-02-04 22:42:10 dovecot_plain authenticator failed for ([210.206.24.238]) [210.206.24.234]:14418: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.77.125
description:
2025-02-04 22:42:20 dovecot_plain authenticator failed for ([80.233.77.125]) [80.233.77.125]:64885: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.193.83
description:
Feb  4 22:42:11 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.193.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.141.194.159
description:
2025-02-04 22:42:14 dovecot_plain authenticator failed for ([121.141.194.159]) [121.141.194.159]:53402: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.230.214
description:
2025-02-04 22:42:20 dovecot_plain authenticator failed for ([94.204.230.214]) [94.204.230.214]:44487: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.177.236.30
description:
[2025-02-04 22:42:28 +0100] info [webmaild] 160.177.236.30 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.24.185.98
description:
2025-02-04 22:42:30 dovecot_plain authenticator failed for ([217.24.185.98]) [217.24.185.98]:37976: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.194.181.238
description:
2025-02-04 22:42:33 dovecot_plain authenticator failed for ([175.194.181.238]) [175.194.181.238]:54971: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.238.94
description:
2025-02-04 22:42:35 dovecot_plain authenticator failed for 186-247-238-94.user.veloxzone.com.br (186-247-238-241.user.veloxzone.com.br) [186.247.238.94]:54892: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.222.90.178
description:
2025-02-04 22:42:38 dovecot_plain authenticator failed for ([200.222.80.81]) [200.222.90.178]:34657: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.35
description:
Feb  4 22:43:26 ait sshd[196856]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.35


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.244.126.105
description:
Feb  4 22:43:27 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.244.126.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
description:
2025-02-04 22:43:29 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (commots) [92.244.126.105]:50220: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.151.218.110
description:
Feb  4 22:42:32 ait sshd[196467]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.151.218.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.16.156.103
description:
2025-02-04 22:42:45 dovecot_plain authenticator failed for (173-16-156-103.client.mchsi.com) [173.16.156.103]:39598: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.232.39.165
description:
2025-02-04 22:43:06 dovecot_login authenticator failed for ([185.232.39.165]) [185.232.39.165]:50742: 535 Incorrect authentication data (set_id=ads23b00195y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.98.208.115
description:
Feb  4 22:43:20 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.98.208.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.140.95.250
description:
2025-02-04 22:43:27 dovecot_login authenticator failed for ([113.140.95.250]) [113.140.95.250]:37314: 535 Incorrect authentication data (set_id=ads23b00195y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
description:
2025-02-04 22:43:25 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:35492: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.140.95.250
description:
Feb  4 22:43:25 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.140.95.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.9
description:
Feb  4 22:42:40 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.127.124.229
description:
2025-02-04 22:42:49 dovecot_plain authenticator failed for 229.red-217-127-124.staticip.rima-tde.net [217.127.124.229]:46139: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.56.107.53
description:
Feb  4 22:42:55 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.56.107.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.33.171.65
description:
Feb  4 22:43:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.33.171.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.125.43
description:
Feb  4 22:43:24 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.125.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.194.181.238
description:
Feb  4 22:42:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.194.181.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.227.203
description:
2025-02-04 22:42:35 dovecot_plain authenticator failed for ([118.70.227.203]) [118.70.227.203]:56696: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.248.55
description:
Feb  4 22:42:41 ait sshd[196587]: pam_imunify(sshd:auth): [IM360_RBL] The IP 209.38.248.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 22:42:49 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.72.14.152
description:
Feb  4 22:43:25 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.72.14.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.181.74
description:
Feb  4 22:42:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.181.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.101.204.242
description:
2025-02-04 22:42:32 dovecot_plain authenticator failed for ([112.101.204.242]) [112.101.204.242]:47818: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
description:
2025-02-04 22:42:34 dovecot_plain authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:34178: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.194.8
description:
Feb  4 22:42:33 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.194.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.212.219
description:
Feb  4 22:42:37 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.212.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.248.149.139
description:
Feb  4 22:42:37 ait sshd[196497]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.149.139  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
description:
2025-02-04 22:43:15 dovecot_plain authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:42826: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.125.43
description:
2025-02-04 22:43:26 dovecot_plain authenticator failed for ([14.37.125.43]) [14.37.125.43]:60548: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.218.133.106
description:
2025-02-04 22:42:32 dovecot_plain authenticator failed for ([103.218.133.106]) [103.218.133.106]:51835: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.181.74
description:
2025-02-04 22:42:33 dovecot_plain authenticator failed for ([103.65.227.71]) [114.130.181.74]:39085: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.207.248.5
description:
Feb  4 22:42:35 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.207.248.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.9
description:
2025-02-04 22:42:42 dovecot_login authenticator failed for ([185.167.58.9]) [185.167.58.9]:60478: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.253.37
description:
2025-02-04 22:42:51 dovecot_plain authenticator failed for ([218.22.253.37]) [218.22.253.37]:58608: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.16.156.103
description:
Feb  4 22:42:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.16.156.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.91.96.58
description:
Feb  4 22:43:11 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.91.96.58 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 132.148.77.70
description:
Feb  4 22:43:26 ait sshd[196858]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.148.77.70  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.63
description:
Feb  4 22:42:37 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.89.60.158
description:
2025-02-04 22:42:39 dovecot_plain authenticator failed for ([124.89.60.158]) [124.89.60.158]:37137: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 209.38.248.55
description:
Feb  4 22:42:41 ait sshd[196587]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.248.55  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.158.224
description:
[2025-02-04 22:42:56 +0100] info [webmaild] 179.125.158.224 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.146.201.37
description:
2025-02-04 22:42:56 dovecot_plain authenticator failed for ([221.146.201.37]) [221.146.201.37]:49749: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.73.242
description:
Feb  4 22:43:00 ait sshd[196758]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.37.73.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 132.148.77.70
description:
Feb  4 22:43:26 ait sshd[196858]: pam_imunify(sshd:auth): [IM360_RBL] The IP 132.148.77.70 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.151.218.110
description:
Feb  4 22:42:32 ait sshd[196467]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.151.218.110


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
description:
Feb  4 22:42:46 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.127.124.229
description:
Feb  4 22:42:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.127.124.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.56.107.53
description:
2025-02-04 22:42:57 dovecot_plain authenticator failed for ([191.56.107.53]) [191.56.107.53]:52097: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.91.96.58
description:
2025-02-04 22:43:13 dovecot_login authenticator failed for ([222.91.96.58]) [222.91.96.58]:50995: 535 Incorrect authentication data (set_id=ads23b00195y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.194.8
description:
2025-02-04 22:42:35 dovecot_plain authenticator failed for ([183.247.194.8]) [183.247.194.8]:44002: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.89.60.158
description:
Feb  4 22:42:37 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.89.60.158 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.37.73.242
description:
Feb  4 22:43:00 ait sshd[196758]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.37.73.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.175.76.146
description:
Feb  4 22:43:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.175.76.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.72.14.152
description:
2025-02-04 22:43:27 dovecot_login authenticator failed for (76-72-14-152.swr.dyn.lusfiber.net) [76.72.14.152]:60423: 535 Incorrect authentication data (set_id=ads23b00195y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.227.203
description:
Feb  4 22:42:33 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.227.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.98.208.115
description:
2025-02-04 22:43:22 dovecot_plain authenticator failed for ([201.98.208.115]) [201.98.208.115]:59446: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.94.190
description:
2025-02-04 22:42:45 dovecot_login authenticator failed for ([39.164.94.190]) [39.164.94.190]:45632: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
description:
2025-02-04 22:42:48 dovecot_plain authenticator failed for ([61.72.59.106]) [61.72.59.106]:39891: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.115.76.186
description:
2025-02-04 22:42:50 dovecot_plain authenticator failed for ool-45734cba.dyn.optonline.net [69.115.76.186]:40828: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.201.37
description:
Feb  4 22:42:54 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.201.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.94.190
description:
Feb  4 22:42:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.94.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.115.76.186
description:
Feb  4 22:42:48 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.115.76.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.248.7
description:
Feb  4 22:42:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.238.94
description:
Feb  4 22:42:33 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.238.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.222.90.178
description:
Feb  4 22:42:36 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.222.90.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
description:
2025-02-04 22:42:37 dovecot_plain authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:47717: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.63
description:
2025-02-04 22:42:39 dovecot_plain authenticator failed for (m121-202-154-63.smartone.com) [121.202.154.63]:62495: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
description:
2025-02-04 22:42:39 dovecot_plain authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:58031: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.232.39.165
description:
Feb  4 22:43:04 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.232.39.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.161.52.149
description:
Feb  4 22:44:11 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.161.52.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.174.182.38
description:
Feb  4 22:44:15 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.174.182.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.52.131.183
description:
2025-02-04 22:44:15 dovecot_plain authenticator failed for ([211.52.131.183]) [211.52.131.183]:59612: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.223.192.254
description:
Feb  4 22:43:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.223.192.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.144.82.250
description:
2025-02-04 22:43:40 dovecot_login authenticator failed for syn-098-144-082-250.res.spectrum.com [98.144.82.250]:57526: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.102
description:
Feb  4 22:43:58 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.102 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Feb  4 22:44:22 ait sshd[197510]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
description:
2025-02-04 22:43:38 dovecot_login authenticator failed for ([106.245.246.26]) [106.245.246.26]:55617: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.148.187.146
description:
Feb  4 22:44:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.148.187.146 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.229.118.208
description:
Feb  4 22:44:12 ait sshd[197485]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.229.118.208


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.102
description:
2025-02-04 22:44:00 dovecot_plain authenticator failed for ([121.202.152.102]) [121.202.152.102]:23471: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.206.205.23
description:
2025-02-04 22:44:01 dovecot_login authenticator failed for ([103.206.205.23]) [103.206.205.23]:35993: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 22:44:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.22.37.184
description:
2025-02-04 22:44:13 dovecot_login authenticator failed for ([217.22.37.184]) [217.22.37.184]:44620: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
description:
2025-02-04 22:44:13 dovecot_login authenticator failed for ([220.161.52.149]) [220.161.52.149]:34269: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.248.243.64
description:
Feb  4 22:43:57 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.248.243.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.248.243.64
description:
2025-02-04 22:43:59 dovecot_plain authenticator failed for ([87.248.243.64]) [87.248.243.64]:57902: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 59.56.18.8
description:
Feb  4 22:43:56 ait sshd[197420]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.56.18.8


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.22.37.184
description:
Feb  4 22:44:11 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.22.37.184 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.74.3
description:
[2025-02-04 22:44:30 +0100] info [webmaild] 213.230.74.3 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.233.166.200
description:
2025-02-04 22:44:00 dovecot_plain authenticator failed for ([183.233.166.200]) [183.233.166.200]:40346: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
description:
2025-02-04 22:44:02 dovecot_plain authenticator failed for ([171.244.63.170]) [171.244.63.170]:45724: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
description:
Feb  4 22:44:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-02-04 22:44:15 dovecot_plain authenticator failed for ([1.28.192.118]) [1.28.192.118]:60427: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.192.254
description:
2025-02-04 22:43:33 dovecot_plain authenticator failed for ([200.223.192.254]) [200.223.192.254]:50222: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.233.166.200
description:
Feb  4 22:43:58 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.233.166.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.206.205.23
description:
Feb  4 22:43:59 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.206.205.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.56.18.8
description:
Feb  4 22:43:56 ait sshd[197420]: pam_imunify(sshd:auth): [IM360_RBL] The IP 59.56.18.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.52.131.183
description:
Feb  4 22:44:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.52.131.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.229.118.208
description:
Feb  4 22:44:12 ait sshd[197485]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.229.118.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Feb  4 22:44:22 ait sshd[197510]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.245.246.26
description:
Feb  4 22:43:36 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.245.246.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.92.149.1
description:
Feb  4 22:43:46 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.92.149.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.92.149.1
description:
2025-02-04 22:43:48 dovecot_plain authenticator failed for ([157.92.149.1]) [157.92.149.1]:50702: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
description:
2025-02-04 22:44:17 dovecot_plain authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:58310: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.57
description:
2025-02-04 22:44:26 dovecot_login authenticator failed for ([180.71.9.57]) [180.71.9.57]:56822: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.71.9.57
description:
Feb  4 22:44:24 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.71.9.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.144.82.250
description:
Feb  4 22:43:38 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.144.82.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
description:
Feb  4 22:44:00 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.148.187.146
description:
2025-02-04 22:44:03 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.148.187.146]:37762: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.212.235.151
description:
Feb  4 22:44:45 ait sshd[197581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.212.235.151  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.167.139
description:
Feb  4 22:45:06 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.167.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.241.64.92
description:
Feb  4 22:45:16 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.241.64.92 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.0.34.96
description:
[2025-02-04 22:45:21 +0100] info [webmaild] 138.0.34.96 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.96.43.215
description:
Feb  4 22:44:40 ait sshd[197572]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.96.43.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
description:
2025-02-04 22:44:48 dovecot_plain authenticator failed for ([94.131.211.168]) [94.131.211.168]:59148: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.156.85
description:
Feb  4 22:45:03 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.156.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.131.211.168
description:
Feb  4 22:44:46 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.131.211.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.167.139
description:
2025-02-04 22:45:08 dovecot_login authenticator failed for (abts-kk-static-139.167.166.122.airtelbroadband.in) [122.166.167.139]:58256: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.5.135
description:
2025-02-04 22:45:27 dovecot_plain authenticator failed for ([46.44.5.135]) [46.44.5.135]:52494: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.96.43.215
description:
Feb  4 22:44:40 ait sshd[197572]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.43.215


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.209.109.213
description:
Feb  4 22:45:16 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.209.109.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.209.109.213
description:
2025-02-04 22:45:18 dovecot_plain authenticator failed for ([175.209.109.213]) [175.209.109.213]:35662: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.44.5.135
description:
Feb  4 22:45:25 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.44.5.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.68.142
description:
2025-02-04 22:45:21 dovecot_login authenticator failed for ([61.185.68.142]) [61.185.68.142]:42469: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.0.131
description:
Feb  4 22:44:55 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.0.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.0.131
description:
2025-02-04 22:44:57 dovecot_plain authenticator failed for ([123.212.0.131]) [123.212.0.131]:48828: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.213.111
description:
2025-02-04 22:45:01 dovecot_plain authenticator failed for ([65.20.213.111]) [65.20.213.111]:60651: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.156.85
description:
2025-02-04 22:45:05 dovecot_plain authenticator failed for (abts-north-static-085.156.160.122.airtelbroadband.in) [122.160.156.85]:58908: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 43.255.23.234
description:
[2025-02-04 22:44:50 +0100] info [webmaild] 43.255.23.234 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.213.111
description:
Feb  4 22:44:59 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.213.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.55.190.58
description:
[2025-02-04 22:45:04 +0100] info [webmaild] 191.55.190.58 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 65.21.58.141
description:
Feb  4 22:45:08 ait sshd[197928]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.21.58.141


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.68.142
description:
Feb  4 22:45:19 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.68.142 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 176.221.29.123
description:
Feb  4 22:44:41 ait sshd[197577]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.221.29.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.92
description:
2025-02-04 22:45:18 dovecot_plain authenticator failed for ([1.241.64.92]) [1.241.64.92]:59801: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.10.44.126
description:
Feb  4 22:45:46 ait sshd[198166]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.10.44.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.41
description:
Feb  4 22:45:58 ait sshd[198334]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.41 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.41
description:
Feb  4 22:45:58 ait sshd[198334]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.41


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 22:46:28 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.109.39.54
description:
Feb  4 22:45:53 ait sshd[198196]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.109.39.54 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.39.54
description:
Feb  4 22:45:53 ait sshd[198196]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.39.54


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.217.229
description:
Feb  4 22:46:16 ait sshd[198418]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.217.229 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.217.229
description:
Feb  4 22:46:16 ait sshd[198418]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.217.229


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.10.44.126
description:
Feb  4 22:45:46 ait sshd[198166]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.10.44.126


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.161.33.36
description:
[2025-02-04 22:47:10 +0100] info [webmaild] 45.161.33.36 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.218.200
description:
Feb  4 22:47:19 ait sshd[198780]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.218.200 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.218.200
description:
Feb  4 22:47:19 ait sshd[198780]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.218.200


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.206
description:
Feb  4 22:46:42 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.229.51.206
description:
2025-02-04 22:46:44 dovecot_login authenticator failed for ([58.229.51.206]) [58.229.51.206]:42226: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.231.75.69
description:
Feb  4 22:47:03 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.231.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.75.69
description:
2025-02-04 22:47:05 dovecot_login authenticator failed for ([49.231.75.69]) [49.231.75.69]:36277: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.216.37.11
description:
Feb  4 22:46:57 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.216.37.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.216.37.11
description:
2025-02-04 22:46:59 dovecot_login authenticator failed for ([60.216.37.11]) [60.216.37.11]:56834: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 22:47:37 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.251.202.80
description:
Feb  4 22:47:51 ait sshd[198888]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.251.202.80  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.107.169.132
description:
[2025-02-04 22:47:45 +0100] info [webmaild] 190.107.169.132 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.199.209.60
description:
2025-02-04 22:48:07 dovecot_login authenticator failed for (rw-0060-209.199.103.rcil.gov.in) [103.199.209.60]:50884: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.118.145.212
description:
Feb  4 22:48:19 ait sshd[199085]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.118.145.212


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.255.252.44
description:
Feb  4 22:47:32 ait sshd[198816]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.255.252.44 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.255.252.44
description:
Feb  4 22:47:32 ait sshd[198816]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.255.252.44  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.91.84.247
description:
[2025-02-04 22:48:03 +0100] info [webmaild] 181.91.84.247 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.199.209.60
description:
Feb  4 22:48:05 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.199.209.60 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.162.141.144
description:
[2025-02-04 22:47:30 +0100] info [webmaild] 188.162.141.144 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.93.87.71
description:
2025-02-04 22:47:36 dovecot_login authenticator failed for ([119.93.87.71]) [119.93.87.71]:44108: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.12.179
description:
Feb  4 22:47:45 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.12.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
description:
2025-02-04 22:47:47 dovecot_login authenticator failed for ([128.185.12.179]) [128.185.12.179]:48754: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 22:47:51 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.163
description:
Feb  4 22:47:57 ait sshd[198999]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.163 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.163
description:
Feb  4 22:47:57 ait sshd[198999]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.163  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.124.143.165
description:
Feb  4 22:49:11 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.124.143.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.21.141.54
description:
Feb  4 22:49:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.21.141.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.17.122
description:
2025-02-04 22:49:17 dovecot_plain authenticator failed for ([220.182.17.122]) [220.182.17.122]:37886: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.158.5.59
description:
2025-02-04 22:49:19 dovecot_plain authenticator failed for 47-158-5-59.lsan.ca.frontiernet.net [47.158.5.59]:63412: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.46.239
description:
2025-02-04 22:49:23 dovecot_plain authenticator failed for (abts-north-static-239.46.176.122.airtelbroadband.in) [122.176.46.239]:49314: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.161.197.130
description:
Feb  4 22:48:41 ait sshd[199290]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.161.197.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.35.200.202
description:
Feb  4 22:49:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.35.200.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.152.99.171
description:
Feb  4 22:49:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.152.99.171 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.18.55.49
description:
Feb  4 22:49:13 ait sshd[199514]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.18.55.49  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.18.55.49
description:
Feb  4 22:49:13 ait sshd[199514]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.18.55.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
description:
2025-02-04 22:49:12 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:57938: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.216.2.74
description:
2025-02-04 22:48:35 dovecot_plain authenticator failed for ([222.216.2.74]) [222.216.2.74]:59087: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.68.194.54
description:
Feb  4 22:49:01 ait sshd[199437]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.68.194.54  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.94.0.159
description:
Feb  4 22:49:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.94.0.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.69.142.186
description:
2025-02-04 22:49:25 dovecot_plain authenticator failed for 61-69-142-186.tpgi.com.au [61.69.142.186]:36333: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.124.143.165
description:
2025-02-04 22:49:13 dovecot_plain authenticator failed for ([92.124.143.165]) [92.124.143.165]:57157: 535 Incorrect authentication data (set_id=abs20a00063y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
description:
2025-02-04 22:49:15 dovecot_plain authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:51456: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.189.90
description:
2025-02-04 22:49:18 dovecot_plain authenticator failed for ([112.172.189.90]) [112.172.189.90]:36394: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.10.79.34
description:
2025-02-04 22:49:25 dovecot_plain authenticator failed for ([59.10.79.34]) [59.10.79.34]:42062: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.5.76.239
description:
Feb  4 22:48:55 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.5.76.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.171
description:
2025-02-04 22:49:15 dovecot_plain authenticator failed for syn-184-152-099-171.res.spectrum.com [184.152.99.171]:59836: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.168.131.3
description:
Feb  4 22:49:17 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.168.131.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
description:
Feb  4 22:49:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.10.79.34
description:
Feb  4 22:49:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.10.79.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.164.28
description:
2025-02-04 22:49:25 dovecot_plain authenticator failed for (abts-north-static-028.164.160.122.airtelbroadband.in) [122.160.164.28]:60672: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.176.46.239
description:
Feb  4 22:49:21 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.176.46.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.122
description:
Feb  4 22:49:25 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.7.10
description:
2025-02-04 22:49:25 dovecot_plain authenticator failed for ([120.194.7.10]) [120.194.7.10]:59059: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.216.2.74
description:
Feb  4 22:48:33 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.216.2.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.68.194.54
description:
Feb  4 22:49:01 ait sshd[199437]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.68.194.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.189.90
description:
Feb  4 22:49:16 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.189.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.168.131.3
description:
2025-02-04 22:49:19 dovecot_plain authenticator failed for ([60.168.131.3]) [60.168.131.3]:54866: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.44
description:
Feb  4 22:49:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.122
description:
2025-02-04 22:49:27 dovecot_plain authenticator failed for ([103.79.175.122]) [103.79.175.122]:33983: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.240.204.168
description:
Feb  4 22:49:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.240.204.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.192.242
description:
Feb  4 22:49:11 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.192.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.200.202
description:
2025-02-04 22:49:11 dovecot_plain authenticator failed for ([161.35.200.202]) [161.35.200.202]:43042: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.62.34.216
description:
Feb  4 22:49:17 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.62.34.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.242.204.22
description:
Feb  4 22:49:19 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.242.204.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.242.204.22
description:
2025-02-04 22:49:21 dovecot_plain authenticator failed for ([222.242.204.22]) [222.242.204.22]:3610: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.195.208.171
description:
Feb  4 22:48:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.195.208.171 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.22.214.214
description:
Feb  4 22:48:52 ait sshd[199307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.214.214


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.164.28
description:
Feb  4 22:49:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.164.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.208.171
description:
2025-02-04 22:48:45 dovecot_plain authenticator failed for ([221.195.72.195]) [221.195.208.171]:53370: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 22:49:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.158.5.59
description:
Feb  4 22:49:17 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.158.5.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.69.142.186
description:
Feb  4 22:49:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.69.142.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.7.10
description:
Feb  4 22:49:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.7.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.5.76.239
description:
2025-02-04 22:48:57 dovecot_plain authenticator failed for ([112.5.76.239]) [112.5.76.239]:56465: 535 Incorrect authentication data (set_id=abs20a00063y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.161.197.130
description:
Feb  4 22:48:41 ait sshd[199290]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.197.130


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.22.214.214
description:
Feb  4 22:48:52 ait sshd[199307]: pam_imunify(sshd:auth): [IM360_RBL] The IP 165.22.214.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.192.242
description:
2025-02-04 22:49:13 dovecot_plain authenticator failed for ([94.204.192.242]) [94.204.192.242]:45288: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.17.122
description:
Feb  4 22:49:15 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.17.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.21.141.54
description:
2025-02-04 22:49:16 dovecot_plain authenticator failed for ([125.21.141.54]) [125.21.141.54]:63900: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-48.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Feb  4 22:49:07 ait sshd[199488]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Feb  4 22:49:07 ait sshd[199488]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
description:
2025-02-04 22:49:19 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:46456: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.142.230.50
description:
2025-02-04 22:49:40 dovecot_plain authenticator failed for ([123.142.230.50]) [123.142.230.50]:54170: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Feb  4 22:49:42 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.183.103.117
description:
Feb  4 22:49:47 ait sshd[199616]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.103.117


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.168.58.245
description:
Feb  4 22:49:51 ait sshd[199618]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.168.58.245  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
description:
2025-02-04 22:49:31 dovecot_plain authenticator failed for ([103.147.248.44]) [103.147.248.44]:42590: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.212.68
description:
2025-02-04 22:49:32 dovecot_plain authenticator failed for ([111.39.212.68]) [111.39.212.68]:40454: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.131.46.146
description:
2025-02-04 22:49:39 dovecot_plain authenticator failed for ([61.131.46.146]) [61.131.46.146]:41466: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-02-04 22:49:43 dovecot_plain authenticator failed for ([112.111.61.229]) [112.111.61.229]:41322: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.191
description:
2025-02-04 22:49:55 dovecot_plain authenticator failed for 111-70-32-191.emome-ip.hinet.net [111.70.32.191]:39093: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.136.139.200
description:
Feb  4 22:50:27 ait sshd[200095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.136.139.200  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.3.42.103
description:
Feb  4 22:49:34 ait sshd[199593]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.3.42.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.48.181
description:
2025-02-04 22:49:39 dovecot_plain authenticator failed for broadband-37-110-48-181.ip.moscow.rt.ru [37.110.48.181]:35700: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-02-04 22:49:44 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:29258: 535 Incorrect authentication data (set_id=ads89b99891y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.101.204.242
description:
2025-02-04 22:49:45 dovecot_plain authenticator failed for ([112.101.204.242]) [112.101.204.242]:50793: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.252.38.24
description:
Feb  4 22:49:56 ait sshd[199654]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.252.38.24 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.252.38.24
description:
Feb  4 22:49:56 ait sshd[199654]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.252.38.24


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.4.116.9
description:
[2025-02-04 22:50:04 +0100] info [webmaild] 200.4.116.9 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.20.111.164
description:
Feb  4 22:49:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.20.111.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.151.19
description:
Feb  4 22:49:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.151.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.151.19
description:
2025-02-04 22:49:34 dovecot_plain authenticator failed for ([95.165.151.19]) [95.165.151.19]:48748: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.116.47.157
description:
Feb  4 22:49:52 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.116.47.157 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 194.55.143.134
description:
[2025-02-04 22:49:54 +0100] info [webmaild] 194.55.143.134 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.47.157
description:
2025-02-04 22:49:54 dovecot_plain authenticator failed for ([222.116.47.157]) [222.116.47.157]:55982: 535 Incorrect authentication data (set_id=ads89b99891y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.111.164
description:
2025-02-04 22:49:33 dovecot_plain authenticator failed for ([38.20.111.164]) [38.20.111.164]:40584: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.142.230.50
description:
Feb  4 22:49:38 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.142.230.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.168.58.245
description:
Feb  4 22:49:51 ait sshd[199618]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.168.58.245 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.15.58.66
description:
[2025-02-04 22:50:30 +0100] info [webmaild] 189.15.58.66 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.212.68
description:
Feb  4 22:49:30 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.212.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.240.204.168
description:
2025-02-04 22:49:31 dovecot_plain authenticator failed for 60-240-204-168.static.tpgi.com.au [60.240.204.168]:58009: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.183.103.117
description:
Feb  4 22:49:47 ait sshd[199616]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.183.103.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Feb  4 22:49:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.72.14.152
description:
2025-02-04 22:49:32 dovecot_plain authenticator failed for ([76.72.14.152]) [76.72.14.152]:57362: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.3.42.103
description:
Feb  4 22:49:34 ait sshd[199593]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.3.42.103


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.131.46.146
description:
Feb  4 22:49:37 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.131.46.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Feb  4 22:49:41 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.101.204.242
description:
Feb  4 22:49:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.101.204.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 22:50:06 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.72.14.152
description:
Feb  4 22:49:30 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.72.14.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-02-04 22:49:33 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:13046: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.48.181
description:
Feb  4 22:49:37 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.48.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.117.88
description:
Feb  4 22:51:12 ait sshd[200412]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.117.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.78.119.104
description:
Feb  4 22:50:40 ait sshd[200219]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.78.119.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.117.88
description:
Feb  4 22:51:12 ait sshd[200412]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.117.88


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.248.149.139
description:
Feb  4 22:50:31 ait sshd[200110]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.149.139  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.191.120.28
description:
[2025-02-04 22:50:34 +0100] info [webmaild] 5.191.120.28 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.78.119.104
description:
Feb  4 22:50:40 ait sshd[200219]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.78.119.104  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 143.198.90.189
description:
Feb  4 22:51:40 ait sshd[200482]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.198.90.189


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.59.228.24
description:
Feb  4 22:52:16 ait sshd[200765]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.59.228.24 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.59.228.24
description:
Feb  4 22:52:16 ait sshd[200765]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.228.24


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.121.153.43
description:
[2025-02-04 22:52:30 +0100] info [webmaild] 190.121.153.43 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.90.189
description:
Feb  4 22:51:40 ait sshd[200482]: pam_imunify(sshd:auth): [IM360_RBL] The IP 143.198.90.189 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 79.106.203.81
description:
[2025-02-04 22:52:46 +0100] info [webmaild] 79.106.203.81 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 22:52:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.24.90.68
description:
[2025-02-04 22:53:05 +0100] info [webmaild] 200.24.90.68 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.4.12.44
description:
Feb  4 22:53:08 ait sshd[201058]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.4.12.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.158.212
description:
[2025-02-04 22:53:17 +0100] info [webmaild] 179.125.158.212 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.99.13.82
description:
Feb  4 22:53:25 ait sshd[201124]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.99.13.82  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.4.12.44
description:
Feb  4 22:53:08 ait sshd[201058]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.4.12.44  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.99.13.82
description:
Feb  4 22:53:25 ait sshd[201124]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.99.13.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 22:54:24 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.204
description:
Feb  4 22:53:47 ait sshd[201489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.204  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.96.43.25
description:
Feb  4 22:53:49 ait sshd[201506]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.43.25


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.222.190.69
description:
Feb  4 22:53:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.222.190.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.90.189
description:
Feb  4 22:53:51 ait sshd[201518]: pam_imunify(sshd:auth): [IM360_RBL] The IP 143.198.90.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.3.42.103
description:
Feb  4 22:53:41 ait sshd[201352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.3.42.103


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.10.44.126
description:
Feb  4 22:53:33 ait sshd[201159]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.10.44.126


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.3.42.103
description:
Feb  4 22:53:41 ait sshd[201352]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.3.42.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
description:
2025-02-04 22:53:41 dovecot_plain authenticator failed for (201-28-33-49.customer.tdatabrasil.net.br) [186.239.41.74]:38315: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.213.240.6
description:
Feb  4 22:53:45 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.213.240.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.204
description:
Feb  4 22:53:47 ait sshd[201489]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.96.43.25
description:
Feb  4 22:53:49 ait sshd[201506]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.96.43.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.222.190.69
description:
2025-02-04 22:53:49 dovecot_plain authenticator failed for (client.fttb.2day.kz) [176.222.190.69]:49188: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 143.198.90.189
description:
Feb  4 22:53:51 ait sshd[201518]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.198.90.189


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.10.44.126
description:
Feb  4 22:53:33 ait sshd[201159]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.10.44.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.74
description:
Feb  4 22:53:39 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.74 has been locked due to Imunify RBL


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.204
description:
Feb  4 22:54:10 ait sshd[201489]: error: maximum authentication attempts exceeded for root from 218.92.0.204 port 13184 ssh2 [preauth]


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.13.21.246
description:
Feb  4 22:54:49 ait sshd[201895]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.13.21.246  user=root


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.3.42.103
description:
Feb  4 22:55:13 ait sshd[202225]: Failed password for invalid user crystal from 62.3.42.103 port 46134 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.13.21.246
description:
Feb  4 22:54:49 ait sshd[201895]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.13.21.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.3.42.103
description:
Feb  4 22:55:12 ait sshd[202225]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.3.42.103 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 223.123.5.42
description:
[2025-02-04 22:55:20 +0100] info [webmaild] 223.123.5.42 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.57.217.38
description:
Feb  4 22:54:35 ait sshd[201855]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.57.217.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.156.198
description:
Feb  4 22:54:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.156.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.90.189
description:
Feb  4 22:55:13 ait sshd[202228]: pam_imunify(sshd:auth): [IM360_RBL] The IP 143.198.90.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.3.42.103
description:
Feb  4 22:55:12 ait sshd[202225]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.3.42.103


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 143.198.90.189
description:
Feb  4 22:55:13 ait sshd[202228]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.198.90.189


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Feb  4 22:55:19 ait sshd[202303]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.57.217.38
description:
Feb  4 22:54:35 ait sshd[201855]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.57.217.38  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.127.68.180
description:
Feb  4 22:54:40 ait sshd[201869]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.68.180


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Feb  4 22:55:19 ait sshd[202303]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.127.68.180
description:
Feb  4 22:54:40 ait sshd[201869]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.127.68.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.89.72
description:
Feb  4 22:54:55 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.89.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.89.72
description:
2025-02-04 22:54:57 dovecot_login authenticator failed for (72.89.132.112.adsl-pool.ah.cnuninet.net) [112.132.89.72]:33153: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 193.84.180.33
description:
[2025-02-04 22:55:13 +0100] info [webmaild] 193.84.180.33 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 213.152.176.252
domain: jabmar.org
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/web.config||User:titlemas||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.156.198
description:
2025-02-04 22:54:45 dovecot_login authenticator failed for ([116.116.156.198]) [116.116.156.198]:59669: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.169.213.177
domain: ijbit.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-content/uploads/414.php||SC:/home/titlemas/public_html/ijbit.us/wp-content


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.252.153.14
description:
Feb  4 22:56:19 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.252.153.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 52.169.213.177
domain: ijbit.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:22-56.52.169.213.177||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.205.203.246
description:
Feb  4 22:55:48 ait sshd[202608]: pam_imunify(sshd:auth): [IM360_RBL] The IP 172.205.203.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 172.205.203.246
description:
Feb  4 22:55:48 ait sshd[202608]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.205.203.246


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 194.150.78.68
description:
[2025-02-04 22:55:48 +0100] info [webmaild] 194.150.78.68 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.30.56.135
description:
[2025-02-04 22:55:50 +0100] info [webmaild] 191.30.56.135 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.252.153.14
description:
2025-02-04 22:56:21 dovecot_plain authenticator failed for (localhost) [5.252.153.14]:51081: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.39.191.14
description:
Feb  4 22:56:29 ait sshd[202871]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.39.191.14 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.39.191.14
description:
Feb  4 22:56:29 ait sshd[202871]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.191.14  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.172.46.10
description:
Feb  4 22:56:31 ait sshd[202874]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.172.46.10  user=lemsas


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.96.43.25
description:
Feb  4 22:56:32 ait sshd[202876]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.43.25


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.172.46.10
description:
Feb  4 22:56:31 ait sshd[202874]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.172.46.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.96.43.25
description:
Feb  4 22:56:32 ait sshd[202876]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.96.43.25 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.78.82.89
description:
[2025-02-04 22:58:09 +0100] info [webmaild] 181.78.82.89 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.56.149.154
description:
Feb  4 22:58:26 ait sshd[203517]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.56.149.154


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.42.84.211
description:
[2025-02-04 22:58:02 +0100] info [webmaild] 201.42.84.211 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.149.154
description:
Feb  4 22:58:26 ait sshd[203517]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.56.149.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.51.38
description:
Feb  4 22:58:02 ait sshd[203304]: pam_imunify(sshd:auth): [IM360_RBL] The IP 74.208.51.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 74.208.51.38
description:
Feb  4 22:58:02 ait sshd[203304]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.208.51.38  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.56.149.154
description:
Feb  4 22:58:44 ait sshd[203618]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.56.149.154


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.216.176.90
description:
2025-02-04 22:58:49 dovecot_plain authenticator failed for 32-216-176-90.bng02.brpt.ct.frontiernet.net [32.216.176.90]:62756: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.237.110.29
description:
Feb  4 22:58:57 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.237.110.29 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 84.22.115.60
description:
Feb  4 22:58:47 ait sshd[203628]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.22.115.60  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.110.29
description:
2025-02-04 22:58:59 dovecot_plain authenticator failed for 81-237-110-29-no2300.tbcn.telia.com [81.237.110.29]:60896: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.117.88
description:
Feb  4 22:58:36 ait sshd[203584]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.117.88 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.117.88
description:
Feb  4 22:58:36 ait sshd[203584]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.117.88


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.106.23.215
description:
Feb  4 22:59:06 ait sshd[203847]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.106.23.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.188.207.151
description:
Feb  4 22:59:26 ait sshd[204020]: pam_imunify(sshd:auth): [IM360_RBL] The IP 199.188.207.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.133.116.127
description:
[2025-02-04 22:58:32 +0100] info [webmaild] 177.133.116.127 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.149.154
description:
Feb  4 22:58:44 ait sshd[203618]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.56.149.154 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.106.151.48
description:
[2025-02-04 22:58:45 +0100] info [webmaild] 189.106.151.48 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.216.176.90
description:
Feb  4 22:58:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.216.176.90 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.106.23.215
description:
Feb  4 22:59:06 ait sshd[203847]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.106.23.215  user=bin


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 199.188.207.151
description:
Feb  4 22:59:26 ait sshd[204020]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=199.188.207.151


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.216.119.13
description:
Feb  4 22:59:41 ait sshd[204069]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.216.119.13


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.168.26.166
description:
2025-02-04 23:00:12 dovecot_plain authenticator failed for syn-024-168-026-166.res.spectrum.com [24.168.26.166]:60436: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.117.88
description:
Feb  4 23:00:22 ait sshd[204500]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.117.88 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.217.229
description:
Feb  4 23:00:17 ait sshd[204485]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.217.229  user=lemsas


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.118.229
description:
2025-02-04 23:00:16 dovecot_plain authenticator failed for ([138.75.118.229]) [138.75.118.229]:52829: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.216.119.13
description:
Feb  4 22:59:41 ait sshd[204069]: pam_imunify(sshd:auth): [IM360_RBL] The IP 118.216.119.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.168.26.166
description:
Feb  4 23:00:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.168.26.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.118.229
description:
Feb  4 23:00:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.118.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.217.229
description:
Feb  4 23:00:17 ait sshd[204485]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.217.229 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.117.88
description:
Feb  4 23:00:22 ait sshd[204500]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.117.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.228.225.22
description:
Feb  4 23:00:24 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.228.225.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.22
description:
2025-02-04 23:00:26 dovecot_plain authenticator failed for ([122.228.225.22]) [122.228.225.22]:53732: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.12.240.14
description:
Feb  4 23:01:00 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.12.240.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.227.31.58
description:
Feb  4 23:01:21 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.227.31.58 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.254.23.40
description:
Feb  4 23:00:44 ait sshd[204585]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.254.23.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.147.25.111
description:
Feb  4 23:00:48 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.147.25.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.147.25.111
description:
2025-02-04 23:00:50 dovecot_plain authenticator failed for ([121.147.25.111]) [121.147.25.111]:39710: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
description:
Feb  4 23:00:58 ait sshd[204694]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.99.36.130
description:
2025-02-04 23:01:09 dovecot_plain authenticator failed for ([50.99.36.130]) [50.99.36.130]:54050: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.188.85
description:
Feb  4 23:01:20 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.188.85 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.41
description:
Feb  4 23:00:32 ait sshd[204528]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.41


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.41
description:
Feb  4 23:00:32 ait sshd[204528]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.41 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Feb  4 23:00:58 ait sshd[204694]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.99.36.130
description:
Feb  4 23:01:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.99.36.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Feb  4 23:01:14 ait sshd[204889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.90.217.50
description:
[2025-02-04 23:00:48 +0100] info [webmaild] 178.90.217.50 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.226.173.151
description:
Feb  4 23:01:03 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.226.173.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.227.31.58
description:
2025-02-04 23:01:23 dovecot_login authenticator failed for ([91.227.31.58]) [91.227.31.58]:43915: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.161.119.209
description:
[2025-02-04 23:01:26 +0100] info [webmaild] 187.161.119.209 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.28.128.172
description:
Feb  4 23:00:34 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.28.128.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.254.23.40
description:
Feb  4 23:00:44 ait sshd[204585]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.254.23.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.12.240.14
description:
2025-02-04 23:01:02 dovecot_plain authenticator failed for ([85.12.240.14]) [85.12.240.14]:34078: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.168.71.109
description:
Feb  4 23:01:28 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.168.71.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.188.85
description:
2025-02-04 23:01:22 dovecot_plain authenticator failed for ([120.234.188.85]) [120.234.188.85]:57048: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.38.60.214
description:
[2025-02-04 23:00:52 +0100] info [webmaild] 187.38.60.214 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.226.173.151
description:
2025-02-04 23:01:05 dovecot_plain authenticator failed for (pool-176-226-173-151.is74.ru) [176.226.173.151]:56226: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Feb  4 23:01:14 ait sshd[204889]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.159.2.126
description:
[2025-02-04 23:01:17 +0100] info [webmaild] 102.159.2.126 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.71.109
description:
2025-02-04 23:01:30 dovecot_plain authenticator failed for ([112.168.71.109]) [112.168.71.109]:40522: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.28.128.172
description:
2025-02-04 23:00:36 dovecot_plain authenticator failed for ([112.28.128.172]) [112.28.128.172]:47632: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.32.227.248
description:
Feb  4 23:02:19 ait sshd[205271]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.32.227.248  user=root


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.79.234.178
domain: elibrary-edu.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/admin/upload/css.php||SC:/home/titlemas/public_html/elibrary-edu.net/admin


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 138.68.99.33
description:
Feb  4 23:01:38 ait sshd[205000]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.99.33  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.168.58.245
description:
Feb  4 23:01:40 ait sshd[205018]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.168.58.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.222.90.178
description:
2025-02-04 23:01:33 dovecot_login authenticator failed for ([200.222.80.81]) [200.222.90.178]:44327: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.168.58.245
description:
Feb  4 23:01:40 ait sshd[205018]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.168.58.245  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.32.227.248
description:
Feb  4 23:02:19 ait sshd[205271]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.32.227.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.222.90.178
description:
Feb  4 23:01:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.222.90.178 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.159.91.86
description:
Feb  4 23:01:34 ait sshd[204967]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.159.91.86  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.221.101.111
description:
Feb  4 23:02:17 ait sshd[205267]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.221.101.111  user=bin


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 13.79.234.178
domain: elibrary-edu.net
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:23-02.13.79.234.178||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.159.91.86
description:
Feb  4 23:01:34 ait sshd[204967]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.159.91.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.68.99.33
description:
Feb  4 23:01:38 ait sshd[205000]: pam_imunify(sshd:auth): [IM360_RBL] The IP 138.68.99.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.221.101.111
description:
Feb  4 23:02:17 ait sshd[205267]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.221.101.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.72.121.10
description:
Feb  4 23:03:20 ait sshd[205592]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.72.121.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.72.121.10
description:
Feb  4 23:03:20 ait sshd[205592]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.72.121.10


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-02-04 23:03:26 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (dueate) [87.103.126.54]:4993: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 84.200.154.39
description:
Feb  4 23:03:29 ait sshd[205595]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.200.154.39  user=lemsas


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 172.205.203.246
description:
Feb  4 23:02:45 ait sshd[205370]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.205.203.246  user=lemsas


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.200.154.39
description:
Feb  4 23:03:29 ait sshd[205595]: pam_imunify(sshd:auth): [IM360_RBL] The IP 84.200.154.39 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-02.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.205.203.246
description:
Feb  4 23:02:45 ait sshd[205370]: pam_imunify(sshd:auth): [IM360_RBL] The IP 172.205.203.246 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 3.109.132.40
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-03.3.109.132.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Feb  4 23:03:24 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.141.229
description:
Feb  4 23:04:11 ait sshd[206006]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.65.141.229 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.65.141.229
description:
Feb  4 23:04:11 ait sshd[206006]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.141.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.192.29.74
description:
Feb  4 23:04:24 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.192.29.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.192.29.74
description:
2025-02-04 23:04:26 dovecot_plain authenticator failed for ([120.192.29.74]) [120.192.29.74]:34513: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.244.255.64
description:
[2025-02-04 23:04:10 +0100] info [webmaild] 170.244.255.64 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.97.250.19
description:
[2025-02-04 23:04:13 +0100] info [webmaild] 190.97.250.19 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.221.231.200
description:
[2025-02-04 23:03:35 +0100] info [webmaild] 177.221.231.200 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.163.151.231
description:
[2025-02-04 23:03:43 +0100] info [webmaild] 45.163.151.231 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.13.237.163
description:
Feb  4 23:04:44 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.13.237.163 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.82.26.182
description:
Feb  4 23:04:58 ait sshd[206245]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.82.26.182


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.47.172.133
description:
Feb  4 23:05:23 ait sshd[206593]: pam_imunify(sshd:auth): [IM360_RBL] The IP 163.47.172.133 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 163.47.172.133
description:
Feb  4 23:05:23 ait sshd[206593]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.47.172.133  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.13.237.163
description:
2025-02-04 23:04:46 dovecot_plain authenticator failed for ([59.13.237.163]) [59.13.237.163]:56664: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.82.26.182
description:
Feb  4 23:04:58 ait sshd[206245]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.82.26.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.215.211.223
description:
Feb  4 23:05:50 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.215.211.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.79.83.28
description:
2025-02-04 23:06:18 dovecot_plain authenticator failed for ([38.79.83.28]) [38.79.83.28]:52874: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.201.45
description:
2025-02-04 23:06:27 dovecot_plain authenticator failed for ([36.33.201.45]) [36.33.201.45]:47862: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.166.230.101
description:
Feb  4 23:06:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.166.230.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.250.249.12
description:
2025-02-04 23:06:30 dovecot_plain authenticator failed for ([45.250.249.12]) [45.250.249.12]:40300: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.132.43.94
description:
Feb  4 23:06:12 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.132.43.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.132.43.94
description:
2025-02-04 23:06:14 dovecot_plain authenticator failed for ([116.132.43.94]) [116.132.43.94]:33594: 535 Incorrect authentication data (set_id=agbozume1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.116.129.29
description:
[2025-02-04 23:06:17 +0100] info [webmaild] 181.116.129.29 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.201.45
description:
Feb  4 23:06:25 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.201.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.250.249.12
description:
Feb  4 23:06:28 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.250.249.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.135.96.213
description:
Feb  4 23:06:28 ait sshd[206974]: pam_imunify(sshd:auth): [IM360_RBL] The IP 137.135.96.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.104
description:
Feb  4 23:05:31 ait sshd[206655]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.215.211.223
description:
2025-02-04 23:05:52 dovecot_plain authenticator failed for ([114.215.211.223]) [114.215.211.223]:52462: 535 Incorrect authentication data (set_id=agbozume1@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.157.107.67
description:
Feb  4 23:05:54 ait sshd[206779]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.157.107.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.157.107.67
description:
Feb  4 23:05:54 ait sshd[206779]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.157.107.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-02-04 23:06:03 dovecot_plain authenticator failed for ([103.103.35.130]) [103.103.35.130]:51855: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.179.29.179
description:
[2025-02-04 23:06:21 +0100] info [webmaild] 185.179.29.179 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 137.135.96.213
description:
Feb  4 23:06:28 ait sshd[206974]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.135.96.213


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.166.230.101
description:
2025-02-04 23:06:31 dovecot_login authenticator failed for (w5JJKiXw) [69.166.230.101]:62129: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.104
description:
Feb  4 23:05:31 ait sshd[206655]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.79.83.28
description:
Feb  4 23:06:16 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.79.83.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.154.90.17
description:
Feb  4 23:07:08 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.154.90.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.166.230.101
description:
Feb  4 23:06:33 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.166.230.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.166.230.101
description:
2025-02-04 23:06:35 dovecot_login authenticator failed for (EryMfQtx) [69.166.230.101]:62165: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.101.16.250
description:
Feb  4 23:06:38 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.101.16.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.75.231.212
description:
[2025-02-04 23:06:51 +0100] info [webmaild] 105.75.231.212 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Feb  4 23:06:52 ait sshd[207041]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.213
description:
Feb  4 23:07:23 ait sshd[207081]: error: maximum authentication attempts exceeded for root from 218.92.0.213 port 26090 ssh2 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.113.95.152
description:
[2025-02-04 23:06:49 +0100] info [webmaild] 190.113.95.152 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.213
description:
Feb  4 23:07:02 ait sshd[207081]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.213  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.17
description:
2025-02-04 23:07:10 dovecot_plain authenticator failed for ([121.154.90.17]) [121.154.90.17]:53620: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.195.225.182
description:
Feb  4 23:06:38 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.195.225.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
description:
2025-02-04 23:06:40 dovecot_plain authenticator failed for ([185.134.179.106]) [185.101.16.250]:47767: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.195.225.182
description:
2025-02-04 23:06:40 dovecot_plain authenticator failed for 123-195-225-182.dynamic.kbronet.com.tw [123.195.225.182]:44976: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.213
description:
Feb  4 23:07:01 ait sshd[207081]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.22.214.214
description:
Feb  4 23:07:54 ait sshd[207361]: pam_imunify(sshd:auth): [IM360_RBL] The IP 165.22.214.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.96.43.25
description:
Feb  4 23:08:03 ait sshd[207393]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.96.43.25 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.231.159
description:
Feb  4 23:08:27 ait sshd[207600]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.231.159


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  4 23:08:09 ait sshd[207442]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.231.159
description:
Feb  4 23:08:27 ait sshd[207600]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.205.231.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.145.27.1
description:
Feb  4 23:08:27 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.145.27.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.3.198
description:
Feb  4 23:08:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.3.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.23.172
description:
Feb  4 23:08:16 ait sshd[207585]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.203.23.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.198
description:
2025-02-04 23:08:31 dovecot_plain authenticator failed for 111-70-3-198.emome-ip.hinet.net [111.70.3.198]:46688: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.144.100.159
description:
Feb  4 23:08:10 ait sshd[207445]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.144.100.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.145.27.1
description:
2025-02-04 23:08:29 dovecot_plain authenticator failed for ([103.145.27.106]) [103.145.27.1]:45064: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.22.214.214
description:
Feb  4 23:07:54 ait sshd[207361]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.214.214


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.163
description:
Feb  4 23:07:58 ait sshd[207364]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.163  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.96.43.25
description:
Feb  4 23:08:03 ait sshd[207393]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.43.25


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.205
description:
2025-02-04 23:08:26 dovecot_plain authenticator failed for (brous) [65.20.155.205]:52837: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.163
description:
Feb  4 23:07:58 ait sshd[207364]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.163 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  4 23:08:09 ait sshd[207442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.144.100.159
description:
Feb  4 23:08:10 ait sshd[207445]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.144.100.159 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.203.23.172
description:
Feb  4 23:08:16 ait sshd[207585]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.23.172  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.205
description:
Feb  4 23:08:24 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.159.117.51
description:
2025-02-04 23:09:19 dovecot_plain authenticator failed for (pool.sevtele.com) [178.159.117.51]:46476: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.133.214.161
description:
Feb  4 23:08:35 ait sshd[207626]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.133.214.161  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.86.79
description:
[2025-02-04 23:08:54 +0100] info [webmaild] 213.230.86.79 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.104.166.110
description:
Feb  4 23:08:45 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.104.166.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
description:
2025-02-04 23:08:47 dovecot_plain authenticator failed for ([211.104.166.110]) [211.104.166.110]:42762: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.61.39.184
description:
[2025-02-04 23:09:22 +0100] info [webmaild] 46.61.39.184 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 163.47.172.133
description:
Feb  4 23:09:27 ait sshd[208096]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.47.172.133  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.146.46.12
description:
[2025-02-04 23:09:29 +0100] info [webmaild] 197.146.46.12 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.159.117.51
description:
Feb  4 23:09:17 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.159.117.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.220.16.46
description:
2025-02-04 23:09:22 dovecot_plain authenticator failed for ([119.220.16.46]) [119.220.16.46]:59681: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.116.64
description:
2025-02-04 23:09:02 dovecot_plain authenticator failed for (hypose) [62.182.116.64]:38013: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.45.225.98
description:
2025-02-04 23:09:05 dovecot_plain authenticator failed for ([69.45.225.98]) [69.45.225.98]:51910: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.119.194.70
description:
Feb  4 23:09:21 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.119.194.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.119.194.70
description:
2025-02-04 23:09:23 dovecot_plain authenticator failed for ([212.119.194.70]) [212.119.194.70]:58664: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.112.154.174
description:
Feb  4 23:09:30 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.112.154.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.133.214.161
description:
Feb  4 23:08:35 ait sshd[207626]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.133.214.161 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.65.245.72
description:
[2025-02-04 23:08:52 +0100] info [webmaild] 177.65.245.72 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.99.15.104
description:
2025-02-04 23:09:21 dovecot_plain authenticator failed for ([103.99.15.104]) [103.99.15.104]:51944: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.221.130.246
description:
Feb  4 23:09:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.221.130.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.185.53.187
description:
Feb  4 23:09:26 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.185.53.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-02-04 23:09:26 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:54080: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.55
description:
2025-02-04 23:09:20 dovecot_plain authenticator failed for ([178.178.222.55]) [178.178.222.55]:50938: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.41
description:
Feb  4 23:08:39 ait sshd[207650]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.41


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.45.225.98
description:
Feb  4 23:09:03 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.45.225.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.55
description:
Feb  4 23:09:18 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.220.16.46
description:
Feb  4 23:09:20 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.220.16.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Feb  4 23:09:24 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.47.172.133
description:
Feb  4 23:09:27 ait sshd[208096]: pam_imunify(sshd:auth): [IM360_RBL] The IP 163.47.172.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.41
description:
Feb  4 23:08:39 ait sshd[207650]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.182.116.64
description:
Feb  4 23:09:00 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.182.116.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.221.130.246
description:
2025-02-04 23:09:25 dovecot_plain authenticator failed for ([211.221.130.246]) [211.221.130.246]:59932: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.53.187
description:
2025-02-04 23:09:28 dovecot_plain authenticator failed for ([122.185.53.187]) [122.185.53.187]:47498: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.99.15.104
description:
Feb  4 23:09:19 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.99.15.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
description:
Feb  4 23:09:40 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.82.102
description:
Feb  4 23:09:36 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.82.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.39.191.14
description:
Feb  4 23:10:13 ait sshd[208376]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.39.191.14 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.153.68.238
description:
Feb  4 23:09:53 ait sshd[208170]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.153.68.238


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.91.84.89
description:
2025-02-04 23:09:35 dovecot_plain authenticator failed for ([187.92.76.49]) [201.91.84.89]:41261: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.91.173.203
description:
2025-02-04 23:09:37 dovecot_plain authenticator failed for (197-91-173-203.dyn.mweb.co.za) [197.91.173.203]:55273: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Feb  4 23:09:37 ait sshd[208149]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
description:
2025-02-04 23:09:42 dovecot_plain authenticator failed for ([218.98.160.117]) [218.98.160.117]:17634: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.153.68.238
description:
Feb  4 23:09:53 ait sshd[208170]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.153.68.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.112.154.174
description:
2025-02-04 23:09:32 dovecot_plain authenticator failed for ([203.112.154.174]) [203.112.154.174]:45912: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.83.9.138
description:
Feb  4 23:10:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.83.9.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.253
description:
2025-02-04 23:09:56 dovecot_plain authenticator failed for (m121-202-152-253.smartone.com) [121.202.152.253]:54505: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.24.154.232
description:
Feb  4 23:09:32 ait sshd[208139]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.24.154.232  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.84.89
description:
Feb  4 23:09:33 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.84.89 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Feb  4 23:09:37 ait sshd[208149]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.115.211
description:
2025-02-04 23:09:40 dovecot_plain authenticator failed for (211.115.156.175.unknown.m1.com.sg) [175.156.115.211]:47947: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.200.16
description:
2025-02-04 23:09:41 dovecot_plain authenticator failed for (16.200.86.116.starhub.net.sg) [116.86.200.16]:56408: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.223
description:
2025-02-04 23:09:43 dovecot_plain authenticator failed for 111-70-23-223.emome-ip.hinet.net [111.70.23.223]:59070: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.39.191.14
description:
Feb  4 23:10:13 ait sshd[208376]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.191.14  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.201.78.193
description:
Feb  4 23:09:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.201.78.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.91.173.203
description:
Feb  4 23:09:35 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.91.173.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.82.102
description:
2025-02-04 23:09:38 dovecot_plain authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:36850: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.223
description:
Feb  4 23:09:41 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
description:
2025-02-04 23:09:50 dovecot_plain authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:38724: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.106.198.35
description:
Feb  4 23:10:24 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.106.198.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.24.154.232
description:
Feb  4 23:09:32 ait sshd[208139]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.24.154.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.253
description:
Feb  4 23:09:54 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.9.138
description:
2025-02-04 23:10:11 dovecot_plain authenticator failed for ([103.83.9.138]) [103.83.9.138]:34756: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.115.211
description:
Feb  4 23:09:38 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.115.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.201.78.193
description:
2025-02-04 23:09:33 dovecot_plain authenticator failed for ([175.201.78.193]) [175.201.78.193]:35870: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.35.237.38
description:
2025-02-04 23:09:33 dovecot_plain authenticator failed for ([183.105.138.168]) [211.35.237.38]:48040: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
description:
Feb  4 23:09:48 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.35.237.38
description:
Feb  4 23:09:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.35.237.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.200.16
description:
Feb  4 23:09:39 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.200.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.166.230.101
description:
2025-02-04 23:09:42 dovecot_login authenticator failed for (hGErFa7a) [69.166.230.101]:57928: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.106.198.35
description:
2025-02-04 23:10:26 dovecot_plain authenticator failed for ([222.106.198.35]) [222.106.198.35]:58802: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.183.180.108
description:
Feb  4 23:10:40 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.183.180.108 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.212.235.151
description:
Feb  4 23:10:33 ait sshd[208531]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.212.235.151  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.183.180.108
description:
2025-02-04 23:10:42 dovecot_plain authenticator failed for ([118.183.180.108]) [118.183.180.108]:20152: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.248.27.95
description:
Feb  4 23:11:04 ait sshd[208680]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.248.27.95 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.62.227.127
description:
Feb  4 23:11:19 ait sshd[208825]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.62.227.127  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.235.151
description:
Feb  4 23:10:33 ait sshd[208531]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.212.235.151 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Feb  4 23:11:19 ait sshd[208700]: Invalid user ergotherapie-hattinger.at 2a01 from 122.51.104.242 port 48220


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  4 23:11:19 ait sshd[208700]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.62.227.127
description:
Feb  4 23:11:19 ait sshd[208825]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.62.227.127 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.248.27.95
description:
Feb  4 23:11:04 ait sshd[208680]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.27.95  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
description:
Feb  4 23:11:48 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.155.191.166
description:
Feb  4 23:12:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.155.191.166 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.190.206.163
description:
[2025-02-04 23:12:05 +0100] info [webmaild] 186.190.206.163 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.78.2.210
description:
[2025-02-04 23:11:33 +0100] info [webmaild] 170.78.2.210 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.207.252.124
description:
2025-02-04 23:11:44 dovecot_plain authenticator failed for (pool-31-207-252-124.is74.ru) [31.207.252.124]:39283: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.13.237.76
description:
Feb  4 23:11:48 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.13.237.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.13.237.76
description:
2025-02-04 23:11:50 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [123.13.237.76]:40504: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.208.245
description:
2025-02-04 23:12:00 dovecot_plain authenticator failed for (m121-202-208-245.smartone.com) [121.202.208.245]:44204: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.155.191.166
description:
2025-02-04 23:12:03 dovecot_plain authenticator failed for ([39.155.191.166]) [39.155.191.166]:60810: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.62.88.225
description:
[2025-02-04 23:11:31 +0100] info [webmaild] 190.62.88.225 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.208.245
description:
Feb  4 23:11:58 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.208.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.183.180.108
description:
Feb  4 23:12:00 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.183.180.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Feb  4 23:12:14 ait sshd[208974]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Feb  4 23:12:14 ait sshd[208974]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.207.252.124
description:
Feb  4 23:11:42 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.207.252.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
description:
2025-02-04 23:11:50 dovecot_plain authenticator failed for ([121.202.155.10]) [121.202.155.10]:38055: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.183.180.108
description:
2025-02-04 23:12:02 dovecot_plain authenticator failed for ([118.183.180.108]) [118.183.180.108]:58063: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.68.173.11
description:
[2025-02-04 23:12:08 +0100] info [webmaild] 200.68.173.11 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.40.145
description:
47.128.40.145 - - [04/Feb/2025:23:12:25 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=22240728 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C205%2C30&filter_course-language=118%2C79%2C99&filtering=1&instructor=2%2C1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.40.145


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.105.246.224
description:
Feb  4 23:13:30 ait sshd[209401]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.105.246.224  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.3.132
description:
Feb  4 23:12:45 ait sshd[209206]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.143.3.132 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.143.3.132
description:
Feb  4 23:12:45 ait sshd[209206]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.143.3.132  user=bin


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.105.246.224
description:
Feb  4 23:13:30 ait sshd[209401]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.105.246.224 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.219.68.141
description:
[2025-02-04 23:14:18 +0100] info [webmaild] 191.219.68.141 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.235.151
description:
Feb  4 23:13:33 ait sshd[209423]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.212.235.151 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.212.235.151
description:
Feb  4 23:13:33 ait sshd[209423]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.212.235.151  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.171.21.192
description:
Feb  4 23:13:39 ait sshd[209472]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.171.21.192


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.61.241
description:
[2025-02-04 23:14:09 +0100] info [webmaild] 45.70.61.241 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.187
description:
Feb  4 23:14:20 ait sshd[209918]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.106.104.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.171.21.192
description:
Feb  4 23:13:39 ait sshd[209472]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.171.21.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.10.44.126
description:
Feb  4 23:14:05 ait sshd[209808]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.10.44.126 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.10.44.126
description:
Feb  4 23:14:05 ait sshd[209808]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.10.44.126


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.106.104.187
description:
Feb  4 23:14:20 ait sshd[209918]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.106.104.187


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.90.58.22
description:
[2025-02-04 23:14:53 +0100] info [webmaild] 168.90.58.22 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.237.108
description:
Feb  4 23:14:46 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.237.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.3.132
description:
Feb  4 23:14:54 ait sshd[210135]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.143.3.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.89.99
description:
Feb  4 23:15:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.89.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.89.99
description:
2025-02-04 23:15:15 dovecot_plain authenticator failed for ([177.174.89.105]) [177.174.89.99]:36336: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.237.108
description:
2025-02-04 23:14:48 dovecot_plain authenticator failed for ([218.147.237.108]) [218.147.237.108]:45790: 535 Incorrect authentication data (set_id=eng19a00097y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.44.120
description:
Feb  4 23:15:18 ait sshd[210402]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.203.44.120 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.143.3.132
description:
Feb  4 23:14:54 ait sshd[210135]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.143.3.132  user=bin


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.203.44.120
description:
Feb  4 23:15:18 ait sshd[210402]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.44.120


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.196.19.81
description:
[2025-02-04 23:14:40 +0100] info [webmaild] 131.196.19.81 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.132.61.213
description:
2025-02-04 23:16:25 dovecot_plain authenticator failed for ([124.132.61.213]) [124.132.61.213]:54740: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.132.61.213
description:
Feb  4 23:16:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.132.61.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.233.177
description:
Feb  4 23:15:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.233.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.174.142.78
description:
Feb  4 23:16:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.174.142.78 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.237.178.130
description:
Feb  4 23:16:02 ait sshd[210594]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.237.178.130  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.174.142.78
description:
2025-02-04 23:16:03 dovecot_plain authenticator failed for ([222.174.142.78]) [222.174.142.78]:26790: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.73.48.210
description:
Feb  4 23:15:35 ait sshd[210415]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.73.48.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.237.178.130
description:
Feb  4 23:16:02 ait sshd[210594]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.237.178.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.222.190.69
description:
Feb  4 23:16:08 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.222.190.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.222.190.69
description:
2025-02-04 23:16:10 dovecot_plain authenticator failed for (client.fttb.2day.kz) [176.222.190.69]:42106: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.73.48.210
description:
Feb  4 23:15:35 ait sshd[210415]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.73.48.210  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 202.29.30.124
domain: ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:23-15.202.29.30.124


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.233.177
description:
2025-02-04 23:15:49 dovecot_plain authenticator failed for (nsg-corporate-177.233.187.122.airtel.in) [122.187.233.177]:33775: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 203.76.222.64
description:
[2025-02-04 23:16:53 +0100] info [webmaild] 203.76.222.64 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.73.242
description:
Feb  4 23:17:27 ait sshd[211015]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.37.73.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.107.106.228
description:
[2025-02-04 23:16:53 +0100] info [webmaild] 217.107.106.228 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-16.80.76.51.123


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.37.73.242
description:
Feb  4 23:17:27 ait sshd[211015]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.37.73.242  user=lemsas


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.190.160.100
description:
[2025-02-04 23:17:27 +0100] info [webmaild] 187.190.160.100 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.244.88
description:
Feb  4 23:18:05 ait sshd[211140]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.244.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.133.185.200
description:
Feb  4 23:18:12 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.133.185.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.35.118.211
description:
Feb  4 23:18:16 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.35.118.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.245.207.104
description:
Feb  4 23:17:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.245.207.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.245.207.104
description:
2025-02-04 23:17:45 dovecot_plain authenticator failed for ([1.245.207.104]) [1.245.207.104]:46414: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.84.132.142
description:
Feb  4 23:18:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.84.132.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.25.30.150
description:
[2025-02-04 23:17:36 +0100] info [webmaild] 38.25.30.150 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
description:
2025-02-04 23:18:00 dovecot_plain authenticator failed for ([196.190.43.139]) [196.190.41.137]:27717: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.41.137
description:
Feb  4 23:17:58 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.41.137 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.244.88
description:
Feb  4 23:18:05 ait sshd[211140]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.244.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.84.132.142
description:
2025-02-04 23:18:03 dovecot_plain authenticator failed for (41.84.132.142.liquidtelecom.net) [41.84.132.142]:38783: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.35.118.211
description:
2025-02-04 23:18:18 dovecot_plain authenticator failed for ([46.35.118.211]) [46.35.118.211]:49485: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.200.239
description:
Feb  4 23:18:53 ait sshd[211418]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.178.200.239 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.178.200.239
description:
Feb  4 23:18:53 ait sshd[211418]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.178.200.239


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.42.80
description:
Feb  4 23:19:20 ait sshd[211625]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.42.80


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.99.13.82
description:
Feb  4 23:19:26 ait sshd[211632]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.99.13.82  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Feb  4 23:19:28 ait sshd[211757]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 95.111.246.153
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-18.95.111.246.153


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.42.80
description:
Feb  4 23:19:20 ait sshd[211625]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.42.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.99.13.82
description:
Feb  4 23:19:26 ait sshd[211632]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.99.13.82 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Feb  4 23:19:28 ait sshd[211757]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.125.93.101
description:
Feb  4 23:19:30 ait sshd[211757]: Failed password for invalid user ait from 175.125.93.101 port 39506 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 114.130.156.191
description:
[2025-02-04 23:19:41 +0100] info [webmaild] 114.130.156.191 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.38.40.169
description:
[2025-02-04 23:20:10 +0100] info [webmaild] 189.38.40.169 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.127.67.83
description:
Feb  4 23:20:09 ait sshd[212099]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.67.83


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.30.104
description:
2025-02-04 23:20:18 dovecot_plain authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:41408: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.198.138.185
description:
Feb  4 23:20:22 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.198.138.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 132.148.77.70
description:
Feb  4 23:19:47 ait sshd[211804]: pam_imunify(sshd:auth): [IM360_RBL] The IP 132.148.77.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.248.205.14
description:
Feb  4 23:20:19 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.248.205.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.81.208.4
description:
Feb  4 23:20:20 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.81.208.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Feb  4 23:20:30 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.160.118.76
description:
[2025-02-04 23:19:39 +0100] info [webmaild] 45.160.118.76 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 132.148.77.70
description:
Feb  4 23:19:47 ait sshd[211804]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.148.77.70  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.127.67.83
description:
Feb  4 23:20:09 ait sshd[212099]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.127.67.83 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 86.108.112.191
description:
[2025-02-04 23:20:13 +0100] info [webmaild] 86.108.112.191 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.48.181
description:
Feb  4 23:20:15 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.48.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.30.104
description:
Feb  4 23:20:16 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.30.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.48.181
description:
2025-02-04 23:20:17 dovecot_plain authenticator failed for broadband-37-110-48-181.ip.moscow.rt.ru [37.110.48.181]:50206: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.248.205.14
description:
2025-02-04 23:20:21 dovecot_plain authenticator failed for ([220.248.205.14]) [220.248.205.14]:1409: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.81.208.4
description:
2025-02-04 23:20:22 dovecot_plain authenticator failed for ([103.81.208.4]) [103.81.208.4]:47420: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.198.138.185
description:
2025-02-04 23:20:24 dovecot_plain authenticator failed for ([120.198.138.185]) [120.198.138.185]:60227: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.124
description:
Feb  4 23:20:35 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.174.182.38
description:
Feb  4 23:20:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.174.182.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.251.214
description:
Feb  4 23:20:47 ait sshd[212408]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.239.251.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.97.114.149
description:
2025-02-04 23:21:30 dovecot_plain authenticator failed for c-73-97-114-149.hsd1.wa.comcast.net [73.97.114.149]:38532: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-02-04 23:20:32 dovecot_plain authenticator failed for ([112.111.61.229]) [112.111.61.229]:40840: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.60.184
description:
Feb  4 23:20:33 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.60.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
description:
2025-02-04 23:20:49 dovecot_plain authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:47565: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.96
description:
Feb  4 23:21:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.33.171.65
description:
Feb  4 23:20:33 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.33.171.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.140.210.134
description:
2025-02-04 23:20:37 dovecot_plain authenticator failed for (priandae) [94.140.210.134]:58980: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.215
description:
Feb  4 23:20:47 ait sshd[212404]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.30.115
description:
Feb  4 23:21:27 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.30.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
description:
2025-02-04 23:20:35 dovecot_plain authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:32065: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.184
description:
2025-02-04 23:20:35 dovecot_plain authenticator failed for ([171.244.60.184]) [171.244.60.184]:20624: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.188.40.123
description:
Feb  4 23:20:39 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.188.40.123 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.89.237.199
description:
Feb  4 23:21:25 ait sshd[212558]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.237.199  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.97.114.149
description:
Feb  4 23:21:28 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.97.114.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.59.94.130
description:
Feb  4 23:21:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.59.94.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.41.211.48
description:
Feb  4 23:20:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.41.211.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
description:
2025-02-04 23:20:37 dovecot_plain authenticator failed for ([196.28.226.124]) [196.28.226.124]:60324: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.215
description:
Feb  4 23:21:08 ait sshd[212404]: error: maximum authentication attempts exceeded for root from 218.92.0.215 port 36742 ssh2 [preauth]


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.237.199
description:
Feb  4 23:21:25 ait sshd[212558]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.89.237.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.25.73.199
description:
Feb  4 23:21:26 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.25.73.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.82.135.154
description:
Feb  4 23:21:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.82.135.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.30.115
description:
2025-02-04 23:21:29 dovecot_plain authenticator failed for ([5.31.30.115]) [5.31.30.115]:38990: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.140.210.134
description:
Feb  4 23:20:35 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.140.210.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
description:
2025-02-04 23:20:34 dovecot_plain authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:48560: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.188.40.123
description:
2025-02-04 23:20:41 dovecot_plain authenticator failed for ([90.188.40.123]) [90.188.40.123]:55684: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.239.251.214
description:
Feb  4 23:20:47 ait sshd[212408]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.239.251.214


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.132.226
description:
Feb  4 23:21:27 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.132.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.25.73.199
description:
2025-02-04 23:21:28 dovecot_plain authenticator failed for ipb21949c7.dynamic.kabel-deutschland.de [178.25.73.199]:45805: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.234.132.226
description:
2025-02-04 23:21:29 dovecot_plain authenticator failed for (static-TB-132-226.kbcnet.rs) [91.234.132.226]:56599: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.215
description:
Feb  4 23:20:47 ait sshd[212404]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.215  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.90.72.18
description:
Feb  4 23:22:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.90.72.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.57.111.99
description:
2025-02-04 23:21:44 dovecot_plain authenticator failed for ([211.57.111.99]) [211.57.111.99]:44048: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.220.196
description:
2025-02-04 23:21:44 dovecot_plain authenticator failed for ([95.221.220.196]) [95.221.220.196]:53996: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.88.67.1
description:
Feb  4 23:21:38 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.88.67.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.103
description:
Feb  4 23:21:52 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
description:
2025-02-04 23:22:01 dovecot_plain authenticator failed for ([121.179.93.147]) [121.179.93.147]:40924: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.7.225.113
description:
Feb  4 23:21:30 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.7.225.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.105.3.221
description:
2025-02-04 23:21:36 dovecot_plain authenticator failed for ([183.105.3.221]) [183.105.3.221]:54010: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.17.165
description:
2025-02-04 23:21:46 dovecot_plain authenticator failed for (abts-north-static-165.17.160.122.airtelbroadband.in) [122.160.17.165]:48498: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.89.232.138
description:
2025-02-04 23:21:47 dovecot_plain authenticator failed for ([159.89.232.138]) [159.89.232.138]:53898: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.136.172.98
description:
2025-02-04 23:21:58 dovecot_plain authenticator failed for ([197.136.236.1]) [197.136.172.98]:51768: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.104.162
description:
2025-02-04 23:22:07 dovecot_plain authenticator failed for ([36.112.104.162]) [36.112.104.162]:58726: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.173.82.198
description:
2025-02-04 23:21:39 dovecot_plain authenticator failed for ([222.173.82.198]) [222.173.82.198]:47510: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.142.8
description:
Feb  4 23:21:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.142.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.130.182
description:
2025-02-04 23:21:41 dovecot_plain authenticator failed for ([183.236.130.182]) [183.236.130.182]:41087: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.193.92
description:
2025-02-04 23:21:44 dovecot_plain authenticator failed for vps-de4e2f27.vps.ovh.net [51.77.193.92]:59206: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.30.108.247
description:
Feb  4 23:21:54 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.30.108.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-02-04 23:21:59 dovecot_plain authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:57087: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.233.77.136
description:
Feb  4 23:22:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.233.77.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 132.247.87.75
description:
Feb  4 23:22:02 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 132.247.87.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.28.137.25
description:
2025-02-04 23:21:36 dovecot_plain authenticator failed for ([112.28.137.25]) [112.28.137.25]:59963: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.193.92
description:
Feb  4 23:21:42 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.77.193.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.203.210.119
description:
2025-02-04 23:22:04 dovecot_plain authenticator failed for ([103.203.210.119]) [103.203.210.119]:50315: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.226.228
description:
Feb  4 23:21:52 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.226.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.139.39.106
description:
Feb  4 23:21:49 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.139.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.0.61.49
description:
Feb  4 23:21:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.0.61.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.85.12.142
description:
Feb  4 23:21:44 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.85.12.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.111.164
description:
2025-02-04 23:21:38 dovecot_plain authenticator failed for ([38.20.111.164]) [38.20.111.164]:58068: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.130.182
description:
Feb  4 23:21:39 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.130.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.72
description:
Feb  4 23:21:55 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.176.249.35
description:
2025-02-04 23:21:59 dovecot_plain authenticator failed for ([112.176.249.35]) [112.176.249.35]:33198: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.215.87.163
description:
2025-02-04 23:22:03 dovecot_plain authenticator failed for ([221.215.87.163]) [221.215.87.163]:37951: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.77.136
description:
2025-02-04 23:22:03 dovecot_plain authenticator failed for ([80.233.77.136]) [80.233.77.136]:8844: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.238.213
description:
Feb  4 23:21:33 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.238.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.223.176.171
description:
Feb  4 23:21:34 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.223.176.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.249.234.242
description:
Feb  4 23:21:57 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.249.234.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.249.234.242
description:
2025-02-04 23:21:59 dovecot_plain authenticator failed for pool-96-249-234-242.nrflva.fios.verizon.net [96.249.234.242]:53023: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.88.67.1
description:
2025-02-04 23:21:40 dovecot_plain authenticator failed for (wtl.worldcall.net.pk) [111.88.67.1]:42303: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.220.196
description:
Feb  4 23:21:42 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.220.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.199.147
description:
2025-02-04 23:21:40 dovecot_plain authenticator failed for (m121-202-199-147.smartone.com) [121.202.199.147]:52830: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.111.99
description:
Feb  4 23:21:42 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.111.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.190.139.137
description:
Feb  4 23:21:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.190.139.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.136.172.98
description:
Feb  4 23:21:56 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.136.172.98 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.90.117.171
description:
[2025-02-04 23:22:13 +0100] info [webmaild] 189.90.117.171 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.231.247.210
description:
Feb  4 23:21:34 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.231.247.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.231.247.210
description:
2025-02-04 23:21:36 dovecot_plain authenticator failed for ([101.231.247.210]) [101.231.247.210]:36522: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.154.149
description:
Feb  4 23:21:34 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.154.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.35.199.239
description:
2025-02-04 23:21:34 dovecot_plain authenticator failed for (199.35.89.239.bcube.co.uk) [89.35.199.239]:36958: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.220.16.46
description:
2025-02-04 23:21:38 dovecot_plain authenticator failed for ([119.220.16.46]) [119.220.16.46]:47733: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
description:
2025-02-04 23:21:40 dovecot_plain authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:51153: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.28.154.169
description:
Feb  4 23:21:30 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.28.154.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.11.20.130
description:
Feb  4 23:21:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.11.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.247.87.75
description:
2025-02-04 23:22:04 dovecot_plain authenticator failed for ([132.247.87.75]) [132.247.87.75]:51267: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.33.162
description:
Feb  4 23:21:35 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.33.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.111
description:
2025-02-04 23:21:44 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.111]:33772: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.20.111.164
description:
Feb  4 23:21:36 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.20.111.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.136.29.20
description:
Feb  4 23:22:11 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.136.29.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.174.209.160
description:
Feb  4 23:22:00 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.174.209.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.227.2.181
description:
Feb  4 23:22:10 ait sshd[212845]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.227.2.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.82.135.154
description:
2025-02-04 23:21:31 dovecot_plain authenticator failed for ([1.82.135.154]) [1.82.135.154]:46192: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.14.180.34
description:
2025-02-04 23:21:35 dovecot_plain authenticator failed for ([218.14.180.34]) [218.14.180.34]:60713: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.85.12.142
description:
2025-02-04 23:21:46 dovecot_plain authenticator failed for ([61.85.12.142]) [61.85.12.142]:54194: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.72
description:
2025-02-04 23:21:57 dovecot_plain authenticator failed for (72.20.167.124.adsl-pool.sx.cn) [124.167.20.72]:54362: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.227.30.210
description:
Feb  4 23:21:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.227.30.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.246
description:
Feb  4 23:21:33 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.33.162
description:
2025-02-04 23:21:37 dovecot_plain authenticator failed for ([183.237.33.162]) [183.237.33.162]:55260: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.137.159
description:
Feb  4 23:21:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.137.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.255.45
description:
Feb  4 23:21:51 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.255.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.176.249.35
description:
Feb  4 23:21:57 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.176.249.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Feb  4 23:21:58 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.151.238.186
description:
[2025-02-04 23:22:13 +0100] info [webmaild] 45.151.238.186 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.72.153.14
description:
Feb  4 23:21:35 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.72.153.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
description:
2025-02-04 23:21:35 dovecot_plain authenticator failed for ([116.114.84.246]) [116.114.84.246]:58532: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
description:
2025-02-04 23:21:36 dovecot_plain authenticator failed for ([50.223.176.171]) [50.223.176.171]:40477: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.32.19.205
description:
Feb  4 23:21:45 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.32.19.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.128.78
description:
Feb  4 23:21:54 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.128.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.250.149.90
description:
Feb  4 23:21:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.250.149.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.193.106.140
description:
Feb  4 23:21:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.193.106.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.17.165
description:
Feb  4 23:21:44 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.17.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.32.19.205
description:
2025-02-04 23:21:47 dovecot_plain authenticator failed for 114-32-19-205.hinet-ip.hinet.net [114.32.19.205]:36356: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.11.119
description:
2025-02-04 23:21:51 dovecot_plain authenticator failed for ([122.175.11.119]) [122.175.11.119]:33795: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.103
description:
2025-02-04 23:21:54 dovecot_plain authenticator failed for 111-70-49-103.emome-ip.hinet.net [111.70.49.103]:36104: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.100.18.224
description:
2025-02-04 23:21:56 dovecot_plain authenticator failed for ([183.100.18.224]) [183.100.18.224]:40894: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-02-04 23:22:00 dovecot_plain authenticator failed for ([186.200.249.162]) [186.200.249.162]:49167: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.149.90
description:
2025-02-04 23:21:33 dovecot_plain authenticator failed for ([110.226.126.143]) [103.250.149.90]:52456: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.54.150
description:
Feb  4 23:21:36 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.54.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.62
description:
Feb  4 23:21:50 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.30.108.247
description:
2025-02-04 23:21:56 dovecot_plain authenticator failed for static-host119-30-108-247.link.net.pk [119.30.108.247]:59295: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
description:
2025-02-04 23:21:56 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:57214: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.136.29.20
description:
2025-02-04 23:22:13 dovecot_plain authenticator failed for ([114.53.252.246]) [124.136.29.20]:22084: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.246.255.174
description:
Feb  4 23:21:44 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.246.255.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.142.8
description:
2025-02-04 23:21:49 dovecot_plain authenticator failed for 95-165-142-8.static.spd-mgts.ru [95.165.142.8]:55152: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.173.82.198
description:
Feb  4 23:21:37 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.173.82.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
description:
2025-02-04 23:21:45 dovecot_plain authenticator failed for ([211.106.126.27]) [211.106.126.27]:57714: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.163.182.162
description:
Feb  4 23:21:50 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.163.182.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.198.129.54
description:
2025-02-04 23:21:59 dovecot_plain authenticator failed for ip54-129-198-217.pool-bba.aruba.it [217.198.129.54]:49470: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Feb  4 23:21:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-02-04 23:21:33 dovecot_plain authenticator failed for (www.safecleen.com) [58.49.113.138]:10246: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.54.150
description:
2025-02-04 23:21:38 dovecot_plain authenticator failed for (150.54.169.61.dial.xw.sh.dynamic.163data.com.cn) [61.169.54.150]:41659: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.177.40.85
description:
Feb  4 23:21:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.177.40.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.106.126.27
description:
Feb  4 23:21:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.106.126.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.154.175
description:
Feb  4 23:21:48 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.154.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.198.129.54
description:
Feb  4 23:21:57 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.198.129.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.7.225.113
description:
2025-02-04 23:21:32 dovecot_plain authenticator failed for (113.225.7.186.f.dyn.claro.net.do) [186.7.225.113]:41972: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.227.30.210
description:
2025-02-04 23:21:33 dovecot_plain authenticator failed for ([112.227.30.210]) [112.227.30.210]:48135: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.198.138.185
description:
Feb  4 23:21:39 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.198.138.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.248.205.14
description:
Feb  4 23:21:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.248.205.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.182.162
description:
2025-02-04 23:21:52 dovecot_plain authenticator failed for ([61.83.232.94]) [221.163.182.162]:55016: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
description:
Feb  4 23:21:54 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.220.16.46
description:
Feb  4 23:21:36 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.220.16.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.72.153.14
description:
2025-02-04 23:21:37 dovecot_plain authenticator failed for (160.72.153.14.lightower.net) [160.72.153.14]:50294: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.36.238.213
description:
2025-02-04 23:21:35 dovecot_plain authenticator failed for ip213.ip-54-36-238.eu [54.36.238.213]:33934: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.115
description:
2025-02-04 23:21:40 dovecot_plain authenticator failed for (m121-202-152-115.smartone.com) [121.202.152.115]:6123: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.198.138.185
description:
2025-02-04 23:21:41 dovecot_plain authenticator failed for ([120.198.138.185]) [120.198.138.185]:34585: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Feb  4 23:21:57 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.28.137.25
description:
Feb  4 23:21:34 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.28.137.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.105.3.221
description:
Feb  4 23:21:34 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.105.3.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.91.67
description:
Feb  4 23:21:51 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.91.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.174.209.160
description:
2025-02-04 23:22:02 dovecot_plain authenticator failed for ([220.174.209.156]) [220.174.209.160]:49942: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.96
description:
2025-02-04 23:21:31 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:57298: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.0.61.49
description:
2025-02-04 23:21:45 dovecot_plain authenticator failed for ([27.0.61.49]) [27.0.61.49]:53184: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.246.255.174
description:
2025-02-04 23:21:46 dovecot_plain authenticator failed for ([185.246.255.174]) [185.246.255.174]:57816: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
description:
Feb  4 23:21:49 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.62
description:
2025-02-04 23:21:52 dovecot_plain authenticator failed for (m121-202-154-62.smartone.com) [121.202.154.62]:30106: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.103.74
description:
2025-02-04 23:21:58 dovecot_plain authenticator failed for ([27.72.103.74]) [27.72.103.74]:56468: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.112.104.162
description:
Feb  4 23:22:05 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.112.104.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.14.180.34
description:
Feb  4 23:21:33 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.14.180.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.232.138
description:
Feb  4 23:21:45 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.232.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.193.106.140
description:
2025-02-04 23:21:34 dovecot_plain authenticator failed for ([122.193.106.140]) [122.193.106.140]:39183: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.115
description:
Feb  4 23:21:38 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.137.159
description:
2025-02-04 23:21:49 dovecot_plain authenticator failed for (abts-tn-static-159.137.165.122.airtelbroadband.in) [122.165.137.159]:57070: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.255.45
description:
2025-02-04 23:21:53 dovecot_plain authenticator failed for (27-123-255-45-mcnbd.com) [27.123.255.45]:50080: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.72.103.74
description:
Feb  4 23:21:56 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.72.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.90.72.18
description:
2025-02-04 23:22:15 dovecot_plain authenticator failed for ([125.90.72.18]) [125.90.72.18]:57715: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.28.154.169
description:
2025-02-04 23:21:32 dovecot_plain authenticator failed for s169-154-28-8.gec.tx.wi-power.com [8.28.154.169]:34553: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.35.199.239
description:
Feb  4 23:21:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.35.199.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.226.228
description:
2025-02-04 23:21:54 dovecot_plain authenticator failed for broadband-77-37-226-228.ip.moscow.rt.ru [77.37.226.228]:55432: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.227.2.181
description:
Feb  4 23:22:10 ait sshd[212845]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.227.2.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.160.70
description:
2025-02-04 23:21:44 dovecot_plain authenticator failed for ([183.238.160.70]) [183.238.160.70]:49023: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.39.106
description:
2025-02-04 23:21:51 dovecot_plain authenticator failed for ([219.139.39.106]) [219.139.39.106]:40978: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.175.11.119
description:
Feb  4 23:21:49 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.175.11.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.91.67
description:
2025-02-04 23:21:53 dovecot_plain authenticator failed for ([39.164.91.67]) [39.164.91.67]:52830: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.128.78
description:
2025-02-04 23:21:56 dovecot_plain authenticator failed for ([65.20.128.78]) [65.20.128.78]:52636: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.203.210.119
description:
Feb  4 23:22:02 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.203.210.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.59.94.130
description:
2025-02-04 23:21:31 dovecot_plain authenticator failed for (rw-00130-94.59.137.rcil.gov.in) [137.59.94.130]:35850: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.154.149
description:
2025-02-04 23:21:36 dovecot_plain authenticator failed for ([175.156.154.149]) [175.156.154.149]:57223: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.248.205.14
description:
2025-02-04 23:21:45 dovecot_plain authenticator failed for ([220.248.205.14]) [220.248.205.14]:1276: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
description:
Feb  4 23:21:59 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.199.147
description:
Feb  4 23:21:38 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.199.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.111
description:
Feb  4 23:21:42 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.100.18.224
description:
Feb  4 23:21:54 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.100.18.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.11.20.130
description:
2025-02-04 23:21:34 dovecot_plain authenticator failed for ([60.11.20.130]) [60.11.20.130]:47306: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.190.139.137
description:
2025-02-04 23:21:49 dovecot_plain authenticator failed for (c-50-190-139-137.unallocated.comcastbusiness.net) [50.190.139.137]:46828: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.40.85
description:
2025-02-04 23:21:45 dovecot_plain authenticator failed for ([103.177.40.85]) [103.177.40.85]:59107: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.174.182.38
description:
Feb  4 23:21:38 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.174.182.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.160.70
description:
Feb  4 23:21:42 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.160.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
description:
2025-02-04 23:21:50 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.154.175]:55442: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
description:
2025-02-04 23:21:51 dovecot_plain authenticator failed for ([203.252.10.5]) [203.252.10.3]:14798: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.53.114.86
description:
Feb  4 23:24:25 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.53.114.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.75.218.103
description:
Feb  4 23:24:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.75.218.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.30.44.113
description:
Feb  4 23:23:38 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.30.44.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 23:24:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.104
description:
Feb  4 23:24:25 ait sshd[213721]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.53.114.86
description:
2025-02-04 23:24:27 dovecot_plain authenticator failed for syn-067-053-114-086.biz.spectrum.com [67.53.114.86]:35951: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.82.33
description:
Feb  4 23:24:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.82.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.224.89.112
description:
Feb  4 23:23:42 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.224.89.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.88.154.47
description:
Feb  4 23:24:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.88.154.47 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.239.251.214
description:
Feb  4 23:24:24 ait sshd[213701]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.239.251.214


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.88.154.47
description:
2025-02-04 23:24:15 dovecot_plain authenticator failed for (47.154.88.116.starhub.net.sg) [116.88.154.47]:52845: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.251.214
description:
Feb  4 23:24:24 ait sshd[213701]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.239.251.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.104
description:
Feb  4 23:24:25 ait sshd[213721]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.149.57
description:
Feb  4 23:24:51 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.149.57 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.113.3.87
description:
Feb  4 23:25:03 ait sshd[214097]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.113.3.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.149.90
description:
2025-02-04 23:25:09 dovecot_plain authenticator failed for ([110.226.126.143]) [103.250.149.90]:34380: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.120.253.62
description:
[2025-02-04 23:25:23 +0100] info [webmaild] 196.120.253.62 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.189.61.189
description:
Feb  4 23:24:44 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.189.61.189 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.62.238.156
description:
[2025-02-04 23:24:52 +0100] info [webmaild] 187.62.238.156 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.113.3.87
description:
Feb  4 23:25:03 ait sshd[214097]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.113.3.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.16
description:
Feb  4 23:25:21 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.16 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.72.121.10
description:
Feb  4 23:24:38 ait sshd[213885]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.72.121.10


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.16
description:
2025-02-04 23:25:23 dovecot_plain authenticator failed for ([121.202.155.16]) [121.202.155.16]:11548: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  4 23:25:27 ait sshd[214174]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
description:
2025-02-04 23:24:31 dovecot_plain authenticator failed for ([103.55.89.5]) [116.75.218.103]:34656: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.72.121.10
description:
Feb  4 23:24:38 ait sshd[213885]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.72.121.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.127.124.229
description:
Feb  4 23:24:45 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.127.124.229 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  4 23:25:27 ait sshd[214174]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
description:
2025-02-04 23:24:33 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:51889: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.127.124.229
description:
2025-02-04 23:24:47 dovecot_plain authenticator failed for 229.red-217-127-124.staticip.rima-tde.net [217.127.124.229]:38501: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.61.100.190
description:
[2025-02-04 23:24:59 +0100] info [webmaild] 187.61.100.190 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.250.149.90
description:
Feb  4 23:25:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.250.149.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.127.68.180
description:
Feb  4 23:25:22 ait sshd[214147]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.127.68.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
description:
Feb  4 23:24:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.189.61.189
description:
2025-02-04 23:24:46 dovecot_plain authenticator failed for (181-189-61-189.ndtelecompb.com.br) [181.189.61.189]:53469: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.149.57
description:
2025-02-04 23:24:53 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.149.57]:35828: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.82.33
description:
2025-02-04 23:24:31 dovecot_plain authenticator failed for ([94.205.82.33]) [94.205.82.33]:44812: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.127.68.180
description:
Feb  4 23:25:22 ait sshd[214147]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.68.180


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.80.40.69
description:
[2025-02-04 23:25:34 +0100] info [webmaild] 170.80.40.69 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 52.169.207.183
domain: elibrary-edu.net
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:23-25.52.169.207.183||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.229
description:
2025-02-04 23:26:16 dovecot_plain authenticator failed for (m121-202-153-229.smartone.com) [121.202.153.229]:63058: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.176.249.35
description:
Feb  4 23:26:06 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.176.249.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.231.61
description:
Feb  4 23:26:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.239.231.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.169.207.183
domain: elibrary-edu.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-content/uploads/414.php||SC:/home/titlemas/public_html/elibrary-edu.net/wp-content


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.108.186.10
description:
Feb  4 23:25:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.108.186.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.92.119.246
description:
2025-02-04 23:26:00 dovecot_plain authenticator failed for ([187.92.119.246]) [187.92.119.246]:37844: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.195.217.94
description:
Feb  4 23:26:05 ait sshd[214496]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.195.217.94  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.31.80.166
description:
Feb  4 23:26:25 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.31.80.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.246.241.234
description:
2025-02-04 23:26:27 dovecot_plain authenticator failed for ([210.22.130.22]) [58.246.241.234]:42257: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.195.217.94
description:
Feb  4 23:26:05 ait sshd[214496]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.195.217.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.176.249.35
description:
2025-02-04 23:26:08 dovecot_plain authenticator failed for ([112.176.249.35]) [112.176.249.35]:56385: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.229
description:
Feb  4 23:26:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.239.231.61
description:
2025-02-04 23:26:15 dovecot_plain authenticator failed for ([222.239.231.61]) [222.239.231.61]:17464: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.246.241.234
description:
Feb  4 23:26:25 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.246.241.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.108.186.10
description:
2025-02-04 23:25:55 dovecot_plain authenticator failed for ([78.108.186.10]) [78.108.186.10]:47762: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.92.119.246
description:
Feb  4 23:25:58 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.92.119.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.80.166
description:
2025-02-04 23:26:27 dovecot_plain authenticator failed for ([1.31.80.166]) [1.31.80.166]:58912: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
description:
2025-02-04 23:26:55 dovecot_plain authenticator failed for ([70.89.116.5]) [70.89.116.5]:55237: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.182.71.73
description:
Feb  4 23:27:06 ait sshd[214844]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.182.71.73  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.42.80
description:
Feb  4 23:26:50 ait sshd[214796]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.42.80  user=lemsas


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.89.116.5
description:
Feb  4 23:26:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.89.116.5 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.231.137.153
description:
Feb  4 23:26:56 ait sshd[214805]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.231.137.153


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.12.90.118
description:
Feb  4 23:27:30 ait sshd[214895]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.90.118


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.90.118
description:
Feb  4 23:27:30 ait sshd[214895]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.12.90.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.42.80
description:
Feb  4 23:26:50 ait sshd[214796]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.42.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.231.137.153
description:
Feb  4 23:26:56 ait sshd[214805]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.231.137.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.182.71.73
description:
Feb  4 23:27:06 ait sshd[214844]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.182.71.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.252.168.97
description:
Feb  4 23:27:20 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.252.168.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.168.97
description:
2025-02-04 23:27:22 dovecot_plain authenticator failed for ([211.252.168.97]) [211.252.168.97]:27469: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.42.80
description:
Feb  4 23:27:48 ait sshd[215101]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.42.80 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.191.162.83
description:
[2025-02-04 23:27:34 +0100] info [webmaild] 45.191.162.83 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.22.214.214
description:
Feb  4 23:27:35 ait sshd[215048]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.214.214


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
description:
2025-02-04 23:27:38 dovecot_plain authenticator failed for ([200.149.51.186]) [200.149.51.186]:49354: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.110.77
description:
Feb  4 23:27:48 ait sshd[215098]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.110.77  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.104
description:
Feb  4 23:28:09 ait sshd[215259]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.104


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.112.6.236
description:
[2025-02-04 23:28:15 +0100] info [webmaild] 190.112.6.236 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.218
description:
Feb  4 23:27:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.42.80
description:
Feb  4 23:27:48 ait sshd[215101]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.42.80


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.218
description:
2025-02-04 23:27:49 dovecot_plain authenticator failed for ([121.202.200.218]) [121.202.200.218]:28312: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.104
description:
Feb  4 23:28:09 ait sshd[215259]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.170.49
description:
2025-02-04 23:27:33 dovecot_plain authenticator failed for (201.172.170.49-clientes-izzi.mx) [201.172.170.49]:46243: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
description:
Feb  4 23:27:36 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.22.214.214
description:
Feb  4 23:27:35 ait sshd[215048]: pam_imunify(sshd:auth): [IM360_RBL] The IP 165.22.214.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 197.159.0.211
description:
Feb  4 23:28:13 ait sshd[215297]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.159.0.211  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.172.170.49
description:
Feb  4 23:27:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.172.170.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.159.0.211
description:
Feb  4 23:28:13 ait sshd[215297]: pam_imunify(sshd:auth): [IM360_RBL] The IP 197.159.0.211 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 106.12.90.118
description:
Feb  4 23:27:32 ait sshd[214895]: Failed password for invalid user aitstaff from 106.12.90.118 port 50580 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.238.46.9
description:
[2025-02-04 23:27:40 +0100] info [webmaild] 45.238.46.9 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.110.77
description:
Feb  4 23:27:48 ait sshd[215098]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.110.77 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.252.80.143
description:
[2025-02-04 23:27:51 +0100] info [webmaild] 38.252.80.143 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.96.43.215
description:
Feb  4 23:29:00 ait sshd[215543]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.96.43.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.4.1.40
description:
Feb  4 23:28:46 ait sshd[215498]: pam_imunify(sshd:auth): [IM360_RBL] The IP 142.4.1.40 has been locked due to Imunify RBL


plugin: modsec
rule: 77140880
name: IM360 WAF: Infectors: PHP Injection Attack
abuser: 217.160.25.51
domain: iric.us
description:
IM360 WAF: Infectors: PHP Injection Attack||MVN:ARGS:fw||MV:fwrite||RSV:6.65||T:APACHE||SC:/home/titlemas/public_html/iric.us/wp-content/plugins/wp-term.php


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Feb  4 23:28:51 ait sshd[215512]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Feb  4 23:28:51 ait sshd[215512]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=lemsas


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 142.4.1.40
description:
Feb  4 23:28:46 ait sshd[215498]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.4.1.40  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 86.81.117.20
description:
Feb  4 23:28:54 ait sshd[215533]: pam_imunify(sshd:auth): [IM360_RBL] The IP 86.81.117.20 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 86.81.117.20
description:
Feb  4 23:28:54 ait sshd[215533]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=86.81.117.20


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.37.89.177
description:
Feb  4 23:28:58 ait sshd[215540]: pam_imunify(sshd:auth): [IM360_RBL] The IP 70.37.89.177 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 70.37.89.177
description:
Feb  4 23:28:58 ait sshd[215540]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.37.89.177


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.96.43.215
description:
Feb  4 23:29:00 ait sshd[215543]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.43.215  user=lemsas


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 61.151.239.210
description:
Feb  4 23:30:28 ait sshd[216215]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.151.239.210


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.127.67.83
description:
Feb  4 23:30:00 ait sshd[215958]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.127.67.83 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.127.67.83
description:
Feb  4 23:30:00 ait sshd[215958]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.67.83  user=lemsas


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.192.86.217
description:
[2025-02-04 23:30:07 +0100] info [webmaild] 181.192.86.217 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.251.173.127
description:
[2025-02-04 23:30:14 +0100] info [webmaild] 191.251.173.127 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.151.239.210
description:
Feb  4 23:30:28 ait sshd[216215]: pam_imunify(sshd:auth): [IM360_RBL] The IP 61.151.239.210 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Feb  4 23:29:45 ait sshd[215933]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Feb  4 23:29:45 ait sshd[215933]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.91.172.21
description:
2025-02-04 23:30:16 dovecot_plain authenticator failed for ([219.91.172.21]) [219.91.172.21]:48046: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.189.72.148
description:
Feb  4 23:30:04 ait sshd[216126]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.189.72.148  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.91.172.21
description:
Feb  4 23:30:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.91.172.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.124.11.67
description:
[2025-02-04 23:30:23 +0100] info [webmaild] 177.124.11.67 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.189.72.148
description:
Feb  4 23:30:04 ait sshd[216126]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.189.72.148 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.232.82.40
description:
[2025-02-04 23:30:48 +0100] info [webmaild] 190.232.82.40 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.152.249
description:
Feb  4 23:31:08 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.152.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.17.125.28
description:
Feb  4 23:31:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.17.125.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.205.242
description:
2025-02-04 23:30:34 dovecot_plain authenticator failed for ([218.4.205.242]) [218.4.205.242]:47091: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.20.186.152
description:
[2025-02-04 23:30:49 +0100] info [webmaild] 160.20.186.152 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 23:30:52 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.207.231.65
description:
Feb  4 23:30:58 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.207.231.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.249
description:
2025-02-04 23:31:10 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.152.249]:43948: 535 Incorrect authentication data (set_id=nyarko@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.203.44.120
description:
Feb  4 23:31:28 ait sshd[216526]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.44.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.207.231.65
description:
2025-02-04 23:31:00 dovecot_login authenticator failed for ([111.207.231.67]) [111.207.231.65]:56234: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.65.141.229
description:
Feb  4 23:31:02 ait sshd[216469]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.141.229  user=bin


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.17.125.28
description:
2025-02-04 23:31:12 dovecot_login authenticator failed for ([120.55.170.138]) [183.17.125.28]:6289: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-31.80.76.51.123


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 61.151.239.210
description:
Feb  4 23:30:30 ait sshd[216215]: Failed password for invalid user titedu from 61.151.239.210 port 52730 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.141.229
description:
Feb  4 23:31:02 ait sshd[216469]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.65.141.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.44.120
description:
Feb  4 23:31:28 ait sshd[216526]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.203.44.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.205.242
description:
Feb  4 23:30:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.205.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.81.78.32
description:
Feb  4 23:31:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.81.78.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.81.78.32
description:
2025-02-04 23:31:34 dovecot_plain authenticator failed for ([185.81.78.32]) [185.81.78.32]:41094: 535 Incorrect authentication data (set_id=nyarko)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.39.191.14
description:
Feb  4 23:31:56 ait sshd[216740]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.39.191.14 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.32.227.248
description:
Feb  4 23:31:40 ait sshd[216679]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.32.227.248  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.168.58.245
description:
Feb  4 23:31:47 ait sshd[216691]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.168.58.245 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.168.58.245
description:
Feb  4 23:31:47 ait sshd[216691]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.168.58.245  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.39.191.14
description:
Feb  4 23:31:56 ait sshd[216740]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.191.14  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.32.227.248
description:
Feb  4 23:31:40 ait sshd[216679]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.32.227.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.37.79.117
description:
Feb  4 23:32:44 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.37.79.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
description:
Feb  4 23:33:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.195.103
description:
Feb  4 23:33:26 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.195.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.160.38.13
description:
Feb  4 23:33:26 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.160.38.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.89.99
description:
2025-02-04 23:33:28 dovecot_plain authenticator failed for ([177.174.89.105]) [177.174.89.99]:40540: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.43.137.90
description:
2025-02-04 23:33:17 dovecot_plain authenticator failed for ([14.43.137.90]) [14.43.137.90]:51560: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.70.9.114
description:
Feb  4 23:33:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.70.9.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.145.163.164
description:
Feb  4 23:33:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.145.163.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.203.126
description:
2025-02-04 23:33:14 dovecot_plain authenticator failed for 126-203-29-85.dyn.estpak.ee [85.29.203.126]:59482: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.43.137.90
description:
Feb  4 23:33:15 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.43.137.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.89.99
description:
Feb  4 23:33:26 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.89.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
description:
2025-02-04 23:33:27 dovecot_plain authenticator failed for ([182.76.71.82]) [182.76.71.82]:58448: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.103
description:
2025-02-04 23:33:28 dovecot_plain authenticator failed for (m121-202-195-103.smartone.com) [121.202.195.103]:15288: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.217.229
description:
Feb  4 23:33:15 ait sshd[217165]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.217.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
description:
2025-02-04 23:33:19 dovecot_plain authenticator failed for ([200.37.179.83]) [200.37.179.83]:45909: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.143.166
description:
Feb  4 23:33:24 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.143.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.71.82
description:
Feb  4 23:33:25 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.71.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.154
description:
2025-02-04 23:33:31 dovecot_plain authenticator failed for 111-70-22-154.emome-ip.hinet.net [111.70.22.154]:43473: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.88.91.22
description:
2025-02-04 23:33:15 dovecot_plain authenticator failed for syn-097-088-091-022.res.spectrum.com [97.88.91.22]:41269: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.70.9.114
description:
2025-02-04 23:33:16 dovecot_plain authenticator failed for ([218.70.9.114]) [218.70.9.114]:57635: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.21.148
description:
2025-02-04 23:33:18 dovecot_plain authenticator failed for ([221.167.21.148]) [221.167.21.148]:37890: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
description:
Feb  4 23:33:28 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
description:
2025-02-04 23:33:29 dovecot_plain authenticator failed for ([207.219.221.101]) [207.219.221.101]:52282: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.29.203.126
description:
Feb  4 23:33:12 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.29.203.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.160.38.13
description:
2025-02-04 23:33:28 dovecot_plain authenticator failed for 89-160-38-13.cust.bredband2.com [89.160.38.13]:45506: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.185.225.50
description:
2025-02-04 23:33:30 dovecot_plain authenticator failed for ([220.185.225.50]) [220.185.225.50]:55036: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
description:
2025-02-04 23:33:26 dovecot_plain authenticator failed for 166.143.48.116.static.netvigator.com [116.48.143.166]:42908: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.182.57.108
description:
[2025-02-04 23:32:59 +0100] info [webmaild] 45.182.57.108 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.214.52.214
description:
Feb  4 23:33:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.214.52.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
description:
2025-02-04 23:33:14 dovecot_plain authenticator failed for ([122.187.230.154]) [122.187.230.154]:50150: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.82.102
description:
Feb  4 23:33:16 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.82.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
description:
2025-02-04 23:33:25 dovecot_plain authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:59478: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.238
description:
2025-02-04 23:33:11 dovecot_plain authenticator failed for ([196.191.212.238]) [196.191.212.238]:34832: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.88.91.22
description:
Feb  4 23:33:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.88.91.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.192
description:
Feb  4 23:33:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.233.166.200
description:
2025-02-04 23:33:20 dovecot_plain authenticator failed for ([183.233.166.200]) [183.233.166.200]:57400: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.194.148.132
description:
Feb  4 23:33:24 ait sshd[217270]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.194.148.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.101
description:
Feb  4 23:33:27 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
description:
Feb  4 23:33:27 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.245.31.174
description:
2025-02-04 23:33:29 dovecot_plain authenticator failed for ([183.245.31.174]) [183.245.31.174]:52157: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.37.35.155
description:
2025-02-04 23:33:14 dovecot_plain authenticator failed for c-68-37-35-155.hsd1.mi.comcast.net [68.37.35.155]:45320: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.167.21.148
description:
Feb  4 23:33:16 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.167.21.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.233.166.200
description:
Feb  4 23:33:18 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.233.166.200 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.78.63.166
description:
[2025-02-04 23:33:18 +0100] info [webmaild] 170.78.63.166 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.220.97.188
description:
Feb  4 23:33:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.220.97.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.28.66.78
description:
2025-02-04 23:33:30 dovecot_plain authenticator failed for ([62.28.66.78]) [62.28.66.78]:54652: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.28.66.78
description:
Feb  4 23:33:28 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.28.66.78 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.22.68
description:
[2025-02-04 23:32:36 +0100] info [webmaild] 45.70.22.68 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.238
description:
Feb  4 23:33:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.37.35.155
description:
Feb  4 23:33:12 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.37.35.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.154
description:
Feb  4 23:33:12 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
description:
2025-02-04 23:33:16 dovecot_plain authenticator failed for (fisercus) [102.53.15.18]:39505: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.37.79.117
description:
2025-02-04 23:32:46 dovecot_plain authenticator failed for (dsl-104-37-79-117.dellcity.com) [104.37.79.117]:46978: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.39.187.16
description:
Feb  4 23:33:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.39.187.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.192
description:
2025-02-04 23:33:16 dovecot_plain authenticator failed for ([178.178.194.192]) [178.178.194.192]:39410: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.163.164
description:
2025-02-04 23:33:16 dovecot_plain authenticator failed for ([61.145.163.164]) [61.145.163.164]:53217: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
description:
2025-02-04 23:33:30 dovecot_plain authenticator failed for ([222.114.200.160]) [222.114.200.160]:44229: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.214.52.214
description:
2025-02-04 23:33:15 dovecot_plain authenticator failed for ([175.214.52.214]) [175.214.52.214]:46676: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.82.102
description:
2025-02-04 23:33:18 dovecot_plain authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:58084: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.236.162.125
description:
Feb  4 23:33:21 ait sshd[217228]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.236.162.125  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.39.187.16
description:
2025-02-04 23:33:15 dovecot_plain authenticator failed for ([189.39.187.16]) [189.39.187.16]:39069: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
description:
2025-02-04 23:33:29 dovecot_plain authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:55920: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.37.179.83
description:
Feb  4 23:33:17 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.37.179.83 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.194.148.132
description:
Feb  4 23:33:24 ait sshd[217270]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.194.148.132  user=bin


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.239.255.163
description:
2025-02-04 23:32:48 dovecot_plain authenticator failed for (uncon) [77.239.255.163]:43552: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.151.20.214
description:
Feb  4 23:33:11 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.151.20.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.151.20.214
description:
2025-02-04 23:33:13 dovecot_plain authenticator failed for p509714d6.dip0.t-ipconnect.de (moloato) [80.151.20.214]:41561: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.245.31.174
description:
Feb  4 23:33:27 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.245.31.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.22.154
description:
Feb  4 23:33:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.22.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.239.255.163
description:
Feb  4 23:32:46 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.239.255.163 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.217.229
description:
Feb  4 23:33:15 ait sshd[217165]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.217.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.185.225.50
description:
Feb  4 23:33:28 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.185.225.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.4.202.144
description:
[2025-02-04 23:33:31 +0100] info [webmaild] 45.4.202.144 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.117.144.194
description:
2025-02-04 23:33:33 dovecot_plain authenticator failed for ([211.117.144.194]) [211.117.144.194]:39040: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.240.204.168
description:
2025-02-04 23:33:33 dovecot_plain authenticator failed for 60-240-204-168.static.tpgi.com.au [60.240.204.168]:52943: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.218
description:
Feb  4 23:33:36 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.214.52.214
description:
2025-02-04 23:33:40 dovecot_plain authenticator failed for ([175.214.52.214]) [175.214.52.214]:48372: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.242.169.144
description:
2025-02-04 23:33:47 dovecot_plain authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [117.242.169.144]:46702: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.104.199.27
description:
2025-02-04 23:33:55 dovecot_plain authenticator failed for ([120.24.83.156]) [223.104.199.27]:10048: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.214.52.214
description:
Feb  4 23:33:38 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.214.52.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.121.229
description:
Feb  4 23:33:38 ait sshd[217315]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.121.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.17.122
description:
2025-02-04 23:33:48 dovecot_plain authenticator failed for ([220.182.17.122]) [220.182.17.122]:49432: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.39.158
description:
Feb  4 23:33:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.39.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.144.140
description:
2025-02-04 23:33:33 dovecot_plain authenticator failed for ([112.15.144.140]) [112.15.144.140]:57918: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.172.46.10
description:
Feb  4 23:33:51 ait sshd[217629]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.172.46.10


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.104.199.27
description:
Feb  4 23:33:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.104.199.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.168.78
description:
2025-02-04 23:33:33 dovecot_plain authenticator failed for (78-168-168-45.weblinknet.com.br) [45.168.168.78]:49959: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.39.158
description:
2025-02-04 23:33:33 dovecot_plain authenticator failed for 95-31-39-158.broadband.corbina.ru [95.31.39.158]:57232: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.188.207.151
description:
Feb  4 23:33:51 ait sshd[217631]: pam_imunify(sshd:auth): [IM360_RBL] The IP 199.188.207.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
description:
2025-02-04 23:33:58 dovecot_plain authenticator failed for ([175.206.113.91]) [175.206.113.91]:47794: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.144.140
description:
Feb  4 23:33:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.144.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.168.78
description:
Feb  4 23:33:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.168.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.242.169.144
description:
Feb  4 23:33:45 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.242.169.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.117.144.194
description:
Feb  4 23:33:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.117.144.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.240.204.168
description:
Feb  4 23:33:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.240.204.168 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.121.229
description:
Feb  4 23:33:38 ait sshd[217315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.121.229  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.172.46.10
description:
Feb  4 23:33:51 ait sshd[217629]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.172.46.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.113.91
description:
Feb  4 23:33:56 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.113.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 23:34:17 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.218
description:
2025-02-04 23:33:38 dovecot_plain authenticator failed for ([121.202.200.218]) [121.202.200.218]:57886: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.17.122
description:
Feb  4 23:33:46 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.17.122 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 199.188.207.151
description:
Feb  4 23:33:51 ait sshd[217631]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=199.188.207.151


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.234.245.7
description:
Feb  4 23:33:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.234.245.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.234.245.7
description:
2025-02-04 23:33:49 dovecot_plain authenticator failed for (net245.234.188-7.ertelecom.ru) [188.234.245.7]:51404: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.103.231
description:
Feb  4 23:35:06 ait sshd[218269]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.103.231  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.140.244.144
description:
Feb  4 23:35:20 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.140.244.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 216.10.214.61
description:
[2025-02-04 23:35:30 +0100] info [webmaild] 216.10.214.61 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.79.37.166
domain: aitstaff.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/admin/upload/css.php||SC:/home/titlemas/public_html/AITSTAFF.NET/admin


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.103.231
description:
Feb  4 23:35:06 ait sshd[218269]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.103.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 23:35:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 13.79.37.166
domain: aitstaff.net
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:23-34.13.79.37.166||RSV:6.65||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.131.159.132
description:
[2025-02-04 23:35:10 +0100] info [webmaild] 177.131.159.132 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.140.244.144
description:
2025-02-04 23:35:22 dovecot_plain authenticator failed for ([125.140.244.144]) [125.140.244.144]:41366: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.16.85.102
description:
Feb  4 23:35:48 ait sshd[218611]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.16.85.102 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.16.85.102
description:
Feb  4 23:35:48 ait sshd[218611]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.16.85.102


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.196.221.74
description:
Feb  4 23:35:52 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.196.221.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.59.125
description:
Feb  4 23:35:41 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.59.125 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.57.145.180
description:
[2025-02-04 23:35:42 +0100] info [webmaild] 167.57.145.180 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.151.218.110
description:
Feb  4 23:36:03 ait sshd[218666]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.151.218.110


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.158.161.99
description:
Feb  4 23:36:29 ait sshd[218757]: pam_imunify(sshd:auth): [IM360_RBL] The IP 124.158.161.99 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.158.161.99
description:
Feb  4 23:36:29 ait sshd[218757]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.158.161.99


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.142.107.84
description:
[2025-02-04 23:36:05 +0100] info [webmaild] 102.142.107.84 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.238.237.254
description:
Feb  4 23:36:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.238.237.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.238.237.254
description:
2025-02-04 23:36:12 dovecot_plain authenticator failed for ([211.238.237.254]) [211.238.237.254]:40937: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.59.125
description:
2025-02-04 23:35:43 dovecot_plain authenticator failed for ([103.171.59.125]) [103.171.59.125]:56694: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.22.201
description:
47.128.22.201 - - [04/Feb/2025:23:35:33 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10469878 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/12/?filter_course-language=99&filtering=1&instructor=2" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.22.201


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.196.221.74
description:
2025-02-04 23:35:54 dovecot_plain authenticator failed for ([159.196.221.74]) [159.196.221.74]:7625: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.151.218.110
description:
Feb  4 23:36:03 ait sshd[218666]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.151.218.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.132.125.226
description:
Feb  4 23:37:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.132.125.226 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.158.161.99
description:
Feb  4 23:36:31 ait sshd[218757]: Failed password for invalid user aitstaff from 124.158.161.99 port 37656 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.244.213.234
description:
Feb  4 23:36:55 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.244.213.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.4
description:
Feb  4 23:37:05 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.4
description:
2025-02-04 23:37:07 dovecot_plain authenticator failed for ([203.252.10.4]) [203.252.10.4]:39661: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.82.18
description:
Feb  4 23:37:12 ait sshd[219007]: pam_imunify(sshd:auth): [IM360_RBL] The IP 67.213.82.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.132.125.226
description:
2025-02-04 23:37:16 dovecot_plain authenticator failed for ip79-132-125-226.ulk.host.ttk.ru [79.132.125.226]:51736: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
description:
2025-02-04 23:37:27 dovecot_plain authenticator failed for (Bundle-Ether3.2581.static.gvt.net.br) [177.43.106.73]:43530: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.244.213.234
description:
2025-02-04 23:36:57 dovecot_plain authenticator failed for ([115.244.213.234]) [115.244.213.234]:49358: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 67.213.82.18
description:
Feb  4 23:37:12 ait sshd[219007]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.213.82.18  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
description:
Feb  4 23:37:25 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.240.236.214
description:
Feb  4 23:38:18 ait sshd[219382]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.240.236.214 has been locked due to Imunify RBL


