# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 198.145.118.138
description:
[2025-02-04 02:17:58 +0100] info [webmaild] 198.145.118.138 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.111.34
description:
Feb  4 02:18:16 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.111.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.202.80.152
description:
Feb  4 02:18:26 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.202.80.152 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 150.107.107.36
description:
[2025-02-04 02:18:08 +0100] info [webmaild] 150.107.107.36 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.212.37.145
description:
Feb  4 02:18:15 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.212.37.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.111.34
description:
2025-02-04 02:18:18 dovecot_plain authenticator failed for ([180.168.111.34]) [180.168.111.34]:38082: 535 Incorrect authentication data (set_id=ads19b00191y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.37.145
description:
2025-02-04 02:18:17 dovecot_plain authenticator failed for (145.37.212.118.adsl-pool.jx.chinaunicom.com) [118.212.37.145]:56090: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.89.60.158
description:
Feb  4 02:19:44 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.89.60.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.89.60.158
description:
2025-02-04 02:19:46 dovecot_plain authenticator failed for ([124.89.60.158]) [124.89.60.158]:40077: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Feb  4 02:18:52 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
description:
Feb  4 02:18:56 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.65.54.204
description:
Feb  4 02:19:41 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.65.54.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.65.54.204
description:
2025-02-04 02:19:43 dovecot_plain authenticator failed for ([121.65.54.204]) [121.65.54.204]:48888: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-02-04 02:18:54 dovecot_plain authenticator failed for (zolion) [91.116.42.218]:57818: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.113.122.243
description:
Feb  4 02:19:08 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.113.122.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.214.127
description:
2025-02-04 02:19:31 dovecot_plain authenticator failed for ([223.241.214.127]) [223.241.214.127]:58400: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-02-04 02:18:58 dovecot_plain authenticator failed for (12-78-123-185.host.cirex.ru) [185.123.78.13]:63343: 535 Incorrect authentication data (set_id=eng19b00204y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.113.122.243
description:
2025-02-04 02:19:10 dovecot_plain authenticator failed for ([210.113.122.243]) [210.113.122.243]:52980: 535 Incorrect authentication data (set_id=eng19b00204y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.241.214.127
description:
Feb  4 02:19:29 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.241.214.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 02:20:01 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Feb  4 02:20:34 ait sshd[3849785]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.189.234.28
description:
2025-02-04 02:20:35 dovecot_plain authenticator failed for ([12.189.234.28]) [12.189.234.28]:33935: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.117.197.238
description:
Feb  4 02:20:23 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.117.197.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.189.234.28
description:
Feb  4 02:20:33 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.189.234.28 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.131.135.172
description:
[2025-02-04 02:20:18 +0100] info [webmaild] 177.131.135.172 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.117.197.238
description:
2025-02-04 02:20:25 dovecot_plain authenticator failed for net-109-117-197-238.cust.vodafonedsl.it [109.117.197.238]:45931: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Feb  4 02:20:34 ait sshd[3849785]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.177.189.176
description:
[2025-02-04 02:20:36 +0100] info [webmaild] 185.177.189.176 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.139.35.161
description:
Feb  4 02:20:06 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.139.35.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.139.35.161
description:
2025-02-04 02:20:08 dovecot_plain authenticator failed for 161.sm-u1.dialup.garlic.net [216.139.35.161]:34082: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.39.9.163
description:
[2025-02-04 02:20:49 +0100] info [webmaild] 177.39.9.163 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.64.129.116
description:
[2025-02-04 02:21:08 +0100] info [webmaild] 196.64.129.116 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.25.225
description:
47.128.25.225 - - [04/Feb/2025:02:21:50 +0100] "GET /wp-content/themes/edumall/assets/images/page-404-image.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17153501" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.25.225


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
description:
2025-02-04 02:21:59 dovecot_plain authenticator failed for ([196.28.226.66]) [196.28.226.66]:41224: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.94.190
description:
Feb  4 02:22:01 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.94.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.94.190
description:
2025-02-04 02:22:03 dovecot_plain authenticator failed for ([39.164.94.190]) [39.164.94.190]:36150: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-02-04 02:22:11 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:56034: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.159.174.136
description:
2025-02-04 02:22:17 dovecot_plain authenticator failed for ([117.159.174.136]) [117.159.174.136]:58676: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.35.63.27
description:
2025-02-04 02:22:31 dovecot_plain authenticator failed for ([110.35.63.27]) [110.35.63.27]:57212: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
description:
2025-02-04 02:22:40 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se [83.254.126.238]:60494: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.238.94
description:
Feb  4 02:21:57 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.238.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Feb  4 02:22:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.139
description:
2025-02-04 02:22:11 dovecot_plain authenticator failed for ([61.108.83.254]) [61.108.83.139]:60685: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.250.134.35
description:
2025-02-04 02:22:12 dovecot_plain authenticator failed for ([130.250.134.35]) [130.250.134.35]:44748: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.35.63.27
description:
Feb  4 02:22:29 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.35.63.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.66
description:
Feb  4 02:21:57 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.179
description:
2025-02-04 02:21:59 dovecot_plain authenticator failed for (static.ill.117.250.107.179.bsnl.co.in) [117.250.107.179]:39438: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.139
description:
Feb  4 02:22:09 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.212.190.170
description:
2025-02-04 02:22:14 dovecot_plain authenticator failed for (176x212x190x170.dynamic.ryazan.ertelecom.ru) [176.212.190.170]:49932: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.143.75.66
description:
Feb  4 02:21:55 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.143.75.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.238.94
description:
2025-02-04 02:21:59 dovecot_plain authenticator failed for 186-247-238-94.user.veloxzone.com.br (186-247-238-241.user.veloxzone.com.br) [186.247.238.94]:49812: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.252.222.82
description:
Feb  4 02:22:10 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.252.222.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.252.222.82
description:
2025-02-04 02:22:12 dovecot_plain authenticator failed for ([58.252.222.82]) [58.252.222.82]:47692: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.159.174.136
description:
Feb  4 02:22:15 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.159.174.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.254.126.238
description:
Feb  4 02:22:38 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.254.126.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.143.75.66
description:
2025-02-04 02:21:57 dovecot_plain authenticator failed for (static-146.220.149.202-tataidc.co.in) [114.143.75.66]:35716: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.250.134.35
description:
Feb  4 02:22:10 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.250.134.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.212.190.170
description:
Feb  4 02:22:12 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.212.190.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.107.179
description:
Feb  4 02:21:57 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.107.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.115.76.186
description:
Feb  4 02:23:21 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.115.76.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
description:
Feb  4 02:23:33 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.146.148.173
description:
Feb  4 02:23:38 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.146.148.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.196.230
description:
Feb  4 02:23:20 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.196.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.131
description:
2025-02-04 02:23:31 dovecot_plain authenticator failed for ([178.178.194.131]) [178.178.194.131]:34456: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.14.33
description:
2025-02-04 02:23:38 dovecot_plain authenticator failed for ([59.2.14.33]) [59.2.14.33]:42946: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.70.28
description:
2025-02-04 02:23:21 dovecot_plain authenticator failed for ([110.34.70.28]) [110.34.70.28]:43007: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.33.44.158
description:
2025-02-04 02:23:24 dovecot_plain authenticator failed for ([89.33.44.158]) [89.33.44.158]:43568: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.50
description:
2025-02-04 02:23:31 dovecot_plain authenticator failed for ([213.154.80.21]) [213.154.80.50]:46016: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.14.33
description:
Feb  4 02:23:36 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.14.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.85.68.71
description:
Feb  4 02:23:37 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.85.68.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.211.130.219
description:
2025-02-04 02:23:36 dovecot_plain authenticator failed for ([185.211.130.219]) [185.211.130.219]:50856: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.241.188
description:
2025-02-04 02:23:37 dovecot_plain authenticator failed for ([85.105.241.188]) [85.105.241.188]:43944: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.69.115.74
description:
Feb  4 02:23:38 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.69.115.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.69.142.186
description:
Feb  4 02:23:26 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.69.142.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.154.94.85
description:
2025-02-04 02:23:26 dovecot_plain authenticator failed for ([43.154.94.85]) [43.154.94.85]:40316: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.54
description:
Feb  4 02:23:23 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.218.7
description:
2025-02-04 02:23:26 dovecot_plain authenticator failed for ([60.173.218.7]) [60.173.218.7]:32813: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
description:
Feb  4 02:23:18 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.115.100.144
description:
2025-02-04 02:23:19 dovecot_plain authenticator failed for 3pc100-144.rconx.com [185.115.100.144]:55441: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.24.215.70
description:
Feb  4 02:23:36 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.24.215.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.52.204.227
description:
Feb  4 02:23:16 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.52.204.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.131
description:
Feb  4 02:23:29 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.155.170.146
description:
Feb  4 02:23:18 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.155.170.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.90.195.68
description:
Feb  4 02:23:30 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.90.195.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
description:
Feb  4 02:23:15 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.242.204.22
description:
Feb  4 02:23:17 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.242.204.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.231.6
description:
2025-02-04 02:23:20 dovecot_plain authenticator failed for ([60.174.231.6]) [60.174.231.6]:43443: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.127.195
description:
Feb  4 02:23:33 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.127.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.76
description:
2025-02-04 02:23:37 dovecot_plain authenticator failed for (95.0.252.76.static.ttnet.com.tr) [95.0.252.76]:45750: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.185.89.241
description:
2025-02-04 02:23:25 dovecot_plain authenticator failed for ([39.185.89.241]) [39.185.89.241]:57880: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.162.59
description:
2025-02-04 02:23:27 dovecot_plain authenticator failed for (223-197-162-59.static.imsbiz.com) [223.197.162.59]:56390: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.212.19.9
description:
2025-02-04 02:23:20 dovecot_plain authenticator failed for ([116.212.19.9]) [116.212.19.9]:58416: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.185.130
description:
2025-02-04 02:23:32 dovecot_plain authenticator failed for ([59.46.185.130]) [59.46.185.130]:34358: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.91.5
description:
Feb  4 02:23:14 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.91.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.113.10
description:
Feb  4 02:23:19 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.42.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.211.130.219
description:
Feb  4 02:23:34 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.211.130.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
description:
2025-02-04 02:23:35 dovecot_plain authenticator failed for ([169.211.232.182]) [169.211.232.182]:37462: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.8.245
description:
Feb  4 02:23:16 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.8.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.185.220.130
description:
2025-02-04 02:23:19 dovecot_plain authenticator failed for ([1.71.191.42]) [183.185.220.130]:6356: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.45.216.101
description:
Feb  4 02:23:34 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.45.216.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.62.233.146
description:
2025-02-04 02:23:32 dovecot_plain authenticator failed for ([103.62.233.146]) [103.62.233.146]:49461: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.8.245
description:
2025-02-04 02:23:18 dovecot_plain authenticator failed for ([65.76.8.245]) [65.76.8.245]:57410: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.154.94.85
description:
Feb  4 02:23:24 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.154.94.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.115.76.186
description:
2025-02-04 02:23:23 dovecot_plain authenticator failed for ool-45734cba.dyn.optonline.net [69.115.76.186]:46558: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.218.7
description:
Feb  4 02:23:24 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.218.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.162.59
description:
Feb  4 02:23:25 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.162.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.13.67.132
description:
2025-02-04 02:23:33 dovecot_plain authenticator failed for ([221.13.67.132]) [221.13.67.132]:45909: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.170.218.142
description:
2025-02-04 02:23:35 dovecot_plain authenticator failed for ([121.170.218.142]) [121.170.218.142]:49336: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.24.215.70
description:
2025-02-04 02:23:38 dovecot_plain authenticator failed for ([195.24.215.70]) [195.24.215.70]:33644: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.41.197.10
description:
2025-02-04 02:23:19 dovecot_plain authenticator failed for ([59.41.197.10]) [59.41.197.10]:56783: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.155.170.146
description:
2025-02-04 02:23:20 dovecot_plain authenticator failed for ([39.155.170.146]) [39.155.170.146]:38875: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.231.6
description:
Feb  4 02:23:18 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.231.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.26.59
description:
2025-02-04 02:23:18 dovecot_plain authenticator failed for ([195.158.26.59]) [195.158.26.59]:56856: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
description:
2025-02-04 02:23:20 dovecot_plain authenticator failed for ([1.227.228.136]) [1.227.228.136]:48962: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Feb  4 02:23:40 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.198.31
description:
Feb  4 02:23:41 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.198.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.146.148.173
description:
2025-02-04 02:23:40 dovecot_plain authenticator failed for ([129.146.148.173]) [129.146.148.173]:42154: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.212.19.9
description:
Feb  4 02:23:18 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.212.19.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.76.95.152
description:
2025-02-04 02:23:16 dovecot_plain authenticator failed for ([62.76.95.152]) [62.76.95.152]:37096: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.79.19
description:
Feb  4 02:23:47 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.187.79.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.39.73.186
description:
2025-02-04 02:23:35 dovecot_plain authenticator failed for (static-50-39-73-186.bvtn.or.ptr.ziplyfiber.com) [50.39.73.186]:46311: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.70.28
description:
Feb  4 02:23:19 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.70.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.13.67.132
description:
Feb  4 02:23:31 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.13.67.132 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.54.136
description:
47.128.54.136 - - [04/Feb/2025:02:23:29 +0100] "GET /wp-content/themes/edumall/assets/images/page-404-image.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15597834" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.54.136


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
description:
2025-02-04 02:23:30 dovecot_plain authenticator failed for ([201.183.225.156]) [201.183.225.156]:33008: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.218.181.19
description:
2025-02-04 02:23:31 dovecot_plain authenticator failed for ([201.218.181.19]) [201.218.181.19]:49730: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.38.202.60
description:
Feb  4 02:23:32 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.38.202.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.49.250
description:
2025-02-04 02:23:35 dovecot_plain authenticator failed for ([58.16.49.250]) [58.16.49.250]:55606: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
description:
2025-02-04 02:23:19 dovecot_plain authenticator failed for ([218.147.6.84]) [218.147.6.84]:35042: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.196.230
description:
2025-02-04 02:23:22 dovecot_plain authenticator failed for ([118.122.196.230]) [118.122.196.230]:38757: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.93.12.184
description:
Feb  4 02:23:30 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.93.12.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.93.12.184
description:
2025-02-04 02:23:32 dovecot_plain authenticator failed for ([124.93.12.184]) [124.93.12.184]:59119: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-02-04 02:23:42 dovecot_plain authenticator failed for ([218.106.120.18]) [58.49.113.138]:12867: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.105.3.221
description:
2025-02-04 02:23:43 dovecot_plain authenticator failed for ([183.105.3.221]) [183.105.3.221]:40096: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.249.25.7
description:
[2025-02-04 02:23:47 +0100] info [webmaild] 186.249.25.7 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.52.204.227
description:
2025-02-04 02:23:18 dovecot_plain authenticator failed for ([46.52.204.227]) [46.52.204.227]:46856: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.54
description:
2025-02-04 02:23:25 dovecot_plain authenticator failed for (m121-202-154-54.smartone.com) [121.202.154.54]:1890: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.127.195
description:
2025-02-04 02:23:35 dovecot_plain authenticator failed for ([39.164.127.195]) [39.164.127.195]:43210: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.216.176.90
description:
Feb  4 02:23:42 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.216.176.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.22.99.2
description:
Feb  4 02:23:17 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.22.99.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.151.150
description:
2025-02-04 02:23:18 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.151.150]:41033: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.222.90.178
description:
2025-02-04 02:23:33 dovecot_plain authenticator failed for ([200.222.80.81]) [200.222.90.178]:53436: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.38.202.60
description:
2025-02-04 02:23:34 dovecot_plain authenticator failed for ([136.38.202.60]) [136.38.202.60]:48462: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.154.80.50
description:
Feb  4 02:23:29 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.154.80.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.90.195.68
description:
2025-02-04 02:23:32 dovecot_plain authenticator failed for (197-90-195-68.dyn.mweb.co.za) [197.90.195.68]:52976: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.46.185.130
description:
Feb  4 02:23:30 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.46.185.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.10.15
description:
Feb  4 02:23:35 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.10.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.29
description:
Feb  4 02:23:37 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.132.61.213
description:
2025-02-04 02:23:40 dovecot_plain authenticator failed for ([124.132.61.213]) [124.132.61.213]:48538: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.79.19
description:
2025-02-04 02:23:49 dovecot_plain authenticator failed for ([103.187.79.19]) [103.187.79.19]:60298: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.24.163.2
description:
Feb  4 02:23:16 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.24.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.183.247
description:
2025-02-04 02:23:27 dovecot_plain authenticator failed for ([207.188.183.247]) [207.188.183.247]:51312: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.142.242
description:
2025-02-04 02:23:39 dovecot_plain authenticator failed for 242.142.48.116.static.netvigator.com [116.48.142.242]:39978: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.146.121.14
description:
2025-02-04 02:23:46 dovecot_plain authenticator failed for ([61.146.121.14]) [61.146.121.14]:36140: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.76.95.152
description:
Feb  4 02:23:14 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.76.95.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.30
description:
2025-02-04 02:23:20 dovecot_plain authenticator failed for ([60.167.19.30]) [60.167.19.30]:35936: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.183.247
description:
Feb  4 02:23:25 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.183.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.252.63.242
description:
2025-02-04 02:23:38 dovecot_plain authenticator failed for ([1.252.63.242]) [1.252.63.242]:35264: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.238.206
description:
Feb  4 02:23:12 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.238.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.238.99.146
description:
[2025-02-04 02:23:15 +0100] info [webmaild] 170.238.99.146 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.42.226.215
description:
Feb  4 02:23:42 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.42.226.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.69.142.186
description:
2025-02-04 02:23:28 dovecot_plain authenticator failed for 61-69-142-186.tpgi.com.au [61.69.142.186]:51477: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.105.241.188
description:
Feb  4 02:23:35 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.105.241.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.218.134.95
description:
Feb  4 02:23:21 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.218.134.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.59.90.121
description:
2025-02-04 02:23:20 dovecot_plain authenticator failed for h-46-59-90-121.a463.priv.bahnhof.se [46.59.90.121]:58061: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.6.78.182
description:
2025-02-04 02:23:20 dovecot_plain authenticator failed for ([189.6.78.182]) [189.6.78.182]:61730: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.183.225.156
description:
Feb  4 02:23:28 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.183.225.156 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.209.186.149
description:
[2025-02-04 02:23:26 +0100] info [webmaild] 186.209.186.149 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.218.181.19
description:
Feb  4 02:23:29 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.218.181.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.238.206
description:
2025-02-04 02:23:14 dovecot_plain authenticator failed for ([95.221.238.206]) [95.221.238.206]:42876: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.26.59
description:
Feb  4 02:23:16 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.26.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.42.226.215
description:
2025-02-04 02:23:44 dovecot_plain authenticator failed for ([58.42.226.215]) [58.42.226.215]:48686: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.24.163.2
description:
2025-02-04 02:23:18 dovecot_plain authenticator failed for syn-098-024-163-002.res.spectrum.com [98.24.163.2]:50198: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.242.204.22
description:
2025-02-04 02:23:19 dovecot_plain authenticator failed for ([222.242.204.22]) [222.242.204.22]:3603: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.231.242
description:
2025-02-04 02:23:21 dovecot_plain authenticator failed for ([124.115.231.242]) [124.115.231.242]:33880: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.170.218.142
description:
Feb  4 02:23:33 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.170.218.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.76
description:
Feb  4 02:23:35 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.185.220.130
description:
Feb  4 02:23:17 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.185.220.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.231.242
description:
Feb  4 02:23:19 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.231.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.144.140
description:
2025-02-04 02:23:49 dovecot_plain authenticator failed for ([112.15.144.140]) [112.15.144.140]:58884: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.252.63.242
description:
Feb  4 02:23:36 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.252.63.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.129.25.70
description:
2025-02-04 02:23:37 dovecot_plain authenticator failed for ([39.129.25.70]) [39.129.25.70]:51737: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.10.15
description:
2025-02-04 02:23:37 dovecot_plain authenticator failed for 111-70-10-15.emome-ip.hinet.net [111.70.10.15]:33976: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.222.90.178
description:
Feb  4 02:23:31 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.222.90.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.39.73.186
description:
Feb  4 02:23:33 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.39.73.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.85.68.71
description:
2025-02-04 02:23:39 dovecot_plain authenticator failed for ([220.85.68.71]) [220.85.68.71]:15357: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.15.177.173
description:
Feb  4 02:23:41 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.15.177.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.144.140
description:
Feb  4 02:23:47 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.144.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.6.78.182
description:
Feb  4 02:23:18 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.6.78.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.250
description:
Feb  4 02:23:21 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.6.68.50
description:
2025-02-04 02:23:20 dovecot_plain authenticator failed for ([221.6.68.50]) [221.6.68.50]:52115: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.33.44.158
description:
Feb  4 02:23:22 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.33.44.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.185.89.241
description:
Feb  4 02:23:23 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.185.89.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.250
description:
2025-02-04 02:23:23 dovecot_plain authenticator failed for ([121.202.154.250]) [121.202.154.250]:2199: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.218.134.95
description:
2025-02-04 02:23:23 dovecot_plain authenticator failed for 32-218-134-95.bng02.trtn.ct.frontiernet.net [32.218.134.95]:35862: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.62.233.146
description:
Feb  4 02:23:30 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.62.233.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-02-04 02:23:17 dovecot_plain authenticator failed for ([186.200.8.115]) [186.200.249.162]:33188: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.6.68.50
description:
Feb  4 02:23:18 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.6.68.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.146.121.14
description:
Feb  4 02:23:44 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.146.121.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.49.250
description:
Feb  4 02:23:33 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Feb  4 02:23:39 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.166.68.184
description:
2025-02-04 02:23:28 dovecot_plain authenticator failed for (5x166x68x184.dynamic.barnaul.ertelecom.ru) [5.166.68.184]:55034: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.15.177.173
description:
2025-02-04 02:23:43 dovecot_plain authenticator failed for ([121.15.177.173]) [121.15.177.173]:52510: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.216.176.90
description:
2025-02-04 02:23:44 dovecot_plain authenticator failed for 32-216-176-90.bng02.brpt.ct.frontiernet.net [32.216.176.90]:63672: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.167.3.81
description:
[2025-02-04 02:22:55 +0100] info [webmaild] 45.167.3.81 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Feb  4 02:23:15 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.166.68.184
description:
Feb  4 02:23:26 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.166.68.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.129.25.70
description:
Feb  4 02:23:35 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.129.25.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.132.61.213
description:
Feb  4 02:23:38 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.132.61.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.105.3.221
description:
Feb  4 02:23:41 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.105.3.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.41.197.10
description:
Feb  4 02:23:17 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.41.197.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
description:
2025-02-04 02:23:17 dovecot_plain authenticator failed for ([211.109.75.68]) [211.109.75.69]:65149: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.142.242
description:
Feb  4 02:23:37 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.142.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.29
description:
2025-02-04 02:23:39 dovecot_plain authenticator failed for ([117.175.160.29]) [117.175.160.29]:43674: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-02-04 02:23:41 dovecot_plain authenticator failed for (abts-north-static-046.68.160.122.airtelbroadband.in) [122.160.68.46]:47700: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.115.100.144
description:
Feb  4 02:23:17 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.115.100.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
description:
2025-02-04 02:23:19 dovecot_plain authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:58380: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.22.99.2
description:
2025-02-04 02:23:19 dovecot_plain authenticator failed for ([121.22.99.2]) [121.22.99.2]:51050: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
description:
2025-02-04 02:23:21 dovecot_plain authenticator failed for ([182.42.113.10]) [182.42.113.10]:33666: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.45.216.101
description:
2025-02-04 02:23:36 dovecot_plain authenticator failed for c-73-45-216-101.hsd1.il.comcast.net [73.45.216.101]:60266: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.72.9.151
description:
Feb  4 02:23:17 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.72.9.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.59.90.121
description:
Feb  4 02:23:18 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.59.90.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.30
description:
Feb  4 02:23:18 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.91.5
description:
2025-02-04 02:23:16 dovecot_plain authenticator failed for (abts-tn-static-005.91.165.122.airtelbroadband.in) [122.165.91.5]:38281: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.69.115.74
description:
2025-02-04 02:23:40 dovecot_plain authenticator failed for ([218.69.115.74]) [218.69.115.74]:35975: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.198.31
description:
2025-02-04 02:23:43 dovecot_plain authenticator failed for ([183.167.198.31]) [183.167.198.31]:51480: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.151.150
description:
Feb  4 02:23:16 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.151.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
description:
Feb  4 02:23:17 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.63.46.34
description:
Feb  4 02:23:53 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.63.46.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.59.8.65
description:
2025-02-04 02:23:53 dovecot_plain authenticator failed for 116-59-8-65.emome-ip.hinet.net [116.59.8.65]:52654: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.235.82.88
description:
Feb  4 02:23:58 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.235.82.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.20.131
description:
2025-02-04 02:23:59 dovecot_plain authenticator failed for ([123.212.20.131]) [123.212.20.131]:42996: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.59.8.65
description:
Feb  4 02:23:51 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.59.8.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.93.130
description:
2025-02-04 02:23:53 dovecot_plain authenticator failed for ([211.109.93.130]) [211.109.93.130]:54046: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.63.46.34
description:
2025-02-04 02:23:55 dovecot_plain authenticator failed for ([203.29.84.253]) [203.63.46.34]:16061: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.235.82.88
description:
2025-02-04 02:24:00 dovecot_plain authenticator failed for ([222.235.82.88]) [222.235.82.88]:42786: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.93.130
description:
Feb  4 02:23:51 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.93.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.20.131
description:
Feb  4 02:23:57 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.20.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 02:24:00 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.189.234.28
description:
Feb  4 02:24:04 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.189.234.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.189.234.28
description:
2025-02-04 02:24:06 dovecot_plain authenticator failed for ([12.189.234.28]) [12.189.234.28]:52933: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:02-25.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.106.15
description:
Feb  4 02:25:35 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.106.15 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.211.6.222
description:
[2025-02-04 02:25:36 +0100] info [webmaild] 190.211.6.222 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.106.15
description:
2025-02-04 02:25:37 dovecot_plain authenticator failed for pool-108-18-106-15.washdc.fios.verizon.net [108.18.106.15]:52412: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.247.54
description:
2025-02-04 02:26:50 dovecot_plain authenticator failed for ([82.209.247.54]) [82.209.247.54]:50770: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.84.56.127
description:
[2025-02-04 02:26:05 +0100] info [webmaild] 177.84.56.127 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.89.72
description:
Feb  4 02:26:39 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.89.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.67.218
description:
Feb  4 02:26:47 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.67.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.58.67.218
description:
2025-02-04 02:26:49 dovecot_plain authenticator failed for ([103.58.67.218]) [103.58.67.218]:48890: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.134.32.74
description:
2025-02-04 02:25:56 dovecot_plain authenticator failed for ([222.134.32.74]) [222.134.32.74]:55680: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.77.181.50
description:
[2025-02-04 02:26:43 +0100] info [webmaild] 186.77.181.50 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.48.39.18
description:
2025-02-04 02:26:46 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:58596: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.134.32.74
description:
Feb  4 02:25:54 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.134.32.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.48.39.18
description:
Feb  4 02:26:44 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.48.39.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.89.72
description:
2025-02-04 02:26:41 dovecot_plain authenticator failed for ([112.132.89.72]) [112.132.89.72]:37141: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.209.247.54
description:
Feb  4 02:26:48 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.209.247.54 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.8.70.157
description:
[2025-02-04 02:26:10 +0100] info [webmaild] 177.8.70.157 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.85.137
description:
Feb  4 02:27:19 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.85.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
description:
2025-02-04 02:27:01 dovecot_plain authenticator failed for ([200.205.133.193]) [187.8.163.70]:54925: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.15.67
description:
Feb  4 02:27:02 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.101.16.250
description:
Feb  4 02:27:00 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.101.16.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.15.67
description:
2025-02-04 02:27:04 dovecot_plain authenticator failed for ([120.224.15.67]) [120.224.15.67]:15176: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
description:
2025-02-04 02:27:17 dovecot_plain authenticator failed for ([211.106.126.27]) [211.106.126.27]:38532: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.235.62
description:
Feb  4 02:27:00 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.235.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
description:
Feb  4 02:27:13 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
description:
2025-02-04 02:27:14 dovecot_plain authenticator failed for ([62.201.228.210]) [62.201.228.210]:60292: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.106.126.27
description:
Feb  4 02:27:15 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.106.126.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.213.111
description:
2025-02-04 02:27:15 dovecot_plain authenticator failed for ([65.20.213.111]) [65.20.213.111]:43951: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.239.246.153
description:
Feb  4 02:27:23 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.239.246.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.31.219
description:
Feb  4 02:26:59 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.31.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.182.171
description:
Feb  4 02:27:01 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.182.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.171
description:
2025-02-04 02:27:03 dovecot_plain authenticator failed for ([220.77.182.171]) [220.77.182.171]:52293: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.213.111
description:
Feb  4 02:27:13 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.213.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.85.137
description:
2025-02-04 02:27:21 dovecot_plain authenticator failed for (177-174-85-137.user.vivozap.com.br) [177.174.85.137]:45566: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
description:
2025-02-04 02:27:02 dovecot_plain authenticator failed for ([179.252.107.105]) [177.6.235.62]:42460: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
description:
2025-02-04 02:27:02 dovecot_plain authenticator failed for ([185.134.179.106]) [185.101.16.250]:60159: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.29.205
description:
47.128.29.205 - - [04/Feb/2025:02:27:05 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=32032230 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/53b6f3?panel=validator" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.29.205


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.201.228.210
description:
Feb  4 02:27:12 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.201.228.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
description:
2025-02-04 02:27:15 dovecot_plain authenticator failed for ([177.43.106.73]) [177.43.106.73]:59118: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.239.246.153
description:
2025-02-04 02:27:25 dovecot_plain authenticator failed for 213-239-246-153.clients.your-server.de [213.239.246.153]:57412: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
description:
Feb  4 02:26:59 ait auth[3759243]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.31.219
description:
2025-02-04 02:27:01 dovecot_plain authenticator failed for ([103.115.31.219]) [103.115.31.219]:33874: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.209.196.225
description:
[2025-02-04 02:27:21 +0100] info [webmaild] 185.209.196.225 - ads19a00020y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user ads19a00020y (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  4 02:28:21 ait sshd[3852406]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.71.161.144
description:
Feb  4 02:28:47 ait sshd[3852636]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.161.144  user=root


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Feb  4 02:28:21 ait sshd[3852406]: Invalid user barbaras-pflegedienst.de 2a00 from 122.51.104.242 port 43932


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Feb  4 02:28:21 ait sshd[3852406]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.254.76.235
description:
[2025-02-04 02:28:41 +0100] info [webmaild] 177.254.76.235 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.67.19.209
description:
[2025-02-04 02:28:41 +0100] info [webmaild] 201.67.19.209 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.236.154.14
description:
[2025-02-04 02:28:11 +0100] info [webmaild] 45.236.154.14 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.71.161.144
description:
Feb  4 02:28:47 ait sshd[3852636]: pam_imunify(sshd:auth): [IM360_RBL] The IP 167.71.161.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
description:
2025-02-04 02:28:54 dovecot_plain authenticator failed for ([200.149.51.186]) [200.149.51.186]:48415: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.189.61.162
description:
2025-02-04 02:29:13 dovecot_plain authenticator failed for ([61.189.61.162]) [61.189.61.162]:58404: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.196.214
description:
Feb  4 02:29:36 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.196.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.82
description:
Feb  4 02:29:05 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.191.163.102
description:
Feb  4 02:29:21 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.191.163.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
description:
2025-02-04 02:29:38 dovecot_plain authenticator failed for syn-208-105-196-214.biz.spectrum.com (rrcs-208-105-196-214.nys.biz.rr.com) [208.105.196.214]:36761: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.67.133.193
description:
Feb  4 02:29:23 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.67.133.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.67.133.193
description:
2025-02-04 02:29:25 dovecot_plain authenticator failed for ([222.67.133.193]) [222.67.133.193]:58024: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.173.18.71
description:
Feb  4 02:29:36 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.173.18.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.3.134.232
description:
2025-02-04 02:28:56 dovecot_plain authenticator failed for ([151.3.134.232]) [151.3.134.232]:42713: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Feb  4 02:29:06 ait sshd[3852854]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.25.36.197
description:
Feb  4 02:29:19 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.25.36.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.68
description:
Feb  4 02:28:52 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.202.206.163
description:
Feb  4 02:29:09 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.202.206.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.216.2.74
description:
2025-02-04 02:29:09 dovecot_plain authenticator failed for ([222.216.2.74]) [222.216.2.74]:51167: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.198.61.29
description:
[2025-02-04 02:29:13 +0100] info [webmaild] 179.198.61.29 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.155.170.146
description:
2025-02-04 02:29:01 dovecot_plain authenticator failed for ([39.155.170.146]) [39.155.170.146]:52422: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Feb  4 02:29:06 ait sshd[3852854]: Invalid user barbaras-pflegedienst.de 2a00 from 122.51.104.242 port 49510


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.216.2.74
description:
Feb  4 02:29:07 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.216.2.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.191.163.102
description:
2025-02-04 02:29:23 dovecot_plain authenticator failed for ([61.191.163.102]) [61.191.163.102]:58700: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.3.134.232
description:
Feb  4 02:28:54 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.3.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.155.170.146
description:
Feb  4 02:28:59 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.155.170.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.202.206.163
description:
2025-02-04 02:29:11 dovecot_plain authenticator failed for 163.189-202-206.bestelclientes.com.mx [189.202.206.163]:54428: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  4 02:29:06 ait sshd[3852854]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.82
description:
2025-02-04 02:29:07 dovecot_plain authenticator failed for ([58.230.236.82]) [58.230.236.82]:39766: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.189.61.162
description:
Feb  4 02:29:11 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.189.61.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
description:
Feb  4 02:28:52 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.68
description:
2025-02-04 02:28:54 dovecot_plain authenticator failed for ([144.48.49.68]) [144.48.49.68]:60937: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.25.36.197
description:
2025-02-04 02:29:21 dovecot_plain authenticator failed for ([37.25.36.197]) [37.25.36.197]:45413: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.173.18.71
description:
2025-02-04 02:29:38 dovecot_plain authenticator failed for ([117.173.18.71]) [117.173.18.71]:58404: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.239.255.163
description:
Feb  4 02:30:09 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.239.255.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.169.234
description:
2025-02-04 02:30:08 dovecot_plain authenticator failed for (reged) [65.20.169.234]:49236: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.21.237
description:
47.128.21.237 - - [04/Feb/2025:02:30:04 +0100] "GET /wp-content/uploads/sites/6/2022/05/Smart-Logo.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11065533" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.21.237


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.169.234
description:
Feb  4 02:30:06 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.169.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.239.255.163
description:
2025-02-04 02:30:11 dovecot_plain authenticator failed for (toxyllod) [77.239.255.163]:42784: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.158.110.240
description:
[2025-02-04 02:30:46 +0100] info [webmaild] 103.158.110.240 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.71.19.150
description:
[2025-02-04 02:31:47 +0100] info [webmaild] 181.71.19.150 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 02:31:27 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.239.138.18
description:
[2025-02-04 02:31:16 +0100] info [webmaild] 37.239.138.18 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.219.137.141
description:
[2025-02-04 02:31:16 +0100] info [webmaild] 186.219.137.141 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.72.121.10
description:
Feb  4 02:32:21 ait sshd[3853984]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.72.121.10  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
description:
2025-02-04 02:32:31 dovecot_plain authenticator failed for (nured) [154.144.243.93]:38040: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.243.93
description:
Feb  4 02:32:29 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.243.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.72.121.10
description:
Feb  4 02:32:21 ait sshd[3853984]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.72.121.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.4.146.231
description:
[2025-02-04 02:33:27 +0100] info [webmaild] 45.4.146.231 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.66.250.63
description:
[2025-02-04 02:33:46 +0100] info [webmaild] 177.66.250.63 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.185.126.242
description:
[2025-02-04 02:34:02 +0100] info [webmaild] 138.185.126.242 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.55.231.225
description:
[2025-02-04 02:34:18 +0100] info [webmaild] 177.55.231.225 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.189
description:
Feb  4 02:35:30 ait sshd[3855062]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
description:
Feb  4 02:35:30 ait sshd[3855062]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
description:
2025-02-04 02:36:12 dovecot_plain authenticator failed for ([213.230.65.53]) [213.230.65.53]:43802: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.38.136.162
description:
Feb  4 02:36:44 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.38.136.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.38.136.162
description:
2025-02-04 02:36:46 dovecot_plain authenticator failed for syn-047-038-136-162.res.spectrum.com [47.38.136.162]:45094: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.224.142.57
description:
[2025-02-04 02:36:08 +0100] info [webmaild] 186.224.142.57 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.65.53
description:
Feb  4 02:36:10 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.65.53 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.115.215.36
description:
[2025-02-04 02:36:15 +0100] info [webmaild] 190.115.215.36 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.236.85.245
description:
[2025-02-04 02:36:48 +0100] info [webmaild] 190.236.85.245 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.131.109.3
description:
[2025-02-04 02:36:38 +0100] info [webmaild] 37.131.109.3 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
description:
2025-02-04 02:36:23 dovecot_plain authenticator failed for ([187.51.234.239]) [189.108.147.210]:43941: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 02:36:09 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
description:
Feb  4 02:36:21 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.197.237.177
description:
2025-02-04 02:36:52 dovecot_plain authenticator failed for (177.237.197.116.unknown.m1.com.sg) [116.197.237.177]:54682: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.90.117.84
description:
Feb  4 02:36:59 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.90.117.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.246.214
description:
Feb  4 02:37:00 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.246.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.1.239.146
description:
Feb  4 02:37:42 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.1.239.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.175.194.139
description:
Feb  4 02:37:02 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.175.194.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.175.194.139
description:
2025-02-04 02:37:04 dovecot_plain authenticator failed for syn-072-175-194-139.res.spectrum.com [72.175.194.139]:60591: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.73.186.178
description:
Feb  4 02:37:38 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.73.186.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.132.2
description:
Feb  4 02:37:39 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.129.132.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
description:
2025-02-04 02:37:44 dovecot_plain authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:40685: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.170.255.146
description:
Feb  4 02:37:16 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.170.255.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.170.255.146
description:
2025-02-04 02:37:18 dovecot_plain authenticator failed for ([222.170.255.146]) [222.170.255.146]:41696: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
description:
2025-02-04 02:37:39 dovecot_plain authenticator failed for 89-67-38-27.dynamic.chello.pl [89.67.38.27]:51761: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.235.5
description:
Feb  4 02:37:40 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.235.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.139.182.85
description:
Feb  4 02:37:38 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.139.182.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.149
description:
Feb  4 02:37:40 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.196.30.122
description:
Feb  4 02:37:41 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.196.30.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.73.186.178
description:
2025-02-04 02:37:40 dovecot_plain authenticator failed for ([46.73.186.178]) [46.73.186.178]:37204: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.239.146
description:
2025-02-04 02:37:44 dovecot_plain authenticator failed for ([116.231.84.13]) [218.1.239.146]:63330: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.246.214
description:
2025-02-04 02:37:02 dovecot_plain authenticator failed for (nsg-corporate-214.246.187.122.airtel.in) [122.187.246.214]:53708: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.244.246.221
description:
2025-02-04 02:37:03 dovecot_plain authenticator failed for ([1.244.246.221]) [1.244.246.221]:45038: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.194.28
description:
Feb  4 02:37:40 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.194.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Feb  4 02:37:16 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.132.2
description:
2025-02-04 02:37:41 dovecot_plain authenticator failed for vps-6186bf6b.vps.ovh.net [57.129.132.2]:48854: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.244.246.221
description:
Feb  4 02:37:01 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.244.246.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.67.38.27
description:
Feb  4 02:37:37 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.67.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.177.61
description:
Feb  4 02:37:40 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.177.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 02:37:41 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.52.109
description:
Feb  4 02:37:42 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.196.30.122
description:
2025-02-04 02:37:43 dovecot_plain authenticator failed for ([103.196.30.122]) [103.196.30.122]:60796: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.77.137.236
description:
Feb  4 02:37:47 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.77.137.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.252.222.82
description:
Feb  4 02:37:48 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.252.222.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.65.117
description:
Feb  4 02:36:59 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.65.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.246.45.57
description:
Feb  4 02:37:40 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.246.45.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.139.182.85
description:
2025-02-04 02:37:40 dovecot_plain authenticator failed for ([43.139.182.85]) [43.139.182.85]:56374: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.34.244.190
description:
Feb  4 02:37:43 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.34.244.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.20.229
description:
2025-02-04 02:37:44 dovecot_plain authenticator failed for ([92.202.82.102]) [154.47.20.229]:26513: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.19
description:
Feb  4 02:37:48 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.10.125.106
description:
2025-02-04 02:37:17 dovecot_plain authenticator failed for (106.host.advance.com.ar) [200.10.125.106]:52993: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.194.28
description:
2025-02-04 02:37:42 dovecot_plain authenticator failed for ([94.204.194.28]) [94.204.194.28]:54222: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.235.5
description:
2025-02-04 02:37:42 dovecot_plain authenticator failed for ([104.241.235.5]) [104.241.235.5]:47671: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.246.45.57
description:
2025-02-04 02:37:42 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:38182: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.34.244.190
description:
2025-02-04 02:37:45 dovecot_plain authenticator failed for ([36.34.244.190]) [36.34.244.190]:35108: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.149
description:
2025-02-04 02:37:42 dovecot_plain authenticator failed for (m121-202-155-149.smartone.com) [121.202.155.149]:6540: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
description:
2025-02-04 02:37:49 dovecot_plain authenticator failed for ([110.77.137.236]) [110.77.137.236]:47698: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.177.61
description:
2025-02-04 02:37:42 dovecot_plain authenticator failed for (61-177-53-194.mairnet.net) [194.53.177.61]:40562: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.65.117
description:
2025-02-04 02:37:01 dovecot_plain authenticator failed for ([183.238.65.117]) [183.238.65.117]:38847: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.90.117.84
description:
2025-02-04 02:37:01 dovecot_plain authenticator failed for ([165.90.117.84]) [165.90.117.84]:56633: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.10.125.106
description:
Feb  4 02:37:15 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.10.125.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.197.237.177
description:
Feb  4 02:36:50 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.197.237.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-02-04 02:37:18 dovecot_plain authenticator failed for ([223.75.231.193]) [58.49.113.138]:16471: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.47.20.229
description:
Feb  4 02:37:42 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.47.20.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.49.182.103
description:
2025-02-04 02:37:55 dovecot_plain authenticator failed for ([38.49.182.103]) [38.49.182.103]:51666: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
description:
2025-02-04 02:37:58 dovecot_plain authenticator failed for ([211.109.75.68]) [211.109.75.69]:56015: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.208.76.154
description:
Feb  4 02:38:04 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.208.76.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.216.85.119
description:
Feb  4 02:38:11 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.216.85.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.10.121.246
description:
Feb  4 02:38:12 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.10.121.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.177.52
description:
2025-02-04 02:38:30 dovecot_login authenticator failed for (ADMIN) [188.241.177.52]:50858: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.166.68.89
description:
Feb  4 02:37:57 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.166.68.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
description:
2025-02-04 02:38:06 dovecot_plain authenticator failed for ([125.139.124.120]) [125.139.124.120]:45788: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.216.85.119
description:
2025-02-04 02:38:13 dovecot_plain authenticator failed for ([211.216.85.119]) [211.216.85.119]:56796: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Feb  4 02:37:59 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.166.68.89
description:
2025-02-04 02:37:59 dovecot_plain authenticator failed for (5x166x68x89.dynamic.barnaul.ertelecom.ru) [5.166.68.89]:51540: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.21.28.237
description:
2025-02-04 02:38:04 dovecot_plain authenticator failed for host-79-21-28-237.retail.telecomitalia.it [79.21.28.237]:54941: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.117.200
description:
2025-02-04 02:38:07 dovecot_plain authenticator failed for ([112.15.117.200]) [112.15.117.200]:43384: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.64.246
description:
Feb  4 02:38:41 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.64.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
description:
2025-02-04 02:37:55 dovecot_plain authenticator failed for ([121.202.152.13]) [121.202.152.13]:55077: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
description:
Feb  4 02:37:56 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.117.200
description:
Feb  4 02:38:05 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.117.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.252.222.82
description:
2025-02-04 02:37:50 dovecot_plain authenticator failed for ([58.252.222.82]) [58.252.222.82]:46086: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.42.85
description:
2025-02-04 02:37:53 dovecot_plain authenticator failed for ([203.124.42.85]) [203.124.42.85]:57532: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.13.67.132
description:
Feb  4 02:37:53 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.13.67.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.10.121.246
description:
2025-02-04 02:38:14 dovecot_plain authenticator failed for syn-098-010-121-246.res.spectrum.com (098-010-121-246.res.spectrum.com) [98.10.121.246]:60791: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.218.17.45
description:
Feb  4 02:38:21 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.218.17.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.245.207.104
description:
2025-02-04 02:38:08 dovecot_plain authenticator failed for ([1.245.207.104]) [1.245.207.104]:32851: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.218.17.45
description:
2025-02-04 02:38:23 dovecot_plain authenticator failed for ([222.218.17.45]) [222.218.17.45]:42783: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
description:
2025-02-04 02:38:43 dovecot_plain authenticator failed for ([213.230.64.246]) [213.230.64.246]:50194: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.174.248
description:
Feb  4 02:37:49 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.174.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.182
description:
2025-02-04 02:37:51 dovecot_plain authenticator failed for ([121.202.155.182]) [121.202.155.182]:9139: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.174.248
description:
2025-02-04 02:37:51 dovecot_plain authenticator failed for broadband-77-37-174-248.ip.moscow.rt.ru [77.37.174.248]:60226: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.124.42.85
description:
Feb  4 02:37:51 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.124.42.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.207.231.65
description:
2025-02-04 02:38:34 dovecot_plain authenticator failed for ([111.207.231.67]) [111.207.231.65]:37276: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.170.102
description:
Feb  4 02:37:51 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.170.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.49.182.103
description:
Feb  4 02:37:53 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.49.182.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-02-04 02:38:01 dovecot_plain authenticator failed for (94-43-224-106.dsl.utg.ge) [2.57.219.2]:60102: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.29.135.230
description:
Feb  4 02:38:01 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.29.135.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.245.207.104
description:
Feb  4 02:38:06 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.245.207.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.207.231.65
description:
Feb  4 02:38:32 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.207.231.65 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.5.236.156
description:
[2025-02-04 02:38:43 +0100] info [webmaild] 187.5.236.156 - webmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.13.67.132
description:
2025-02-04 02:37:55 dovecot_plain authenticator failed for ([221.13.67.132]) [221.13.67.132]:50923: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.72.244.39
description:
2025-02-04 02:37:58 dovecot_plain authenticator failed for 39.244.72.148.host.secureserver.net [148.72.244.39]:58566: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.127.197.89
description:
2025-02-04 02:37:59 dovecot_plain authenticator failed for (179.127.197.89.afinet.com.br) [179.127.197.89]:53943: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.29.135.230
description:
2025-02-04 02:38:03 dovecot_plain authenticator failed for 50.29.135.230.res-cmts.mtp2.ptd.net [50.29.135.230]:34036: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.205.251
description:
Feb  4 02:38:07 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.205.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.205.251
description:
2025-02-04 02:38:09 dovecot_plain authenticator failed for ([183.236.205.251]) [183.236.205.251]:34510: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.208.76.154
description:
2025-02-04 02:38:06 dovecot_plain authenticator failed for (186-208-76-154.veloo.com.br) [186.208.76.154]:47108: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.21.28.237
description:
Feb  4 02:38:02 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.21.28.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.124.120
description:
Feb  4 02:38:04 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.124.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.229
description:
2025-02-04 02:38:24 dovecot_plain authenticator failed for (m121-202-153-229.smartone.com) [121.202.153.229]:17013: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.182
description:
Feb  4 02:37:49 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.19
description:
2025-02-04 02:37:50 dovecot_plain authenticator failed for ([121.202.153.19]) [121.202.153.19]:46591: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.170.102
description:
2025-02-04 02:37:53 dovecot_plain authenticator failed for ([183.234.170.102]) [183.234.170.102]:50075: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.13
description:
Feb  4 02:37:53 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.244.39
description:
Feb  4 02:37:56 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.229
description:
Feb  4 02:38:22 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.239.134
description:
Feb  4 02:39:35 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.239.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.172.131
description:
2025-02-04 02:39:20 dovecot_login authenticator failed for ([5.11.172.131]) [5.11.172.131]:51056: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.84.88.132
description:
[2025-02-04 02:39:25 +0100] info [webmaild] 186.84.88.132 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.239.134
description:
2025-02-04 02:39:37 dovecot_login authenticator failed for (134.239.223.60.adsl-pool.sx.cn) [60.223.239.134]:46235: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Feb  4 02:39:33 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.60.225.71
description:
[2025-02-04 02:39:11 +0100] info [webmaild] 179.60.225.71 - webmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.172.131
description:
Feb  4 02:39:18 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.172.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
description:
2025-02-04 02:39:22 dovecot_login authenticator failed for ([182.42.113.10]) [182.42.113.10]:47873: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-02-04 02:39:35 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:35460: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.113.10
description:
Feb  4 02:39:20 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.42.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.101.163.95
description:
[2025-02-04 02:38:51 +0100] info [webmaild] 187.101.163.95 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.208.159.90
description:
2025-02-04 02:41:54 dovecot_login authenticator failed for (EAOex0qOHJ) [185.208.159.90]:51257: 535 Incorrect authentication data (set_id=addo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.184.194
description:
2025-02-04 02:41:52 dovecot_login authenticator failed for ([114.242.172.76]) [61.51.184.194]:40628: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:02-41.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.184.194
description:
Feb  4 02:41:50 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.184.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.12.68.242
description:
Feb  4 02:42:00 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.12.68.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.159.90
description:
Feb  4 02:41:52 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.159.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.12.68.242
description:
2025-02-04 02:42:02 dovecot_login authenticator failed for ([210.12.68.242]) [210.12.68.242]:44101: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.161.10.78
description:
[2025-02-04 02:41:56 +0100] info [webmaild] 187.161.10.78 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.159.90
description:
Feb  4 02:42:58 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.159.90 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.233.51.18
description:
[2025-02-04 02:43:40 +0100] info [webmaild] 45.233.51.18 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.208.159.90
description:
2025-02-04 02:43:00 dovecot_login authenticator failed for (yE5KiJ0) [185.208.159.90]:56761: 535 Incorrect authentication data (set_id=addo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.225.194.121
description:
Feb  4 02:43:53 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.225.194.121 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.175.103.88
description:
[2025-02-04 02:44:09 +0100] info [webmaild] 45.175.103.88 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.181.74
description:
Feb  4 02:44:20 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.181.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.7
description:
Feb  4 02:44:48 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.71.199.46
description:
Feb  4 02:44:44 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.71.199.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
description:
2025-02-04 02:44:34 dovecot_plain authenticator failed for (indan) [185.113.51.55]:43086: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.71.199.46
description:
2025-02-04 02:44:46 dovecot_plain authenticator failed for ([120.71.199.46]) [120.71.199.46]:55928: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.10.79.34
description:
Feb  4 02:44:34 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.10.79.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.10.79.34
description:
2025-02-04 02:44:36 dovecot_plain authenticator failed for ([59.10.79.34]) [59.10.79.34]:34604: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
description:
2025-02-04 02:44:13 dovecot_plain authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:41328: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
description:
Feb  4 02:44:32 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.89.159.59
description:
Feb  4 02:44:11 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.89.159.59 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.254.5.133
description:
[2025-02-04 02:43:58 +0100] info [webmaild] 88.254.5.133 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.181.74
description:
2025-02-04 02:44:22 dovecot_plain authenticator failed for ([103.65.227.71]) [114.130.181.74]:44801: 535 Incorrect authentication data (set_id=eng20b00167y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.238.165.36
description:
[2025-02-04 02:44:30 +0100] info [webmaild] 170.238.165.36 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.99.168
description:
Feb  4 02:44:48 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.99.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.225.194.121
description:
2025-02-04 02:43:55 dovecot_plain authenticator failed for (45-225-194-121.ibiunet.com.br) [45.225.194.121]:57150: 535 Incorrect authentication data (set_id=eng20b00167y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.7
description:
2025-02-04 02:44:50 dovecot_plain authenticator failed for ([121.202.152.7]) [121.202.152.7]:52138: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.99.168
description:
2025-02-04 02:44:50 dovecot_plain authenticator failed for ([49.245.99.168]) [49.245.99.168]:59991: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.28.26.250
description:
Feb  4 02:45:02 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.28.26.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.23.103
description:
2025-02-04 02:45:07 dovecot_plain authenticator failed for ([115.23.23.103]) [115.23.23.103]:46016: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.23.103
description:
Feb  4 02:45:05 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.23.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.43.231.186
description:
Feb  4 02:45:07 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.43.231.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.28.26.250
description:
2025-02-04 02:45:04 dovecot_plain authenticator failed for (201-28-26-250.customer.tdatabrasil.net.br) [201.28.26.250]:39849: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.43.231.186
description:
2025-02-04 02:45:09 dovecot_plain authenticator failed for host-88-43-231-186.business.telecomitalia.it ([88.43.231.188]) [88.43.231.186]:58504: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.243.67.142
description:
[2025-02-04 02:46:33 +0100] info [webmaild] 88.243.67.142 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.215.254.115
description:
Feb  4 02:46:11 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.215.254.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.195.217.94
description:
Feb  4 02:46:44 ait sshd[3859252]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.195.217.94 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.227.183.34
description:
[2025-02-04 02:46:30 +0100] info [webmaild] 168.227.183.34 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.254.115
description:
2025-02-04 02:46:13 dovecot_plain authenticator failed for 217-215-254-115-no2460.tbcn.telia.com (aning) [217.215.254.115]:33848: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.195.217.94
description:
Feb  4 02:46:44 ait sshd[3859252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.195.217.94  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.141.98.157
description:
[2025-02-04 02:46:59 +0100] info [webmaild] 201.141.98.157 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.128.121.201
description:
[2025-02-04 02:47:09 +0100] info [webmaild] 177.128.121.201 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 02:48:49 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
description:
2025-02-04 02:49:14 dovecot_login authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:54776: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.206.153
description:
Feb  4 02:49:25 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.206.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 02:49:41 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.24.215.70
description:
Feb  4 02:49:47 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.24.215.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.0.90.81
description:
Feb  4 02:49:12 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.0.90.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.153.85.132
description:
2025-02-04 02:49:39 dovecot_plain authenticator failed for ([46.153.85.132]) [46.153.85.132]:37206: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.24.215.70
description:
2025-02-04 02:49:49 dovecot_login authenticator failed for ([195.24.215.70]) [195.24.215.70]:34478: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.114.57
description:
[2025-02-04 02:49:19 +0100] info [webmaild] 213.230.114.57 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.97.237.156
description:
[2025-02-04 02:49:49 +0100] info [webmaild] 190.97.237.156 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.111.64.38
description:
Feb  4 02:49:07 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.111.64.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.111.64.38
description:
2025-02-04 02:49:09 dovecot_plain authenticator failed for ([176.111.64.38]) [176.111.64.38]:57314: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.236.111.18
description:
2025-02-04 02:49:21 dovecot_plain authenticator failed for ([156.236.111.18]) [156.236.111.18]:58856: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.158.133.113
description:
[2025-02-04 02:49:15 +0100] info [webmaild] 105.158.133.113 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.206.153
description:
2025-02-04 02:49:27 dovecot_plain authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:44512: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.236.111.18
description:
Feb  4 02:49:19 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.236.111.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.153.85.132
description:
Feb  4 02:49:37 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.153.85.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.253
description:
Feb  4 02:50:32 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.253
description:
2025-02-04 02:50:34 dovecot_plain authenticator failed for (m121-202-152-253.smartone.com) [121.202.152.253]:22694: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
description:
2025-02-04 02:50:08 dovecot_plain authenticator failed for ([220.161.52.149]) [220.161.52.149]:38466: 535 Incorrect authentication data (set_id=agbozume1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.101.36.159
description:
Feb  4 02:50:21 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.101.36.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
description:
2025-02-04 02:50:23 dovecot_plain authenticator failed for (089-101-036159.ntlworld.ie) [89.101.36.159]:54973: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.62
description:
Feb  4 02:50:17 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.62
description:
2025-02-04 02:50:19 dovecot_plain authenticator failed for ([203.189.124.62]) [203.189.124.62]:59844: 535 Incorrect authentication data (set_id=agbozume1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.186.156.195
description:
[2025-02-04 02:49:50 +0100] info [webmaild] 45.186.156.195 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.161.52.149
description:
Feb  4 02:50:06 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.161.52.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.112
description:
Feb  4 02:52:31 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.112 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.47.41.190
description:
[2025-02-04 02:52:33 +0100] info [webmaild] 177.47.41.190 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 198.163.195.112
description:
[2025-02-04 02:52:11 +0100] info [webmaild] 198.163.195.112 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.112
description:
2025-02-04 02:52:33 dovecot_plain authenticator failed for ([183.249.1.112]) [183.249.1.112]:43533: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.100.98.31
description:
[2025-02-04 02:52:04 +0100] info [webmaild] 131.100.98.31 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.142.14
description:
2025-02-04 02:52:08 dovecot_plain authenticator failed for ([39.164.142.14]) [39.164.142.14]:58649: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.142.14
description:
Feb  4 02:52:06 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.142.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.212
description:
Feb  4 02:53:30 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.212 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.221.115.212
description:
[2025-02-04 02:52:52 +0100] info [webmaild] 201.221.115.212 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.178.132
description:
Feb  4 02:53:13 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.178.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
description:
2025-02-04 02:53:32 dovecot_plain authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:54070: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.178.132
description:
2025-02-04 02:53:15 dovecot_plain authenticator failed for (132-178-53-194.mairnet.net) [194.53.178.132]:57447: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.189.27.219
description:
[2025-02-04 02:54:42 +0100] info [webmaild] 191.189.27.219 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 3.141.24.81
domain: www.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ENG15B00223Y||WPU:ENG15B00223Y||RSV:6.65||T:APACHE||MV:02-54.3.141.24.81


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.115.6.34
description:
[2025-02-04 02:54:40 +0100] info [webmaild] 181.115.6.34 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.215.241
description:
2025-02-04 02:55:09 dovecot_plain authenticator failed for ([58.16.215.241]) [58.16.215.241]:36216: 535 Incorrect authentication data (set_id=baah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.89.234.208
description:
Feb  4 02:55:18 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.89.234.208 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.163.221.205
description:
[2025-02-04 02:55:24 +0100] info [webmaild] 181.163.221.205 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.5.88.147
description:
[2025-02-04 02:54:50 +0100] info [webmaild] 45.5.88.147 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.215.241
description:
Feb  4 02:55:07 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.215.241 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.71.131
description:
[2025-02-04 02:55:09 +0100] info [webmaild] 84.54.71.131 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.89.234.208
description:
2025-02-04 02:55:20 dovecot_plain authenticator failed for (deenetservices.net) [103.89.234.208]:41388: 535 Incorrect authentication data (set_id=baah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
description:
2025-02-04 02:56:46 dovecot_plain authenticator failed for syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:49222: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 02:56:00 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.4
description:
Feb  4 02:56:26 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.4
description:
2025-02-04 02:56:28 dovecot_plain authenticator failed for ([203.252.10.4]) [203.252.10.4]:46723: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.118.112.230
description:
Feb  4 02:56:44 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.118.112.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.250.50
description:
Feb  4 02:57:04 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.250.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
description:
Feb  4 02:57:47 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.190.100.199
description:
[2025-02-04 02:57:08 +0100] info [webmaild] 45.190.100.199 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.163.122.133
description:
Feb  4 02:57:17 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.163.122.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.215.211.223
description:
Feb  4 02:57:25 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.215.211.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.14.33
description:
Feb  4 02:57:37 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.14.33 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.215.7.111
description:
[2025-02-04 02:57:37 +0100] info [webmaild] 37.215.7.111 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.250.50
description:
2025-02-04 02:57:06 dovecot_plain authenticator failed for (50.250.223.60.adsl-pool.sx.cn) [60.223.250.50]:39279: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.29.196.170
description:
Feb  4 02:57:41 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.29.196.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.29.196.170
description:
2025-02-04 02:57:43 dovecot_plain authenticator failed for ([71.29.196.170]) [71.29.196.170]:59458: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.232.138
description:
Feb  4 02:57:22 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.232.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.215.211.223
description:
2025-02-04 02:57:27 dovecot_plain authenticator failed for ([114.215.211.223]) [114.215.211.223]:59226: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.182.74.155
description:
[2025-02-04 02:57:30 +0100] info [webmaild] 177.182.74.155 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.14.33
description:
2025-02-04 02:57:39 dovecot_plain authenticator failed for ([59.2.14.33]) [59.2.14.33]:58886: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
description:
2025-02-04 02:57:49 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:36724: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
description:
2025-02-04 02:57:19 dovecot_plain authenticator failed for ([182.163.122.133]) [182.163.122.133]:18797: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.89.232.138
description:
2025-02-04 02:57:24 dovecot_plain authenticator failed for ([159.89.232.138]) [159.89.232.138]:12944: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.189.180.243
description:
2025-02-04 02:57:57 dovecot_login authenticator failed for ([90.189.180.243]) [90.189.180.243]:33868: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.210.48.54
description:
[2025-02-04 02:58:00 +0100] info [webmaild] 38.210.48.54 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.142.44.154
description:
Feb  4 02:58:25 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.142.44.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.142.44.154
description:
2025-02-04 02:58:27 dovecot_plain authenticator failed for ([211.142.44.154]) [211.142.44.154]:49342: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.211
description:
Feb  4 02:58:35 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
description:
2025-02-04 02:58:37 dovecot_plain authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:2468: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.189.180.243
description:
Feb  4 02:57:55 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.189.180.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.17.6.119
description:
Feb  4 02:59:17 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.17.6.119 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.227.92.255
description:
[2025-02-04 02:59:40 +0100] info [webmaild] 41.227.92.255 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.247.105.204
description:
2025-02-04 02:59:48 dovecot_login authenticator failed for (ADMIN) [84.247.105.204]:59824: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.116.64
description:
2025-02-04 02:59:49 dovecot_plain authenticator failed for (tompres) [62.182.116.64]:47559: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:02-59.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.182.116.64
description:
Feb  4 02:59:47 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.182.116.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.132.113
description:
2025-02-04 02:59:59 dovecot_plain authenticator failed for ([188.226.132.113]) [188.226.132.113]:37351: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.103.120.150
description:
Feb  4 03:00:12 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.103.120.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.216.2.74
description:
2025-02-04 03:00:18 dovecot_plain authenticator failed for ([222.216.2.74]) [222.216.2.74]:48863: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.140.69
description:
2025-02-04 02:59:53 dovecot_plain authenticator failed for (tracurasm) [65.20.140.69]:45810: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.132.61.213
description:
Feb  4 03:00:00 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.132.61.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.120.150
description:
2025-02-04 03:00:14 dovecot_plain authenticator failed for 150.120.103.218.static.netvigator.com [218.103.120.150]:50728: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.216.2.74
description:
Feb  4 03:00:16 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.216.2.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.140.69
description:
Feb  4 02:59:51 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.140.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.132.61.213
description:
2025-02-04 03:00:02 dovecot_plain authenticator failed for ([124.132.61.213]) [124.132.61.213]:43090: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.34.87.75
description:
[2025-02-04 03:00:17 +0100] info [webmaild] 177.34.87.75 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.132.113
description:
Feb  4 02:59:57 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.132.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.71.203.117
description:
[2025-02-04 03:00:10 +0100] info [webmaild] 45.71.203.117 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.179
description:
Feb  4 03:01:21 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.16.156.103
description:
Feb  4 03:01:32 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.16.156.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.66.154.229
description:
Feb  4 03:01:43 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.66.154.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 03:01:43 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.134.56.57
description:
[2025-02-04 03:00:50 +0100] info [webmaild] 5.134.56.57 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.30.180.58
description:
Feb  4 03:01:48 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.30.180.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.196.6
description:
2025-02-04 03:01:45 dovecot_plain authenticator failed for ([121.202.196.6]) [121.202.196.6]:61135: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.179
description:
2025-02-04 03:01:23 dovecot_plain authenticator failed for (m121-202-153-179.smartone.com) [121.202.153.179]:22849: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.16.156.103
description:
2025-02-04 03:01:34 dovecot_plain authenticator failed for (173-16-156-103.client.mchsi.com) [173.16.156.103]:33166: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.196.6
description:
Feb  4 03:01:43 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.196.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.66.154.229
description:
2025-02-04 03:01:45 dovecot_plain authenticator failed for (borcic) [98.66.154.229]:43058: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.7.225.113
description:
Feb  4 03:02:03 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.7.225.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Feb  4 03:02:21 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-02-04 03:02:23 dovecot_plain authenticator failed for (enteo) [81.211.77.58]:60019: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.48.181
description:
Feb  4 03:01:52 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.48.181 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 45.61.162.13
domain: www.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:moumounibabson@gmail.com||WPU:moumounibabson@gmail.com||RSV:6.65||T:APACHE||MV:03-02.45.61.162.13


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.184.96.253
description:
[2025-02-04 03:02:20 +0100] info [webmaild] 45.184.96.253 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.180.58
description:
2025-02-04 03:01:50 dovecot_plain authenticator failed for ([114.30.180.58]) [114.30.180.58]:36697: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.81.70.80
description:
2025-02-04 03:01:58 dovecot_plain authenticator failed for (50-81-70-80.client.mchsi.com) [50.81.70.80]:36484: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.210.10
description:
Feb  4 03:02:02 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.210.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.7.225.113
description:
2025-02-04 03:02:05 dovecot_plain authenticator failed for (113.225.7.186.f.dyn.claro.net.do) [186.7.225.113]:39328: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.48.181
description:
2025-02-04 03:01:54 dovecot_plain authenticator failed for broadband-37-110-48-181.ip.moscow.rt.ru [37.110.48.181]:33242: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.81.70.80
description:
Feb  4 03:01:56 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.81.70.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.210.10
description:
2025-02-04 03:02:04 dovecot_plain authenticator failed for ([27.45.210.10]) [27.45.210.10]:60862: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.184.85.252
description:
[2025-02-04 03:03:44 +0100] info [webmaild] 197.184.85.252 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Feb  4 03:03:37 ait sshd[3865239]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.84.241.61
description:
[2025-02-04 03:03:11 +0100] info [webmaild] 170.84.241.61 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.247.74
description:
Feb  4 03:03:28 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.247.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.247.74
description:
2025-02-04 03:03:30 dovecot_plain authenticator failed for ([183.234.247.74]) [183.234.247.74]:35100: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.126.195.176
description:
Feb  4 03:03:36 ait sshd[3865239]: Invalid user universitypublishing from 175.126.195.176 port 58454


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
description:
Feb  4 03:03:41 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-02-04 03:03:43 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:55573: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.104.35.62
description:
[2025-02-04 03:02:50 +0100] info [webmaild] 190.104.35.62 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.69.195.7
description:
Feb  4 03:03:40 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.69.195.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.153.146
description:
Feb  4 03:03:47 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.153.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
description:
2025-02-04 03:03:49 dovecot_plain authenticator failed for (indue) [65.20.153.146]:60262: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Feb  4 03:03:37 ait sshd[3865239]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.69.195.7
description:
2025-02-04 03:03:42 dovecot_plain authenticator failed for ([125.69.195.7]) [125.69.195.7]:58258: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 03:04:48 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.8.106
description:
Feb  4 03:03:58 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.8.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.8.106
description:
2025-02-04 03:04:00 dovecot_plain authenticator failed for ([58.16.8.106]) [58.16.8.106]:54688: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 5.183.252.150
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads19a00014y@ait.edu.gh||WPU:ads19a00014y@ait.edu.gh||RSV:6.65||T:APACHE||MV:03-04.5.183.252.150


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 03:05:22 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.59.100.159
description:
[2025-02-04 03:05:40 +0100] info [webmaild] 176.59.100.159 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.92.71.18
description:
[2025-02-04 03:05:48 +0100] info [webmaild] 201.92.71.18 - webmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.52.219.4
description:
[2025-02-04 03:05:04 +0100] info [webmaild] 191.52.219.4 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.217.226.11
description:
[2025-02-04 03:06:21 +0100] info [webmaild] 201.217.226.11 - webmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.235.247.80
description:
2025-02-04 03:06:20 dovecot_plain authenticator failed for ([91.235.247.80]) [91.235.247.80]:50776: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.138.18
description:
Feb  4 03:06:24 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.138.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.78.70
description:
2025-02-04 03:06:25 dovecot_plain authenticator failed for 80-15-78-70.ftth.fr.orangecustomers.net (stivocon) [80.15.78.70]:44705: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.138.18
description:
2025-02-04 03:06:26 dovecot_plain authenticator failed for ([189.44.138.18]) [189.44.138.18]:51921: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
description:
Feb  4 03:06:02 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.39.128
description:
2025-02-04 03:06:11 dovecot_plain authenticator failed for ([158.140.39.128]) [158.140.39.128]:55306: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
description:
2025-02-04 03:06:07 dovecot_plain authenticator failed for (hadver) [185.113.51.55]:60697: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.15.78.70
description:
Feb  4 03:06:23 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.15.78.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.118.230
description:
2025-02-04 03:06:39 dovecot_plain authenticator failed for ([182.70.118.230]) [182.70.118.230]:44820: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.89.159.59
description:
Feb  4 03:06:29 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.89.159.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
description:
2025-02-04 03:06:31 dovecot_plain authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:41476: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.70.118.230
description:
Feb  4 03:06:37 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.70.118.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
description:
2025-02-04 03:06:04 dovecot_plain authenticator failed for (dionething) [65.20.205.197]:42222: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
description:
Feb  4 03:06:05 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.39.128
description:
Feb  4 03:06:09 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.39.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.235.247.80
description:
Feb  4 03:06:18 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.235.247.80 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 90.156.166.30
description:
[2025-02-04 03:07:46 +0100] info [webmaild] 90.156.166.30 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Feb  4 03:06:52 ait sshd[3866424]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.139.195
description:
2025-02-04 03:06:57 dovecot_plain authenticator failed for ([175.156.139.195]) [175.156.139.195]:34297: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.139.195
description:
Feb  4 03:06:55 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.139.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.181.5.127
description:
[2025-02-04 03:07:44 +0100] info [webmaild] 168.181.5.127 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Feb  4 03:06:52 ait sshd[3866424]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.85.137
description:
Feb  4 03:08:29 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.85.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.169.13
description:
Feb  4 03:08:49 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.169.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
description:
Feb  4 03:08:04 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
description:
2025-02-04 03:08:06 dovecot_plain authenticator failed for (callumpal) [37.224.119.19]:42796: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.143.255.243
description:
[2025-02-04 03:08:13 +0100] info [webmaild] 190.143.255.243 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.70.66
description:
[2025-02-04 03:08:21 +0100] info [webmaild] 84.54.70.66 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.85.137
description:
2025-02-04 03:08:31 dovecot_plain authenticator failed for (177-174-85-137.user.vivozap.com.br) [177.174.85.137]:53454: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.226.245.37
description:
[2025-02-04 03:08:55 +0100] info [webmaild] 45.226.245.37 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.5.135
description:
2025-02-04 03:09:17 dovecot_login authenticator failed for ([46.44.5.135]) [46.44.5.135]:60920: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.253.194.26
description:
Feb  4 03:09:36 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.253.194.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.253.194.26
description:
2025-02-04 03:09:38 dovecot_login authenticator failed for ([58.253.194.26]) [58.253.194.26]:52372: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.13
description:
2025-02-04 03:08:51 dovecot_plain authenticator failed for ([41.216.169.13]) [41.216.169.13]:34212: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.91.67
description:
Feb  4 03:09:02 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.91.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.13
description:
Feb  4 03:09:04 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
description:
2025-02-04 03:09:06 dovecot_plain authenticator failed for ([121.202.152.13]) [121.202.152.13]:10670: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.101
description:
Feb  4 03:09:24 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
description:
2025-02-04 03:09:26 dovecot_plain authenticator failed for ([207.219.221.101]) [207.219.221.101]:52748: 535 Incorrect authentication data (set_id=eng19b00160y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Feb  4 03:09:03 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.91.67
description:
2025-02-04 03:09:04 dovecot_plain authenticator failed for ([39.164.91.67]) [39.164.91.67]:56154: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-02-04 03:09:05 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net (monoss) [81.16.170.117]:44536: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.44.5.135
description:
Feb  4 03:09:15 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.44.5.135 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.223.246.43
description:
[2025-02-04 03:10:31 +0100] info [webmaild] 177.223.246.43 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Feb  4 03:10:10 ait sshd[3867571]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Feb  4 03:10:10 ait sshd[3867571]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 03:10:30 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.201.228.210
description:
Feb  4 03:11:47 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.201.228.210 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.215.157.138
description:
[2025-02-04 03:10:50 +0100] info [webmaild] 95.215.157.138 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.175.242.187
description:
[2025-02-04 03:11:02 +0100] info [webmaild] 103.175.242.187 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.122.29.209
description:
[2025-02-04 03:11:25 +0100] info [webmaild] 138.122.29.209 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
description:
2025-02-04 03:11:49 dovecot_plain authenticator failed for ([62.201.228.210]) [62.201.228.210]:52616: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.69.243.130
description:
Feb  4 03:12:00 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.69.243.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.69.243.130
description:
2025-02-04 03:12:02 dovecot_plain authenticator failed for ([39.69.243.130]) [39.69.243.130]:38438: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.117.166.193
description:
[2025-02-04 03:13:36 +0100] info [webmaild] 138.117.166.193 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.222.171.6
description:
2025-02-04 03:13:38 dovecot_plain authenticator failed for 6.ip-92-222-171.eu [92.222.171.6]:48886: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.222.171.6
description:
Feb  4 03:13:36 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.222.171.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.150.19.16
description:
[2025-02-04 03:13:06 +0100] info [webmaild] 170.150.19.16 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.27.224
description:
2025-02-04 03:13:48 dovecot_plain authenticator failed for ([88.215.27.224]) [88.215.27.224]:41794: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.185.84.10
description:
[2025-02-04 03:13:24 +0100] info [webmaild] 138.185.84.10 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.215.27.224
description:
Feb  4 03:13:46 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.215.27.224 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.153.47.182
description:
[2025-02-04 03:13:56 +0100] info [webmaild] 185.153.47.182 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.209.109.213
description:
Feb  4 03:14:39 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.209.109.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.179.255.54
description:
Feb  4 03:14:40 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.179.255.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.209.109.213
description:
2025-02-04 03:14:41 dovecot_plain authenticator failed for ([175.209.109.213]) [175.209.109.213]:35395: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.179.255.54
description:
2025-02-04 03:14:42 dovecot_plain authenticator failed for ([220.179.255.54]) [220.179.255.54]:60046: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.116.62
description:
2025-02-04 03:15:29 dovecot_plain authenticator failed for (catoconsop) [62.182.116.62]:37206: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.155.8.109
description:
2025-02-04 03:15:38 dovecot_plain authenticator failed for 109.sub-166-155-8.myvzw.com [166.155.8.109]:35053: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.6.68.50
description:
2025-02-04 03:15:21 dovecot_plain authenticator failed for ([221.6.68.50]) [221.6.68.50]:65145: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.221.241.159
description:
Feb  4 03:15:27 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.221.241.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.241.159
description:
2025-02-04 03:15:29 dovecot_plain authenticator failed for (159.241.221.60.adsl-pool.sx.cn) [60.221.241.159]:49661: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.66.113.58
description:
2025-02-04 03:15:19 dovecot_plain authenticator failed for ([183.66.113.58]) [183.66.113.58]:58600: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.214.1.86
description:
[2025-02-04 03:15:36 +0100] info [webmaild] 103.214.1.86 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.21.141.54
description:
Feb  4 03:14:51 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.21.141.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.174.182.38
description:
Feb  4 03:14:55 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.174.182.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
description:
2025-02-04 03:15:05 dovecot_plain authenticator failed for ([209.173.10.75]) [209.173.10.75]:33994: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.28.145
description:
Feb  4 03:15:11 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.28.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.6.68.50
description:
Feb  4 03:15:19 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.6.68.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.204.158.2
description:
2025-02-04 03:15:25 dovecot_plain authenticator failed for 2.189-204-158.bestelclientes.com.mx [189.204.158.2]:48733: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.21.141.54
description:
2025-02-04 03:14:53 dovecot_plain authenticator failed for ([125.21.141.54]) [125.21.141.54]:56266: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
description:
2025-02-04 03:14:57 dovecot_plain authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:42445: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
description:
2025-02-04 03:15:02 dovecot_plain authenticator failed for ([203.128.181.121]) [203.128.181.121]:46343: 535 Incorrect authentication data (set_id=ads21a00069y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.204.158.2
description:
Feb  4 03:15:23 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.204.158.2 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:03-15.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.155.8.109
description:
Feb  4 03:15:36 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.155.8.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
description:
Feb  4 03:15:00 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.145
description:
2025-02-04 03:15:13 dovecot_plain authenticator failed for 111-70-28-145.emome-ip.hinet.net [111.70.28.145]:36943: 535 Incorrect authentication data (set_id=ads21a00069y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 03:15:22 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.200.95.18
description:
Feb  4 03:16:35 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.200.95.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.91.176.243
description:
Feb  4 03:16:19 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.91.176.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.95.18
description:
2025-02-04 03:16:37 dovecot_plain authenticator failed for ([94.200.95.18]) [94.200.95.18]:47528: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.39.158
description:
Feb  4 03:16:10 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.39.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.91.176.243
description:
2025-02-04 03:16:21 dovecot_plain authenticator failed for ([118.91.176.243]) [118.91.176.243]:46752: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.233.86.94
description:
[2025-02-04 03:16:05 +0100] info [webmaild] 45.233.86.94 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.158.200.26
description:
[2025-02-04 03:16:33 +0100] info [webmaild] 186.158.200.26 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.161.68
description:
Feb  4 03:16:47 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.161.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.161.68
description:
2025-02-04 03:16:49 dovecot_plain authenticator failed for ([65.20.161.68]) [65.20.161.68]:35444: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.227.36.140
description:
[2025-02-04 03:15:57 +0100] info [webmaild] 41.227.36.140 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.39.158
description:
2025-02-04 03:16:12 dovecot_plain authenticator failed for 95-31-39-158.broadband.corbina.ru [95.31.39.158]:53464: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.134
description:
Feb  4 03:17:42 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
description:
2025-02-04 03:17:46 dovecot_plain authenticator failed for ([210.206.24.238]) [210.206.24.234]:8501: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.93.87.71
description:
Feb  4 03:17:27 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.93.87.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.233.160.181
description:
Feb  4 03:17:40 ait sshd[3872265]: pam_imunify(sshd:auth): [IM360_RBL] The IP 172.233.160.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.134
description:
2025-02-04 03:17:44 dovecot_plain authenticator failed for ([121.202.152.134]) [121.202.152.134]:64646: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 172.233.160.181
description:
Feb  4 03:17:40 ait sshd[3872265]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.233.160.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.57.96.109
description:
2025-02-04 03:17:27 dovecot_plain authenticator failed for ([58.19.13.200]) [113.57.96.109]:13663: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.93.87.71
description:
2025-02-04 03:17:29 dovecot_plain authenticator failed for ([119.93.87.71]) [119.93.87.71]:59032: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
description:
2025-02-04 03:17:36 dovecot_plain authenticator failed for (arthmoncon) [65.20.153.146]:52540: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.57.96.109
description:
Feb  4 03:17:25 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.57.96.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.206.24.234
description:
Feb  4 03:17:44 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.206.24.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.104.141.57
description:
Feb  4 03:18:48 ait sshd[3872510]: pam_imunify(sshd:auth): [IM360_RBL] The IP 171.104.141.57 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.18.179.140
description:
[2025-02-04 03:18:09 +0100] info [webmaild] 188.18.179.140 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.153.116.126
description:
[2025-02-04 03:18:31 +0100] info [webmaild] 190.153.116.126 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 171.104.141.57
description:
Feb  4 03:18:48 ait sshd[3872510]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.104.141.57


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 03:18:08 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.0.104.44
description:
[2025-02-04 03:18:39 +0100] info [webmaild] 179.0.104.44 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 171.104.141.57
description:
Feb  4 03:18:50 ait sshd[3872510]: Failed password for invalid user deploy from 171.104.141.57 port 42818 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.28.128.173
description:
Feb  4 03:19:37 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.28.128.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.23.95.14
description:
2025-02-04 03:19:38 dovecot_plain authenticator failed for ([218.23.95.14]) [218.23.95.14]:35054: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.207.24
description:
2025-02-04 03:19:42 dovecot_plain authenticator failed for syn-076-176-207-024.res.spectrum.com [76.176.207.24]:61374: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.152.225.58
description:
2025-02-04 03:19:48 dovecot_plain authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:50656: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.230.252.103
description:
Feb  4 03:19:39 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.230.252.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.246
description:
Feb  4 03:19:36 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.28.128.173
description:
2025-02-04 03:19:39 dovecot_plain authenticator failed for ([112.28.128.173]) [112.28.128.173]:56931: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.207.24
description:
Feb  4 03:19:40 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.207.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 208.96.134.58
description:
[2025-02-04 03:19:05 +0100] info [webmaild] 208.96.134.58 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.23.95.14
description:
Feb  4 03:19:36 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.23.95.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
description:
2025-02-04 03:19:38 dovecot_plain authenticator failed for ([116.114.84.246]) [116.114.84.246]:44326: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.230.252.103
description:
2025-02-04 03:19:41 dovecot_plain authenticator failed for ([183.230.252.103]) [183.230.252.103]:34458: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.152.225.58
description:
Feb  4 03:19:46 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.152.225.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.206
description:
Feb  4 03:20:13 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.229.51.206
description:
2025-02-04 03:20:15 dovecot_plain authenticator failed for ([58.229.51.206]) [58.229.51.206]:35720: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.226.113
description:
2025-02-04 03:20:29 dovecot_plain authenticator failed for ([94.207.226.113]) [94.207.226.113]:44647: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.56.11.148
description:
2025-02-04 03:19:57 dovecot_plain authenticator failed for 93-56-11-148.ip287.fastwebnet.it [93.56.11.148]:34142: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
description:
2025-02-04 03:20:00 dovecot_plain authenticator failed for syn-208-105-196-214.biz.spectrum.com (rrcs-208-105-196-214.nys.biz.rr.com) [208.105.196.214]:55063: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.41.6
description:
2025-02-04 03:20:14 dovecot_plain authenticator failed for ([219.139.41.6]) [219.139.41.6]:53683: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Feb  4 03:20:16 ait sshd[3873095]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.56.11.148
description:
Feb  4 03:19:55 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.56.11.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.123.153.214
description:
Feb  4 03:19:57 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.123.153.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Feb  4 03:20:16 ait sshd[3873095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.207.226.113
description:
Feb  4 03:20:27 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.207.226.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.196.214
description:
Feb  4 03:19:58 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.196.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.139.41.6
description:
Feb  4 03:20:12 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.139.41.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.149.243
description:
2025-02-04 03:19:53 dovecot_plain authenticator failed for (scz-181-188-149-00243.tigo.bo) [181.188.149.243]:41667: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.162.187
description:
Feb  4 03:19:54 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.162.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
description:
Feb  4 03:20:11 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
description:
2025-02-04 03:20:13 dovecot_plain authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:46394: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.188.149.243
description:
Feb  4 03:19:51 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.188.149.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.162.187
description:
2025-02-04 03:19:56 dovecot_plain authenticator failed for (psenness) [65.20.162.187]:45112: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.47
description:
2025-02-04 03:20:02 dovecot_plain authenticator failed for (m121-202-155-47.smartone.com) [121.202.155.47]:65293: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.163
description:
2025-02-04 03:20:08 dovecot_plain authenticator failed for ([103.146.233.163]) [103.146.233.163]:17466: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 03:20:37 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.123.153.214
description:
2025-02-04 03:19:59 dovecot_plain authenticator failed for ([144.123.153.214]) [144.123.153.214]:45807: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.163
description:
Feb  4 03:20:06 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.163 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.6.223.52
description:
[2025-02-04 03:20:37 +0100] info [webmaild] 45.6.223.52 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.47
description:
Feb  4 03:20:00 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.173
description:
Feb  4 03:20:55 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-02-04 03:20:55 dovecot_plain authenticator failed for ([59.98.150.190]) [122.160.68.46]:45364: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.216.7.163
description:
2025-02-04 03:20:58 dovecot_plain authenticator failed for 61-216-7-163.hinet-ip.hinet.net (61-216-7-165.hinet-ip.hinet.net) [61.216.7.163]:35976: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.85.12.142
description:
2025-02-04 03:21:03 dovecot_plain authenticator failed for ([61.85.12.142]) [61.85.12.142]:41535: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.179.124.13
description:
Feb  4 03:21:07 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.179.124.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.154.56.124
description:
Feb  4 03:21:08 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.154.56.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.76.95.152
description:
2025-02-04 03:21:08 dovecot_plain authenticator failed for ([62.76.95.152]) [62.76.95.152]:40244: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.245
description:
Feb  4 03:20:54 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.143.231.208
description:
2025-02-04 03:21:32 dovecot_plain authenticator failed for ([43.143.231.208]) [43.143.231.208]:42044: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.162.249
description:
2025-02-04 03:21:39 dovecot_plain authenticator failed for 1-34-162-249.hinet-ip.hinet.net [1.34.162.249]:37674: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.229.51.206
description:
2025-02-04 03:21:45 dovecot_plain authenticator failed for ([58.229.51.206]) [58.229.51.206]:42912: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Feb  4 03:21:31 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.200.139
description:
Feb  4 03:20:52 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.200.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.220.196
description:
2025-02-04 03:20:53 dovecot_plain authenticator failed for ([95.221.220.196]) [95.221.220.196]:51822: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.33.36.254
description:
2025-02-04 03:20:56 dovecot_plain authenticator failed for ([102.33.36.254]) [102.33.36.254]:36112: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.80.158
description:
2025-02-04 03:21:07 dovecot_plain authenticator failed for ([222.114.80.158]) [222.114.80.158]:42226: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.96
description:
2025-02-04 03:21:13 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:65298: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.68.225.143
description:
Feb  4 03:21:20 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.68.225.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.79
description:
Feb  4 03:20:51 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.49
description:
2025-02-04 03:20:59 dovecot_plain authenticator failed for ([101.13.5.49]) [101.13.5.49]:48596: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.244.213.234
description:
2025-02-04 03:21:05 dovecot_plain authenticator failed for ([115.244.213.234]) [115.244.213.234]:45150: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.193.106.140
description:
Feb  4 03:21:10 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.193.106.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.21.191.178
description:
2025-02-04 03:21:09 dovecot_plain authenticator failed for host-79-21-191-178.retail.telecomitalia.it [79.21.191.178]:37170: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.168.78
description:
2025-02-04 03:21:16 dovecot_plain authenticator failed for (78-168-168-45.weblinknet.com.br) [45.168.168.78]:48664: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.245.186
description:
Feb  4 03:20:57 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.245.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.100
description:
Feb  4 03:20:54 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.193.106.140
description:
2025-02-04 03:21:12 dovecot_plain authenticator failed for ([122.193.106.140]) [122.193.106.140]:32841: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.186.220.42
description:
2025-02-04 03:21:14 dovecot_plain authenticator failed for ([211.186.220.42]) [211.186.220.42]:33221: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.34
description:
2025-02-04 03:21:22 dovecot_plain authenticator failed for (m121-202-152-34.smartone.com) [121.202.152.34]:5854: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.34.162.249
description:
Feb  4 03:21:37 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.34.162.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.58
description:
2025-02-04 03:21:44 dovecot_plain authenticator failed for ([117.175.160.58]) [117.175.160.58]:52294: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
description:
2025-02-04 03:20:53 dovecot_plain authenticator failed for ([195.222.57.182]) [195.222.57.190]:39298: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.136
description:
Feb  4 03:21:00 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.220.235
description:
2025-02-04 03:21:05 dovecot_plain authenticator failed for ([118.122.220.235]) [118.122.220.235]:60962: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.0.200
description:
2025-02-04 03:21:10 dovecot_plain authenticator failed for ([218.22.0.200]) [218.22.0.200]:33498: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
description:
2025-02-04 03:21:35 dovecot_plain authenticator failed for ([196.191.212.236]) [213.55.85.202]:23213: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.85.205
description:
Feb  4 03:20:52 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.85.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.21.12.36
description:
Feb  4 03:21:24 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.21.12.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.65
description:
2025-02-04 03:21:34 dovecot_plain authenticator failed for (m121-202-154-65.smartone.com) [121.202.154.65]:59117: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Feb  4 03:20:53 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.54
description:
Feb  4 03:20:55 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.179.124.13
description:
2025-02-04 03:21:09 dovecot_plain authenticator failed for ([163.179.124.13]) [163.179.124.13]:37521: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.131
description:
2025-02-04 03:21:27 dovecot_plain authenticator failed for ([1.235.192.131]) [1.235.192.131]:33054: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.167.140.130
description:
Feb  4 03:20:49 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.167.140.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.50
description:
Feb  4 03:21:02 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.225.194.121
description:
2025-02-04 03:21:14 dovecot_plain authenticator failed for (45-225-194-121.ibiunet.com.br) [45.225.194.121]:44030: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.27.32.70
description:
Feb  4 03:20:52 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.27.32.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
description:
Feb  4 03:20:55 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.85.12.142
description:
Feb  4 03:21:01 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.85.12.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.218.7
description:
2025-02-04 03:21:02 dovecot_plain authenticator failed for ([60.173.218.7]) [60.173.218.7]:33784: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.246.89.195
description:
Feb  4 03:21:05 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.246.89.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.56.124
description:
2025-02-04 03:21:10 dovecot_plain authenticator failed for ([160.154.56.124]) [160.154.56.124]:48990: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.90.43
description:
Feb  4 03:21:15 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.90.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.176.46.239
description:
Feb  4 03:20:54 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.176.46.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.120
description:
Feb  4 03:21:04 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.99
description:
2025-02-04 03:21:05 dovecot_plain authenticator failed for ([207.219.221.99]) [207.219.221.99]:53274: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.225.194.121
description:
Feb  4 03:21:12 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.225.194.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
description:
2025-02-04 03:20:57 dovecot_plain authenticator failed for ([218.149.235.152]) [218.149.235.152]:53266: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.49
description:
Feb  4 03:20:57 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-02-04 03:21:06 dovecot_plain authenticator failed for (undefined.hostname.localhost) [182.76.87.90]:40284: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.62.78.218
description:
[2025-02-04 03:21:07 +0100] info [webmaild] 200.62.78.218 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.90.34.32
description:
2025-02-04 03:21:10 dovecot_plain authenticator failed for syn-071-090-034-032.res.spectrum.com [71.90.34.32]:46020: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.196.62
description:
2025-02-04 03:21:16 dovecot_plain authenticator failed for ([183.167.196.62]) [183.167.196.62]:42775: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.127
description:
2025-02-04 03:20:54 dovecot_plain authenticator failed for (m121-202-154-127.smartone.com) [121.202.154.127]:26194: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.136
description:
2025-02-04 03:21:02 dovecot_plain authenticator failed for ([178.178.194.136]) [178.178.194.136]:57918: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.202
description:
2025-02-04 03:21:04 dovecot_plain authenticator failed for (m121-202-206-202.smartone.com) [121.202.206.202]:39129: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.80.158
description:
Feb  4 03:21:05 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.80.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.48.27
description:
2025-02-04 03:20:57 dovecot_plain authenticator failed for 111-70-48-27.emome-ip.hinet.net [111.70.48.27]:56406: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.11.145.163
description:
2025-02-04 03:20:58 dovecot_plain authenticator failed for ([121.11.145.163]) [121.11.145.163]:47243: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.97.114.149
description:
Feb  4 03:21:10 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.97.114.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.245
description:
2025-02-04 03:20:56 dovecot_plain authenticator failed for (m121-202-152-245.smartone.com) [121.202.152.245]:16794: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.206.202
description:
Feb  4 03:21:02 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.206.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.199.183.172
description:
Feb  4 03:21:07 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.199.183.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.222.190.69
description:
2025-02-04 03:21:08 dovecot_plain authenticator failed for (client.fttb.2day.kz) [176.222.190.69]:43756: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
description:
2025-02-04 03:21:11 dovecot_plain authenticator failed for ([177.6.235.62]) [177.6.235.62]:60117: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.21.12.36
description:
2025-02-04 03:21:26 dovecot_plain authenticator failed for ([210.21.12.36]) [210.21.12.36]:48138: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.173
description:
2025-02-04 03:20:57 dovecot_plain authenticator failed for ([121.202.154.173]) [121.202.154.173]:38739: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.186.220.42
description:
Feb  4 03:21:12 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.186.220.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.60.184
description:
Feb  4 03:21:13 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.60.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.141.194.159
description:
Feb  4 03:21:27 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.141.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.50
description:
2025-02-04 03:21:04 dovecot_plain authenticator failed for ([178.178.222.50]) [178.178.222.50]:55184: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
description:
2025-02-04 03:20:57 dovecot_plain authenticator failed for (187-50-84-19.customer.tdatabrasil.net.br) [177.43.106.73]:49505: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Feb  4 03:21:04 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.192.131
description:
Feb  4 03:21:25 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.192.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.72.17.75
description:
2025-02-04 03:21:28 dovecot_plain authenticator failed for (h75-192-72-17.seed.net.tw) [192.72.17.75]:48131: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.179
description:
2025-02-04 03:20:56 dovecot_plain authenticator failed for (m121-202-153-179.smartone.com) [121.202.153.179]:13790: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.11.145.163
description:
Feb  4 03:20:56 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.11.145.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.35
description:
Feb  4 03:20:57 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.52.253.175
description:
2025-02-04 03:20:59 dovecot_plain authenticator failed for ([111.52.253.175]) [111.52.253.175]:50732: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.201.113.14
description:
[2025-02-04 03:21:18 +0100] info [webmaild] 88.201.113.14 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.143.231.208
description:
Feb  4 03:21:30 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.143.231.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.79
description:
2025-02-04 03:20:53 dovecot_plain authenticator failed for (m121-202-155-79.smartone.com) [121.202.155.79]:32419: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.62.67.73
description:
2025-02-04 03:20:52 dovecot_plain authenticator failed for ([85.62.67.73]) [85.62.67.73]:53078: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.1.177
description:
Feb  4 03:20:56 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.1.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.201.58
description:
Feb  4 03:20:56 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.201.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
description:
Feb  4 03:21:13 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Feb  4 03:21:14 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.125.174.202
description:
Feb  4 03:21:15 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.125.174.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.72.17.75
description:
Feb  4 03:21:26 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.72.17.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.167.140.130
description:
2025-02-04 03:20:51 dovecot_plain authenticator failed for (109-167-140-130.westcall.net) [109.167.140.130]:44674: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.58
description:
Feb  4 03:21:42 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.149.185
description:
Feb  4 03:21:09 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.149.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.125.174.202
description:
2025-02-04 03:21:17 dovecot_plain authenticator failed for ([27.125.174.202]) [27.125.174.202]:55399: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.170.149
description:
Feb  4 03:20:53 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.170.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.46.239
description:
2025-02-04 03:20:56 dovecot_plain authenticator failed for (abts-north-static-239.46.176.122.airtelbroadband.in) [122.176.46.239]:53894: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.201.58
description:
2025-02-04 03:20:58 dovecot_plain authenticator failed for ([220.178.201.58]) [220.178.201.58]:58960: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.216.7.163
description:
Feb  4 03:20:56 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.216.7.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.120
description:
2025-02-04 03:20:56 dovecot_plain authenticator failed for ([121.202.152.120]) [121.202.152.120]:19660: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.47.211
description:
Feb  4 03:21:06 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.47.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.76.95.152
description:
Feb  4 03:21:06 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.76.95.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.245.31.174
description:
Feb  4 03:21:07 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.245.31.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.90.34.32
description:
Feb  4 03:21:08 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.90.34.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.235.62
description:
Feb  4 03:21:09 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.235.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.168.78
description:
Feb  4 03:21:14 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.168.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.127
description:
Feb  4 03:20:52 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.34
description:
Feb  4 03:21:20 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
description:
2025-02-04 03:20:54 dovecot_plain authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:38684: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.62.67.73
description:
Feb  4 03:20:50 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.62.67.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
description:
Feb  4 03:20:51 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Feb  4 03:20:54 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.220.235
description:
Feb  4 03:21:03 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.220.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.96
description:
Feb  4 03:21:11 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.220.196
description:
Feb  4 03:20:51 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.220.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.120
description:
Feb  4 03:20:54 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.170.149
description:
2025-02-04 03:20:55 dovecot_plain authenticator failed for ([218.149.170.149]) [218.149.170.149]:45593: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.11.20.130
description:
Feb  4 03:20:56 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.11.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.11.20.130
description:
2025-02-04 03:20:58 dovecot_plain authenticator failed for ([60.11.20.130]) [60.11.20.130]:59228: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
description:
2025-02-04 03:20:59 dovecot_plain authenticator failed for ([114.242.61.19]) [114.242.61.35]:46174: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.245.31.174
description:
2025-02-04 03:21:09 dovecot_plain authenticator failed for ([183.245.31.174]) [183.245.31.174]:54460: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.97.114.149
description:
2025-02-04 03:21:12 dovecot_plain authenticator failed for c-73-97-114-149.hsd1.wa.comcast.net [73.97.114.149]:53323: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.179
description:
Feb  4 03:20:54 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.68.225.143
description:
2025-02-04 03:21:22 dovecot_plain authenticator failed for s143-225-68-64.ssvec.az.wi-power.com [64.68.225.143]:35072: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.65
description:
Feb  4 03:21:32 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
description:
2025-02-04 03:21:15 dovecot_plain authenticator failed for ([218.98.160.119]) [218.98.160.117]:34532: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.81.78.32
description:
2025-02-04 03:21:06 dovecot_plain authenticator failed for ([185.81.78.32]) [185.81.78.32]:38764: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-02-04 03:21:16 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-173.static.tpgi.com.au) [110.175.220.250]:35624: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.222.190.69
description:
Feb  4 03:21:06 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.222.190.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.81.78.32
description:
Feb  4 03:21:04 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.81.78.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.47.211
description:
2025-02-04 03:21:08 dovecot_plain authenticator failed for ([188.226.47.211]) [188.226.47.211]:52852: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.196.62
description:
Feb  4 03:21:14 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.196.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.33.36.254
description:
Feb  4 03:20:54 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.33.36.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.85.205
description:
2025-02-04 03:20:54 dovecot_plain authenticator failed for 131-106-85-205.s1483.c3-0.tlg-cbr5.atw-tlg.pa.cable.rcncustomer.com [131.106.85.205]:58890: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.218.7
description:
Feb  4 03:21:00 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.218.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.90.43
description:
2025-02-04 03:21:17 dovecot_plain authenticator failed for ([39.174.90.48]) [39.174.90.43]:36667: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.182
description:
2025-02-04 03:20:54 dovecot_plain authenticator failed for ([121.202.155.182]) [121.202.155.182]:11790: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.21.191.178
description:
Feb  4 03:21:07 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.21.191.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.0.200
description:
Feb  4 03:21:08 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.0.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
description:
Feb  4 03:21:33 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.201.37.210
description:
2025-02-04 03:20:54 dovecot_plain authenticator failed for ([50.201.37.210]) [50.201.37.210]:64952: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.177
description:
2025-02-04 03:20:58 dovecot_plain authenticator failed for ([179.185.1.177]) [179.185.1.177]:48941: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.0.245.186
description:
2025-02-04 03:20:59 dovecot_plain authenticator failed for 131.0.245.186.core3.com.br [131.0.245.186]:47289: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.199.183.172
description:
2025-02-04 03:21:09 dovecot_plain authenticator failed for (172.183.199.112.unknown.m1.com.sg) [112.199.183.172]:41264: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.184
description:
2025-02-04 03:21:15 dovecot_plain authenticator failed for ([171.244.60.184]) [171.244.60.184]:40784: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.52.253.175
description:
Feb  4 03:20:57 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.52.253.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.100
description:
2025-02-04 03:20:56 dovecot_plain authenticator failed for (m121-202-153-100.smartone.com) [121.202.153.100]:25312: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.54
description:
2025-02-04 03:20:57 dovecot_plain authenticator failed for (m121-202-154-54.smartone.com) [121.202.154.54]:26246: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.99
description:
Feb  4 03:21:03 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.120
description:
2025-02-04 03:21:06 dovecot_plain authenticator failed for ([121.202.200.120]) [121.202.200.120]:28757: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.246.89.195
description:
2025-02-04 03:21:07 dovecot_plain authenticator failed for ([183.246.89.195]) [183.246.89.195]:51460: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.141.194.159
description:
2025-02-04 03:21:29 dovecot_plain authenticator failed for ([121.141.194.159]) [121.141.194.159]:39864: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.120.150
description:
2025-02-04 03:21:35 dovecot_plain authenticator failed for 150.120.103.218.static.netvigator.com [218.103.120.150]:54971: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.201.37.210
description:
Feb  4 03:20:52 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.201.37.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
description:
Feb  4 03:20:55 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.48.27
description:
Feb  4 03:20:55 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.48.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.200.139
description:
2025-02-04 03:20:54 dovecot_plain authenticator failed for 198-91-200-139.cpe.distributel.net [198.91.200.139]:49432: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-02-04 03:20:56 dovecot_plain authenticator failed for ([121.202.153.186]) [121.202.153.186]:41731: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.244.213.234
description:
Feb  4 03:21:03 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.244.213.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.149.185
description:
2025-02-04 03:21:11 dovecot_plain authenticator failed for ([120.237.149.185]) [120.237.149.185]:42042: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.103.120.150
description:
Feb  4 03:21:33 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.103.120.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.182
description:
Feb  4 03:20:52 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.206
description:
Feb  4 03:21:43 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-02-04 03:21:33 dovecot_plain authenticator failed for (www.safecleen.com) [58.49.113.138]:13964: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.233.160.181
description:
Feb  4 03:22:36 ait sshd[3874287]: pam_imunify(sshd:auth): [IM360_RBL] The IP 172.233.160.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.227.77
description:
Feb  4 03:21:53 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.227.77 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.63.53.250
description:
[2025-02-04 03:21:53 +0100] info [webmaild] 179.63.53.250 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.227.77
description:
2025-02-04 03:21:55 dovecot_plain authenticator failed for (grupokrause.static.gvt.net.br) [179.185.227.77]:57998: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 172.233.160.181
description:
Feb  4 03:22:36 ait sshd[3874287]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.233.160.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.165.114
description:
2025-02-04 03:22:38 dovecot_login authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:34344: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.114.171
description:
Feb  4 03:22:44 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.114.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.114.171
description:
2025-02-04 03:22:46 dovecot_login authenticator failed for ([2.55.114.171]) [2.55.114.171]:32786: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.34.165.114
description:
Feb  4 03:22:36 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.34.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.48.104.200
description:
Feb  4 03:22:10 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.48.104.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.48.104.200
description:
2025-02-04 03:22:12 dovecot_plain authenticator failed for ([112.48.104.200]) [112.48.104.200]:48605: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.164.165
description:
Feb  4 03:22:20 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.164.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.164.165
description:
2025-02-04 03:22:22 dovecot_plain authenticator failed for ([5.11.164.165]) [5.11.164.165]:56819: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.220.33
description:
Feb  4 03:22:50 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.220.33 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.171.31.215
description:
[2025-02-04 03:23:07 +0100] info [webmaild] 38.171.31.215 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 172.233.160.181
description:
Feb  4 03:23:46 ait sshd[3874582]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.233.160.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
description:
2025-02-04 03:22:52 dovecot_plain authenticator failed for ([106.51.120.94]) [106.51.220.33]:28528: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.106.15
description:
Feb  4 03:22:59 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.106.15 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 39.34.187.191
description:
[2025-02-04 03:23:37 +0100] info [webmaild] 39.34.187.191 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.233.160.181
description:
Feb  4 03:23:48 ait sshd[3874582]: Failed password for invalid user deploy from 172.233.160.181 port 39368 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.233.160.181
description:
Feb  4 03:23:46 ait sshd[3874582]: pam_imunify(sshd:auth): [IM360_RBL] The IP 172.233.160.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.106.15
description:
2025-02-04 03:23:01 dovecot_plain authenticator failed for pool-108-18-106-15.washdc.fios.verizon.net [108.18.106.15]:46960: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.104.141.57
description:
Feb  4 03:23:06 ait sshd[3874370]: pam_imunify(sshd:auth): [IM360_RBL] The IP 171.104.141.57 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 171.104.141.57
description:
Feb  4 03:23:06 ait sshd[3874370]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.104.141.57


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.216.5.134
description:
Feb  4 03:24:35 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.216.5.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.43.204.45
description:
Feb  4 03:24:04 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.43.204.45 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.199.60.162
description:
[2025-02-04 03:24:24 +0100] info [webmaild] 181.199.60.162 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
description:
Feb  4 03:24:23 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
description:
2025-02-04 03:24:25 dovecot_plain authenticator failed for ([96.79.174.131]) [96.79.174.131]:40982: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
description:
2025-02-04 03:23:53 dovecot_plain authenticator failed for ([103.194.243.187]) [103.194.243.187]:55772: 535 Incorrect authentication data (set_id=eng20a00022y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
description:
2025-02-04 03:24:12 dovecot_plain authenticator failed for (187-50-84-19.customer.tdatabrasil.net.br) [177.43.106.73]:57419: 535 Incorrect authentication data (set_id=eng20a00022y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.207.177.75
description:
Feb  4 03:24:13 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.207.177.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.214.127.246
description:
2025-02-04 03:24:24 dovecot_plain authenticator failed for ([60.214.127.246]) [60.214.127.246]:64646: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.93.183
description:
Feb  4 03:24:24 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.93.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
description:
2025-02-04 03:24:26 dovecot_plain authenticator failed for (corporativo.static.gvt.net.br) [189.115.93.183]:37583: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.216.5.134
description:
2025-02-04 03:24:37 dovecot_plain authenticator failed for ([114.216.5.134]) [114.216.5.134]:45374: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.50.195.4
description:
[2025-02-04 03:23:53 +0100] info [webmaild] 179.50.195.4 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
description:
Feb  4 03:24:10 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.233.160.181
description:
Feb  4 03:23:50 ait sshd[3874582]: Disconnected from invalid user deploy 172.233.160.181 port 39368 [preauth]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.241.252
description:
Feb  4 03:24:16 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.241.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.186.131.108
description:
Feb  4 03:24:38 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.186.131.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-02-04 03:24:40 dovecot_plain authenticator failed for ([121.186.131.108]) [121.186.131.108]:50704: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.194.243.187
description:
Feb  4 03:23:51 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.194.243.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 03:23:56 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.177.75
description:
2025-02-04 03:24:15 dovecot_plain authenticator failed for (49.207.177.75.actcorp.in) [49.207.177.75]:46328: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.104.141.57
description:
Feb  4 03:24:33 ait sshd[3874879]: pam_imunify(sshd:auth): [IM360_RBL] The IP 171.104.141.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.93.198.164
description:
2025-02-04 03:24:37 dovecot_plain authenticator failed for ([183.93.198.164]) [183.93.198.164]:35845: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.43.204.45
description:
2025-02-04 03:24:06 dovecot_plain authenticator failed for ([188.43.204.45]) [188.43.204.45]:37030: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.214.127.246
description:
Feb  4 03:24:22 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.214.127.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 171.104.141.57
description:
Feb  4 03:24:33 ait sshd[3874879]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.104.141.57  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.241.252
description:
2025-02-04 03:24:18 dovecot_plain authenticator failed for ([183.220.241.252]) [183.220.241.252]:41674: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.93.198.164
description:
Feb  4 03:24:35 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.93.198.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Feb  4 03:24:51 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-02-04 03:24:53 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-179.static.tpgi.com.au) [110.175.220.250]:45505: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 03:25:01 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.178.132
description:
2025-02-04 03:25:03 dovecot_plain authenticator failed for (132-178-53-194.mairnet.net) [194.53.178.132]:50886: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.89.159.50
description:
[2025-02-04 03:25:38 +0100] info [webmaild] 185.89.159.50 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.231.61
description:
Feb  4 03:24:56 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.239.231.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.239.231.61
description:
2025-02-04 03:24:58 dovecot_plain authenticator failed for ([222.239.231.61]) [222.239.231.61]:51382: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.178.132
description:
Feb  4 03:25:01 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.178.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.150.123.106
description:
Feb  4 03:25:52 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.150.123.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.233.64.5
description:
2025-02-04 03:26:13 dovecot_plain authenticator failed for (static-14.38.103.extranet.co.in) [103.233.64.5]:13710: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.240
description:
Feb  4 03:26:06 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.215.211.223
description:
Feb  4 03:26:29 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.215.211.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.215.211.223
description:
2025-02-04 03:26:31 dovecot_plain authenticator failed for ([114.215.211.223]) [114.215.211.223]:37158: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.21.59.218
description:
Feb  4 03:25:51 ait sshd[3875585]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.21.59.218


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.123.106
description:
2025-02-04 03:25:54 dovecot_plain authenticator failed for ([61.150.123.106]) [61.150.123.106]:41936: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
description:
2025-02-04 03:25:54 dovecot_plain authenticator failed for (nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:59889: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 149.78.62.51
description:
[2025-02-04 03:26:14 +0100] info [webmaild] 149.78.62.51 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.226.240
description:
Feb  4 03:25:52 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.226.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.226.228
description:
Feb  4 03:25:53 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.226.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.88.146
description:
Feb  4 03:25:53 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.88.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.204.13
description:
Feb  4 03:26:22 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.204.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.204.13
description:
2025-02-04 03:26:24 dovecot_plain authenticator failed for vps-45cb66f2.vps.ovh.net [135.125.204.13]:34182: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.226.228
description:
2025-02-04 03:25:55 dovecot_plain authenticator failed for broadband-77-37-226-228.ip.moscow.rt.ru [77.37.226.228]:49840: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.240
description:
2025-02-04 03:26:08 dovecot_plain authenticator failed for ([121.202.155.240]) [121.202.155.240]:61769: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.210.126.181
description:
[2025-02-04 03:26:20 +0100] info [webmaild] 168.210.126.181 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.218.181.19
description:
2025-02-04 03:27:05 dovecot_plain authenticator failed for ([201.218.181.19]) [201.218.181.19]:39382: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.189
description:
Feb  4 03:27:49 ait sshd[3876127]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
description:
Feb  4 03:27:49 ait sshd[3876127]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.168.0.250
description:
[2025-02-04 03:26:53 +0100] info [webmaild] 45.168.0.250 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.246.92.77
description:
Feb  4 03:26:54 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.246.92.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.92.77
description:
2025-02-04 03:26:56 dovecot_plain authenticator failed for ([124.246.92.77]) [124.246.92.77]:39584: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.218.181.19
description:
Feb  4 03:27:03 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.218.181.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 03:27:34 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.152.186
description:
2025-02-04 03:26:57 dovecot_login authenticator failed for (ADMIN) [102.129.152.186]:50454: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.112.104.162
description:
Feb  4 03:27:04 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.112.104.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.104.162
description:
2025-02-04 03:27:06 dovecot_plain authenticator failed for ([36.112.104.162]) [36.112.104.162]:60923: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Feb  4 03:28:03 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-02-04 03:28:05 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (utters) [91.56.31.167]:60643: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.214.202.15
description:
[2025-02-04 03:28:17 +0100] info [webmaild] 103.214.202.15 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 132.255.57.182
description:
[2025-02-04 03:28:46 +0100] info [webmaild] 132.255.57.182 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.157.227
description:
Feb  4 03:28:52 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.157.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.93.113.138
description:
Feb  4 03:29:01 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.93.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 151.236.166.157
description:
[2025-02-04 03:29:04 +0100] info [webmaild] 151.236.166.157 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.143.51.58
description:
Feb  4 03:29:19 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.143.51.58 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.21.59.218
description:
Feb  4 03:28:51 ait sshd[3876526]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.21.59.218


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.157.227
description:
2025-02-04 03:28:54 dovecot_plain authenticator failed for (perie) [65.20.157.227]:46811: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.13.140
description:
[2025-02-04 03:29:39 +0100] info [webmaild] 45.70.13.140 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.223.203
description:
Feb  4 03:30:42 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.223.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.223.203
description:
2025-02-04 03:30:44 dovecot_plain authenticator failed for ([210.99.223.203]) [210.99.223.203]:60494: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.21.59.218
description:
Feb  4 03:30:15 ait sshd[3877247]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.21.59.218


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.195.250
description:
Feb  4 03:30:19 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.195.250 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.59.218
description:
Feb  4 03:30:18 ait sshd[3877247]: Failed password for invalid user git from 125.21.59.218 port 36344 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.195.250
description:
2025-02-04 03:30:21 dovecot_plain authenticator failed for (flenating) [65.20.195.250]:37172: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.20.253.109
description:
2025-02-04 03:30:59 dovecot_plain authenticator failed for (173-20-253-109.client.mchsi.com) [173.20.253.109]:46148: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.134.161.29
description:
[2025-02-04 03:31:24 +0100] info [webmaild] 186.134.161.29 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Feb  4 03:31:32 ait sshd[3877642]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Feb  4 03:31:32 ait sshd[3877642]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Feb  4 03:31:08 ait sshd[3877581]: Invalid user barbaras-pflegedienst.de 2a00 from 122.51.104.242 port 48642


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Feb  4 03:31:08 ait sshd[3877581]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.191.158.156
description:
[2025-02-04 03:30:54 +0100] info [webmaild] 105.191.158.156 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.20.253.109
description:
Feb  4 03:30:57 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.20.253.109 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  4 03:31:08 ait sshd[3877581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.8.131.178
description:
[2025-02-04 03:31:41 +0100] info [webmaild] 177.8.131.178 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.36.64.247
description:
2025-02-04 03:32:12 dovecot_plain authenticator failed for net-2-36-64-247.cust.vodafonedsl.it (alshommer) [2.36.64.247]:38593: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.208.183.131
description:
[2025-02-04 03:32:14 +0100] info [webmaild] 181.208.183.131 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.36.64.247
description:
Feb  4 03:32:10 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.36.64.247 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:03-32.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.180
description:
Feb  4 03:32:30 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
description:
2025-02-04 03:32:32 dovecot_plain authenticator failed for (lubbed) [102.53.15.180]:63319: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.253.115.130
description:
2025-02-04 03:32:45 dovecot_login authenticator failed for (ait.edu.gh) [182.253.115.130]:50943: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.161.68
description:
Feb  4 03:33:36 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.161.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.135.13
description:
Feb  4 03:33:38 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.135.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.216.135.13
description:
2025-02-04 03:33:40 dovecot_plain authenticator failed for ([103.216.135.13]) [103.216.135.13]:53708: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.193.167.212
description:
Feb  4 03:33:24 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.193.167.212 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.92.140.161
description:
[2025-02-04 03:33:23 +0100] info [webmaild] 201.92.140.161 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.193.167.212
description:
2025-02-04 03:33:26 dovecot_plain authenticator failed for ([183.242.64.111]) [111.193.167.212]:51302: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.147.25.111
description:
2025-02-04 03:33:22 dovecot_plain authenticator failed for ([121.147.25.111]) [121.147.25.111]:33762: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.161.68
description:
2025-02-04 03:33:38 dovecot_plain authenticator failed for ([65.20.161.68]) [65.20.161.68]:47589: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.253.115.130
description:
2025-02-04 03:32:52 dovecot_plain authenticator failed for (ait.edu.gh) [182.253.115.130]:50943: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.147.25.111
description:
Feb  4 03:33:20 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.147.25.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.125.43
description:
2025-02-04 03:34:04 dovecot_plain authenticator failed for ([14.37.125.43]) [14.37.125.43]:47779: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.167.217.147
description:
2025-02-04 03:34:06 dovecot_plain authenticator failed for ([121.167.217.147]) [121.167.217.147]:35064: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
description:
Feb  4 03:34:11 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.84.33.2
description:
2025-02-04 03:34:18 dovecot_plain authenticator failed for ([223.84.33.2]) [223.84.33.2]:43774: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.35.199.239
description:
Feb  4 03:33:58 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.35.199.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.188
description:
2025-02-04 03:34:02 dovecot_plain authenticator failed for ([27.40.100.188]) [27.40.100.188]:43020: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.135.188.125
description:
Feb  4 03:34:03 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.135.188.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
description:
2025-02-04 03:34:38 dovecot_plain authenticator failed for ([61.72.59.106]) [61.72.59.106]:37617: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
description:
2025-02-04 03:34:00 dovecot_plain authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:51430: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.168.78
description:
2025-02-04 03:34:10 dovecot_plain authenticator failed for (78-168-168-45.weblinknet.com.br) [45.168.168.78]:43470: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.122.139.172
description:
Feb  4 03:34:00 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.122.139.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.181.81
description:
2025-02-04 03:34:03 dovecot_plain authenticator failed for ([85.130.181.81]) [85.130.181.81]:62679: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.30.214
description:
Feb  4 03:34:09 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.30.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.250.225.23
description:
2025-02-04 03:34:13 dovecot_plain authenticator failed for syn-172-250-225-023.res.spectrum.com [172.250.225.23]:42204: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.113.91.98
description:
Feb  4 03:34:28 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.113.91.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.218.181.20
description:
2025-02-04 03:34:35 dovecot_plain authenticator failed for (201.218.181.20.viptel.com) [201.218.181.20]:60580: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.88.22
description:
2025-02-04 03:34:05 dovecot_plain authenticator failed for ([61.150.88.22]) [61.150.88.22]:50002: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.61.209
description:
Feb  4 03:34:11 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.61.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.87.49.250
description:
Feb  4 03:34:15 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.87.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.152.108.61
description:
2025-02-04 03:34:16 dovecot_plain authenticator failed for syn-098-152-108-061.biz.spectrum.com [98.152.108.61]:46971: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
description:
Feb  4 03:34:26 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
description:
2025-02-04 03:34:28 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:53872: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.95.195
description:
2025-02-04 03:34:46 dovecot_plain authenticator failed for ([47.206.95.195]) [47.206.95.195]:59676: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.83.0.148
description:
Feb  4 03:33:58 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.83.0.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.169.209.141
description:
Feb  4 03:34:01 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.169.209.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.167.217.147
description:
Feb  4 03:34:04 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.167.217.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.168.78
description:
Feb  4 03:34:08 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.168.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.163.236.235
description:
Feb  4 03:34:13 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.163.236.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.163.236.235
description:
2025-02-04 03:34:15 dovecot_plain authenticator failed for ([222.163.236.235]) [222.163.236.235]:48010: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.206.95.195
description:
Feb  4 03:34:44 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.206.95.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.160.228
description:
Feb  4 03:34:46 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.160.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.86.6
description:
Feb  4 03:34:01 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.86.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.250.225.23
description:
Feb  4 03:34:11 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.250.225.23 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.224.96.225
description:
[2025-02-04 03:34:11 +0100] info [webmaild] 88.224.96.225 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.61.209
description:
2025-02-04 03:34:13 dovecot_plain authenticator failed for ([39.165.61.209]) [39.165.61.209]:59016: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.211.197.38
description:
Feb  4 03:34:15 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.211.197.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.48.181
description:
2025-02-04 03:34:19 dovecot_plain authenticator failed for broadband-37-110-48-181.ip.moscow.rt.ru [37.110.48.181]:41730: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.238.206
description:
2025-02-04 03:34:36 dovecot_plain authenticator failed for ([95.221.238.206]) [95.221.238.206]:51621: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.230.168.26
description:
Feb  4 03:33:58 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.230.168.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.95.13.185
description:
Feb  4 03:34:16 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.95.13.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.48.181
description:
Feb  4 03:34:17 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.48.181 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.54.79.182
description:
[2025-02-04 03:33:54 +0100] info [webmaild] 187.54.79.182 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.188
description:
Feb  4 03:34:00 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.181.81
description:
Feb  4 03:34:01 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.181.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.150.88.22
description:
Feb  4 03:34:03 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.150.88.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.30.214
description:
2025-02-04 03:34:11 dovecot_plain authenticator failed for ([220.77.30.214]) [220.77.30.214]:53770: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.152.108.61
description:
Feb  4 03:34:14 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.152.108.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.87.49.250
description:
2025-02-04 03:34:17 dovecot_plain authenticator failed for ([222.87.49.250]) [222.87.49.250]:54412: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
description:
2025-02-04 03:34:18 dovecot_plain authenticator failed for (74-95-13-185-SFBA.hfc.comcastbusiness.net) [74.95.13.185]:57480: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.115.211
description:
2025-02-04 03:34:30 dovecot_plain authenticator failed for (211.115.156.175.unknown.m1.com.sg) [175.156.115.211]:55658: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.132.137.230
description:
Feb  4 03:34:00 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.132.137.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.86.6
description:
2025-02-04 03:34:03 dovecot_plain authenticator failed for ([188.168.86.6]) [188.168.86.6]:49758: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.197.38
description:
2025-02-04 03:34:17 dovecot_plain authenticator failed for ([117.211.197.38]) [117.211.197.38]:59172: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 48.218.170.53
description:
2025-02-04 03:34:18 dovecot_plain authenticator failed for ([48.218.170.53]) [48.218.170.53]:36728: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.105.234
description:
[2025-02-04 03:34:46 +0100] info [webmaild] 157.100.105.234 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.202.11
description:
2025-02-04 03:34:03 dovecot_plain authenticator failed for (381859.cloudwaysapps.com) [128.199.202.11]:60256: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.9
description:
2025-02-04 03:34:12 dovecot_plain authenticator failed for ([185.167.58.9]) [185.167.58.9]:38012: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.196.97
description:
Feb  4 03:34:16 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.196.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.113.91.98
description:
2025-02-04 03:34:30 dovecot_plain authenticator failed for ([223.113.91.98]) [223.113.91.98]:53432: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.218.181.20
description:
Feb  4 03:34:33 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.218.181.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.99.36.130
description:
Feb  4 03:34:46 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.99.36.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.202.11
description:
Feb  4 03:34:01 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.199.202.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.122.139.172
description:
2025-02-04 03:34:02 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:58448: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.84.33.2
description:
Feb  4 03:34:16 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.84.33.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.177.3.82
description:
Feb  4 03:34:22 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.177.3.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
description:
Feb  4 03:34:36 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.228
description:
2025-02-04 03:34:48 dovecot_plain authenticator failed for (coriess) [65.20.160.228]:58292: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.135.188.125
description:
2025-02-04 03:34:05 dovecot_plain authenticator failed for ([121.135.188.125]) [121.135.188.125]:49088: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.9
description:
Feb  4 03:34:10 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.238.206
description:
Feb  4 03:34:34 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.238.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.35.199.239
description:
2025-02-04 03:34:00 dovecot_plain authenticator failed for (199.35.89.239.bcube.co.uk) [89.35.199.239]:40234: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.0.148
description:
2025-02-04 03:34:00 dovecot_plain authenticator failed for ool-43530094.dyn.optonline.net [67.83.0.148]:61233: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.132.137.230
description:
2025-02-04 03:34:02 dovecot_plain authenticator failed for ([78.132.137.230]) [78.132.137.230]:49026: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.169.209.141
description:
2025-02-04 03:34:03 dovecot_plain authenticator failed for 141.sub-166-169-209.myvzw.com [166.169.209.141]:41808: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
description:
2025-02-04 03:34:13 dovecot_plain authenticator failed for ([203.128.181.121]) [203.128.181.121]:47662: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 48.218.170.53
description:
Feb  4 03:34:16 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 48.218.170.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.97
description:
2025-02-04 03:34:18 dovecot_plain authenticator failed for (97.196.181.45.datasysteminfor.com.br) [45.181.196.97]:59445: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.177.3.82
description:
2025-02-04 03:34:24 dovecot_plain authenticator failed for ip98-177-3-82.ph.ph.cox.net [98.177.3.82]:53939: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.115.211
description:
Feb  4 03:34:28 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.115.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.125.43
description:
Feb  4 03:34:02 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.125.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.99.36.130
description:
2025-02-04 03:34:48 dovecot_plain authenticator failed for ([50.99.36.130]) [50.99.36.130]:55616: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.99.210
description:
Feb  4 03:35:28 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.99.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.99.210
description:
2025-02-04 03:35:30 dovecot_plain authenticator failed for ([222.160.99.210]) [222.160.99.210]:41000: 535 Incorrect authentication data (set_id=nyarko@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
description:
Feb  4 03:35:40 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
description:
2025-02-04 03:35:42 dovecot_plain authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:42966: 535 Incorrect authentication data (set_id=nyarko)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.6.143.161
description:
[2025-02-04 03:36:27 +0100] info [webmaild] 200.6.143.161 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.41.169.132
description:
[2025-02-04 03:36:44 +0100] info [webmaild] 201.41.169.132 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.43.176.5
description:
[2025-02-04 03:36:01 +0100] info [webmaild] 200.43.176.5 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
description:
2025-02-04 03:37:11 dovecot_plain authenticator failed for ([196.190.43.138]) [196.190.41.137]:44987: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.140.110
description:
[2025-02-04 03:37:19 +0100] info [webmaild] 157.100.140.110 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.207.176.198
description:
Feb  4 03:37:28 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.207.176.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Feb  4 03:37:08 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.41.137
description:
Feb  4 03:37:09 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.41.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-02-04 03:37:10 dovecot_login authenticator failed for 110-175-220-250.static.tpgi.com.au (203-194-21-196.tpgi.com.au) [110.175.220.250]:37026: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.170.200
description:
Feb  4 03:37:23 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.170.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.170.200
description:
2025-02-04 03:37:25 dovecot_login authenticator failed for (broadband-37.204-170-200.ip.moscow.rt.ru) [37.204.170.200]:43035: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.176.198
description:
2025-02-04 03:37:30 dovecot_plain authenticator failed for ([196.207.176.198]) [196.207.176.198]:51584: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.43.51.237
description:
[2025-02-04 03:38:28 +0100] info [webmaild] 31.43.51.237 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.160.38.13
description:
Feb  4 03:39:30 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.160.38.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.85.196
description:
Feb  4 03:39:26 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.85.196 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.242.44.3
description:
[2025-02-04 03:39:26 +0100] info [webmaild] 201.242.44.3 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.37.78.41
description:
[2025-02-04 03:38:59 +0100] info [webmaild] 189.37.78.41 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 03:39:02 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.50.222
description:
47.128.50.222 - - [04/Feb/2025:03:39:07 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=26565188 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/8/?duration=short&filtering=1&level=intermediate%2Cbeginner%2Cexpert&rating_filter=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.50.222


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.238.94
description:
2025-02-04 03:39:23 dovecot_plain authenticator failed for 186-247-238-94.user.veloxzone.com.br [186.247.238.94]:44442: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.238.94
description:
Feb  4 03:39:21 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.238.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.160.38.13
description:
2025-02-04 03:39:32 dovecot_plain authenticator failed for 89-160-38-13.cust.bredband2.com [89.160.38.13]:38128: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.37.181
description:
Feb  4 03:39:17 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.37.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.37.181
description:
2025-02-04 03:39:19 dovecot_plain authenticator failed for ([158.140.37.181]) [158.140.37.181]:40842: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.85.196
description:
2025-02-04 03:39:28 dovecot_plain authenticator failed for (2-55-85-196.orange.net.il) [2.55.85.196]:51329: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.204.125.125
description:
Feb  4 03:39:57 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.204.125.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.191.170.208
description:
2025-02-04 03:40:16 dovecot_plain authenticator failed for syn-108-191-170-208.biz.spectrum.com [108.191.170.208]:45518: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.188.122.79
description:
[2025-02-04 03:39:50 +0100] info [webmaild] 45.188.122.79 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.204.125.125
description:
2025-02-04 03:39:59 dovecot_plain authenticator failed for ([210.204.125.125]) [210.204.125.125]:34831: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.191.170.208
description:
Feb  4 03:40:14 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.191.170.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Feb  4 03:40:36 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-02-04 03:40:38 dovecot_plain authenticator failed for (conplamar) [81.211.77.58]:63510: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Feb  4 03:42:47 ait sshd[3881874]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.98.116.242
description:
[2025-02-04 03:41:56 +0100] info [webmaild] 189.98.116.242 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.119.54
description:
47.128.119.54 - - [04/Feb/2025:03:42:30 +0100] "GET /wp-content/uploads/sites/6/2022/05/Smart-Logo.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16618300" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.54


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Feb  4 03:42:47 ait sshd[3881874]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.3.215.14
description:
[2025-02-04 03:42:29 +0100] info [webmaild] 177.3.215.14 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.40.72.101
description:
Feb  4 03:43:38 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.40.72.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.40.72.101
description:
2025-02-04 03:43:40 dovecot_plain authenticator failed for ([89.40.72.101]) [89.40.72.101]:36068: 535 Incorrect authentication data (set_id=ads22b00248y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.117.240.118
description:
[2025-02-04 03:43:42 +0100] info [webmaild] 138.117.240.118 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.83.26.200
description:
Feb  4 03:43:48 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.83.26.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.206.19
description:
2025-02-04 03:43:19 dovecot_plain authenticator failed for syn-076-176-206-019.res.spectrum.com [76.176.206.19]:63968: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
description:
Feb  4 03:43:29 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.206.19
description:
Feb  4 03:43:17 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.206.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-02-04 03:43:31 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:35603: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.189
description:
Feb  4 03:44:11 ait sshd[3882214]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.7.97.85
description:
[2025-02-04 03:44:39 +0100] info [webmaild] 191.7.97.85 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.125.94
description:
Feb  4 03:44:45 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
description:
2025-02-04 03:44:47 dovecot_plain authenticator failed for ([111.171.125.94]) [111.171.125.94]:33435: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
description:
2025-02-04 03:44:00 dovecot_plain authenticator failed for (pfilicker) [154.144.243.93]:47458: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.243.93
description:
Feb  4 03:43:58 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.243.93 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
description:
Feb  4 03:44:11 ait sshd[3882214]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.47.138.158
description:
[2025-02-04 03:44:13 +0100] info [webmaild] 186.47.138.158 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.83.26.200
description:
2025-02-04 03:43:50 dovecot_plain authenticator failed for ([80.83.26.200]) [80.83.26.200]:50261: 535 Incorrect authentication data (set_id=ads22b00248y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.208.136.225
description:
Feb  4 03:45:32 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.208.136.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.136.225
description:
2025-02-04 03:45:34 dovecot_plain authenticator failed for 31-208-136-225.cust.bredband2.com [31.208.136.225]:38867: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.138.132.109
description:
Feb  4 03:45:47 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.138.132.109 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.69.81
description:
[2025-02-04 03:45:07 +0100] info [webmaild] 157.100.69.81 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.220.16.46
description:
Feb  4 03:45:06 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.220.16.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.138.132.109
description:
2025-02-04 03:45:49 dovecot_plain authenticator failed for ([36.138.132.109]) [36.138.132.109]:54022: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.189.149.199
description:
[2025-02-04 03:46:24 +0100] info [webmaild] 179.189.149.199 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.105.193.80
description:
2025-02-04 03:47:44 dovecot_plain authenticator failed for user80.77-105-193.netatonce.net (flatinize) [77.105.193.80]:43098: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.226.142.114
description:
2025-02-04 03:47:49 dovecot_plain authenticator failed for ([221.226.142.114]) [221.226.142.114]:55710: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.105.193.80
description:
Feb  4 03:47:42 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.105.193.80 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.202.58.91
description:
[2025-02-04 03:47:43 +0100] info [webmaild] 143.202.58.91 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.165.222.245
description:
[2025-02-04 03:47:10 +0100] info [webmaild] 45.165.222.245 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
description:
2025-02-04 03:47:28 dovecot_plain authenticator failed for (inone) [41.248.243.181]:43182: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.130.16
description:
Feb  4 03:47:33 ait dovecot[3298119]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.130.16, lip=136.243.145.84, TLS, session=<0pvqB0gt85otnIIQ>


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.52.109
description:
Feb  4 03:47:40 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.168.37.74
description:
[2025-02-04 03:46:52 +0100] info [webmaild] 152.168.37.74 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.248.243.181
description:
Feb  4 03:47:26 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.248.243.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.10.221.104
description:
Feb  4 03:47:35 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.10.221.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.221.104
description:
2025-02-04 03:47:37 dovecot_plain authenticator failed for ([221.10.221.104]) [221.10.221.104]:60157: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
description:
2025-02-04 03:47:42 dovecot_plain authenticator failed for 77-85-52-109.ip.btc-net.bg (experve) [77.85.52.109]:57367: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.226.142.114
description:
Feb  4 03:47:47 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.226.142.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.214.65.245
description:
2025-02-04 03:48:16 dovecot_plain authenticator failed for ([123.214.65.245]) [123.214.65.245]:48316: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.217.105
description:
Feb  4 03:48:28 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.217.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.197.237.177
description:
Feb  4 03:47:58 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.197.237.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.188.253.175
description:
Feb  4 03:48:08 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.188.253.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.188.253.175
description:
2025-02-04 03:48:10 dovecot_plain authenticator failed for (istes) [90.188.253.175]:57470: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.85.69.22
description:
Feb  4 03:48:11 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.85.69.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.85.69.22
description:
2025-02-04 03:48:13 dovecot_plain authenticator failed for ([194.85.69.22]) [194.85.69.22]:49096: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.197.237.177
description:
2025-02-04 03:48:00 dovecot_plain authenticator failed for (177.237.197.116.unknown.m1.com.sg) [116.197.237.177]:43508: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.214.65.245
description:
Feb  4 03:48:14 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.214.65.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.217.105
description:
2025-02-04 03:48:30 dovecot_plain authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:53836: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.19.108
description:
Feb  4 03:49:25 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.19.108 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:03-49.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.58.221.230
description:
[2025-02-04 03:49:38 +0100] info [webmaild] 201.58.221.230 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.19.108
description:
2025-02-04 03:49:27 dovecot_plain authenticator failed for (tropix) [149.0.19.108]:53600: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Feb  4 03:49:43 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.115.200.53
description:
[2025-02-04 03:48:57 +0100] info [webmaild] 190.115.200.53 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.115.208.211
description:
[2025-02-04 03:49:27 +0100] info [webmaild] 190.115.208.211 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.184.218.49
description:
Feb  4 03:50:40 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.184.218.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
description:
2025-02-04 03:50:42 dovecot_plain authenticator failed for (imparhoteis.static.gvt.net.br) [179.184.218.49]:46841: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Feb  4 03:49:50 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.251.107.47
description:
Feb  4 03:50:00 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.251.107.47 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.151.118.154
description:
[2025-02-04 03:50:10 +0100] info [webmaild] 201.151.118.154 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-02-04 03:51:10 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:45378: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.196.17.69
description:
[2025-02-04 03:51:27 +0100] info [webmaild] 168.196.17.69 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.41.81.24
description:
Feb  4 03:51:44 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.41.81.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.51.122.230
description:
Feb  4 03:51:45 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.51.122.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.81.24
description:
2025-02-04 03:51:46 dovecot_plain authenticator failed for (24.81.41.31.ip4.feromedia.eu) [31.41.81.24]:59121: 535 Incorrect authentication data (set_id=sarpong-nsiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.51.122.230
description:
2025-02-04 03:51:47 dovecot_plain authenticator failed for ([58.51.122.230]) [58.51.122.230]:38390: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Feb  4 03:51:08 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.6.11.214
description:
[2025-02-04 03:52:41 +0100] info [webmaild] 191.6.11.214 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.100
description:
2025-02-04 03:51:57 dovecot_plain authenticator failed for (m121-202-153-100.smartone.com) [121.202.153.100]:22053: 535 Incorrect authentication data (set_id=sarpong-nsiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
description:
Feb  4 03:52:01 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 03:52:14 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.32.250.174
description:
2025-02-04 03:52:19 dovecot_plain authenticator failed for ([117.32.250.174]) [117.32.250.174]:60500: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.58.22
description:
2025-02-04 03:52:38 dovecot_login authenticator failed for (ADMIN) [173.244.58.22]:32972: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.100
description:
Feb  4 03:51:55 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.216.168.226
description:
Feb  4 03:51:58 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.216.168.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.168.226
description:
2025-02-04 03:52:00 dovecot_plain authenticator failed for (200-217-53-25.host.telemar.net.br) [200.216.168.226]:58522: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.32.250.174
description:
Feb  4 03:52:17 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.32.250.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
description:
2025-02-04 03:52:03 dovecot_plain authenticator failed for ([211.109.75.68]) [211.109.75.69]:52987: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.55.186.174
description:
[2025-02-04 03:51:56 +0100] info [webmaild] 177.55.186.174 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 24.152.64.62
description:
[2025-02-04 03:52:08 +0100] info [webmaild] 24.152.64.62 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.0.149.238
description:
2025-02-04 03:53:48 dovecot_plain authenticator failed for net-130-0-149-238.cust.vodafonedsl.it (nondae) [130.0.149.238]:34048: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.112.29
description:
2025-02-04 03:53:15 dovecot_plain authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:55482: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.12
description:
Feb  4 03:53:17 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.233.77.136
description:
Feb  4 03:53:39 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.233.77.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.77.136
description:
2025-02-04 03:53:41 dovecot_login authenticator failed for ([80.233.77.136]) [80.233.77.136]:31639: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.0.149.238
description:
Feb  4 03:53:46 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.0.149.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.179.123.160
description:
Feb  4 03:53:49 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.179.123.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.112.29
description:
Feb  4 03:53:13 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.112.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
description:
2025-02-04 03:53:19 dovecot_plain authenticator failed for (copeclated) [65.20.191.12]:48792: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.128.19.228
description:
Feb  4 03:53:21 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.128.19.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.128.19.228
description:
2025-02-04 03:53:23 dovecot_plain authenticator failed for ([57.128.19.228]) [57.128.19.228]:60328: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.25
description:
2025-02-04 03:54:26 dovecot_plain authenticator failed for ([121.202.154.25]) [121.202.154.25]:24532: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.94.18.69
description:
Feb  4 03:54:33 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.94.18.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.94.18.69
description:
2025-02-04 03:54:35 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:44956: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.64.246
description:
Feb  4 03:54:39 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.64.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.43.204.45
description:
2025-02-04 03:54:48 dovecot_plain authenticator failed for ([188.43.204.45]) [188.43.204.45]:34539: 535 Incorrect authentication data (set_id=zabopiqu@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Feb  4 03:54:15 ait sshd[3885626]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 03:54:36 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.244.213.234
description:
2025-02-04 03:54:26 dovecot_plain authenticator failed for ([115.244.213.234]) [115.244.213.234]:53802: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.255.54.75
description:
[2025-02-04 03:54:30 +0100] info [webmaild] 131.255.54.75 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
description:
2025-02-04 03:54:41 dovecot_plain authenticator failed for ([213.230.64.246]) [213.230.64.246]:56380: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.179.123.160
description:
2025-02-04 03:53:51 dovecot_login authenticator failed for ([163.179.123.160]) [163.179.123.160]:55209: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.162.92.105
description:
[2025-02-04 03:54:00 +0100] info [webmaild] 45.162.92.105 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.25
description:
Feb  4 03:54:24 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.244.213.234
description:
Feb  4 03:54:24 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.244.213.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.43.204.45
description:
Feb  4 03:54:46 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.43.204.45 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Feb  4 03:54:15 ait sshd[3885626]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=aitopen


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.27.114
description:
Feb  4 03:55:02 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.27.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.27.114
description:
2025-02-04 03:55:04 dovecot_plain authenticator failed for (114.27.33.36.adsl-pool.ah.cnuninet.net) [36.33.27.114]:60242: 535 Incorrect authentication data (set_id=zabopiqu)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.190.189.168
description:
[2025-02-04 03:55:13 +0100] info [webmaild] 177.190.189.168 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
description:
Feb  4 03:55:36 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
description:
2025-02-04 03:55:38 dovecot_plain authenticator failed for ([41.220.3.113]) [41.220.3.101]:25652: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.1.154
description:
2025-02-04 03:55:53 dovecot_plain authenticator failed for 110-4-1-154.static.pccw-hkt.com [110.4.1.154]:64947: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 03:56:10 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Feb  4 03:56:45 ait sshd[3886548]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.177.168.72
description:
[2025-02-04 03:55:59 +0100] info [webmaild] 102.177.168.72 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.12.201.7
description:
Feb  4 03:56:18 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.12.201.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.54.83.22
description:
Feb  4 03:56:25 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.54.83.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.59.141.152
description:
Feb  4 03:55:56 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.59.141.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Feb  4 03:56:03 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.201.7
description:
2025-02-04 03:56:20 dovecot_plain authenticator failed for ([59.12.201.7]) [59.12.201.7]:36660: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 94.136.191.170
description:
Feb  4 03:56:28 ait sshd[3886535]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.136.191.170


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Feb  4 03:56:45 ait sshd[3886548]: Invalid user barbaras-pflegedienst.de 2a00 from 122.51.104.242 port 47996


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.118
description:
2025-02-04 03:56:03 dovecot_plain authenticator failed for (m121-202-155-118.smartone.com) [121.202.155.118]:3537: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  4 03:56:45 ait sshd[3886548]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.1.154
description:
Feb  4 03:55:51 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.1.154 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.23.84.82
description:
[2025-02-04 03:56:45 +0100] info [webmaild] 187.23.84.82 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.118
description:
Feb  4 03:56:01 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.244.39
description:
2025-02-04 03:56:17 dovecot_plain authenticator failed for ([103.69.244.39]) [103.69.244.39]:60698: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.59.141.152
description:
2025-02-04 03:55:58 dovecot_plain authenticator failed for ([5.59.141.152]) [5.59.141.152]:55996: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-02-04 03:56:05 dovecot_plain authenticator failed for (nsg-static-170.125.76.182-airtel.com) [182.76.87.90]:58160: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.244.39
description:
Feb  4 03:56:15 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.83.22
description:
2025-02-04 03:56:27 dovecot_plain authenticator failed for (2-54-83-22.orange.net.il) [2.54.83.22]:46672: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.136.191.170
description:
Feb  4 03:56:28 ait sshd[3886535]: pam_imunify(sshd:auth): [IM360_RBL] The IP 94.136.191.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
description:
Feb  4 03:57:33 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
description:
2025-02-04 03:57:35 dovecot_plain authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:48702: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.24.75.95
description:
[2025-02-04 03:57:14 +0100] info [webmaild] 95.24.75.95 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 03:57:22 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.132.113
description:
Feb  4 03:58:03 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.132.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.34.158.19
description:
2025-02-04 03:58:32 dovecot_plain authenticator failed for ti0004q160-7861.bb.online.no [95.34.158.19]:55978: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.21.9.236
description:
Feb  4 03:58:45 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.21.9.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.21.9.236
description:
2025-02-04 03:58:47 dovecot_plain authenticator failed for ([210.21.9.236]) [210.21.9.236]:37476: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 03:58:28 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.168.173.87
description:
2025-02-04 03:58:44 dovecot_plain authenticator failed for (ratiscorum) [185.168.173.87]:56566: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.222.38.9
description:
Feb  4 03:57:55 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.222.38.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.202.24.117
description:
Feb  4 03:57:57 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.202.24.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.222.38.9
description:
2025-02-04 03:57:57 dovecot_plain authenticator failed for (scz-177-222-38-00009.tigo.bo) [177.222.38.9]:56875: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.202.24.117
description:
2025-02-04 03:57:59 dovecot_plain authenticator failed for ([120.202.24.117]) [120.202.24.117]:35161: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.132.113
description:
2025-02-04 03:58:05 dovecot_plain authenticator failed for ([188.226.132.113]) [188.226.132.113]:51844: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.34.158.19
description:
Feb  4 03:58:30 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.34.158.19 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.70.11
description:
[2025-02-04 03:58:31 +0100] info [webmaild] 170.239.70.11 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.168.173.87
description:
Feb  4 03:58:42 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.168.173.87 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.116.201.198
description:
[2025-02-04 03:57:55 +0100] info [webmaild] 181.116.201.198 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.238
description:
Feb  4 03:58:10 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.238
description:
2025-02-04 03:58:12 dovecot_plain authenticator failed for ([196.191.212.238]) [196.191.212.238]:43998: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.175.76.146
description:
Feb  4 03:59:15 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.175.76.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
description:
2025-02-04 03:59:17 dovecot_plain authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:58832: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Feb  4 03:59:19 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.185.160.6
description:
2025-02-04 03:59:09 dovecot_plain authenticator failed for (6.160.185.190.cable.dyn.ridsa.com.ar) [190.185.160.6]:45359: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.107.194.229
description:
Feb  4 03:59:20 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.107.194.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.107.194.229
description:
2025-02-04 03:59:22 dovecot_plain authenticator failed for ([211.107.194.229]) [211.107.194.229]:58554: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 03:59:32 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.30.203.102
description:
Feb  4 03:59:32 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.30.203.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.205.48.62
description:
2025-02-04 03:59:45 dovecot_plain authenticator failed for 47-205-48-62.tamp.fl.frontiernet.net [47.205.48.62]:39312: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.191
description:
Feb  4 03:59:06 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.185.160.6
description:
Feb  4 03:59:07 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.185.160.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.191
description:
2025-02-04 03:59:08 dovecot_plain authenticator failed for 111-70-32-191.emome-ip.hinet.net [111.70.32.191]:49358: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-02-04 03:59:21 dovecot_plain authenticator failed for ([103.103.35.130]) [103.103.35.130]:35881: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.205.48.62
description:
Feb  4 03:59:43 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.205.48.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.12.134
description:
Feb  4 03:59:25 ait sshd[3887276]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.215.12.134 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.215.12.134
description:
Feb  4 03:59:25 ait sshd[3887276]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.215.12.134


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.203.102
description:
2025-02-04 03:59:34 dovecot_plain authenticator failed for ([114.30.203.102]) [114.30.203.102]:47066: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.11.3.56
description:
[2025-02-04 03:59:37 +0100] info [webmaild] 190.11.3.56 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.245.217.87
description:
[2025-02-04 04:00:07 +0100] info [webmaild] 170.245.217.87 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Feb  4 04:00:09 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.196.172.215
description:
Feb  4 04:00:47 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.196.172.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.73.103.221
description:
Feb  4 03:59:52 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.73.103.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.154.56.124
description:
Feb  4 03:59:57 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.154.56.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.56.124
description:
2025-02-04 03:59:59 dovecot_plain authenticator failed for ([160.154.56.124]) [160.154.56.124]:27348: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-02-04 04:00:35 dovecot_plain authenticator failed for ([221.209.48.204]) [221.209.48.203]:44452: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Feb  4 04:00:33 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.1.40.151
description:
Feb  4 03:59:49 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.1.40.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
description:
2025-02-04 03:59:51 dovecot_plain authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:38127: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.73.103.221
description:
2025-02-04 03:59:54 dovecot_plain authenticator failed for ([216.73.103.221]) [216.73.103.221]:34357: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-02-04 04:00:11 dovecot_plain authenticator failed for ([59.98.150.190]) [122.160.68.46]:43690: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.90.43
description:
Feb  4 04:00:48 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.90.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.90.43
description:
2025-02-04 04:00:50 dovecot_plain authenticator failed for ([39.174.90.43]) [39.174.90.43]:40104: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.109.133.55
description:
[2025-02-04 04:01:11 +0100] info [webmaild] 187.109.133.55 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 04:01:15 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.228.167.156
description:
[2025-02-04 04:01:46 +0100] info [webmaild] 45.228.167.156 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.196.172.215
description:
2025-02-04 04:00:49 dovecot_plain authenticator failed for (fencey) [156.196.172.215]:47198: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Feb  4 04:02:02 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 04:02:02 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-02-04 04:02:04 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (hetic) [109.67.154.24]:53634: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.197.38.12
description:
Feb  4 04:02:33 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.197.38.12 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.162.72.13
description:
[2025-02-04 04:02:34 +0100] info [webmaild] 45.162.72.13 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.197.38.12
description:
2025-02-04 04:02:35 dovecot_plain authenticator failed for ([181.197.38.12]) [181.197.38.12]:55640: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.10.31.45
description:
[2025-02-04 04:02:03 +0100] info [webmaild] 103.10.31.45 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 04:02:59 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.253.142
description:
Feb  4 04:03:02 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.253.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.253.142
description:
2025-02-04 04:03:04 dovecot_plain authenticator failed for ([122.165.253.142]) [122.165.253.142]:52401: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.82.199.25
description:
[2025-02-04 04:03:42 +0100] info [webmaild] 201.82.199.25 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.71.211.76
description:
[2025-02-04 04:04:44 +0100] info [webmaild] 188.71.211.76 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.10.75.45
description:
2025-02-04 04:04:16 dovecot_plain authenticator failed for (ovellog) [81.10.75.45]:58577: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.69.255.239
description:
Feb  4 04:04:22 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.69.255.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.72.153.14
description:
Feb  4 04:04:39 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.72.153.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.10.75.45
description:
Feb  4 04:04:14 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.10.75.45 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.195.9.238
description:
[2025-02-04 04:04:17 +0100] info [webmaild] 168.195.9.238 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.34.158.19
description:
Feb  4 04:05:05 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.34.158.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
description:
2025-02-04 04:05:13 dovecot_plain authenticator failed for (fervarious) [102.53.15.180]:36373: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.227.66.92
description:
2025-02-04 04:05:20 dovecot_plain authenticator failed for ([188.227.66.92]) [188.227.66.92]:53714: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
description:
2025-02-04 04:05:32 dovecot_plain authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:32250: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.72.153.14
description:
Feb  4 04:04:52 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.72.153.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.163.122.138
description:
Feb  4 04:05:12 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.163.122.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.25.233.22
description:
Feb  4 04:05:15 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.25.233.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.180
description:
Feb  4 04:05:11 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.71.121.54
description:
Feb  4 04:05:06 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.71.121.54 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.0.235.164
description:
[2025-02-04 04:05:05 +0100] info [webmaild] 168.0.235.164 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.34.158.19
description:
2025-02-04 04:05:07 dovecot_login authenticator failed for ti0004q160-7861.bb.online.no [95.34.158.19]:51870: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
description:
Feb  4 04:05:07 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
description:
2025-02-04 04:05:14 dovecot_login authenticator failed for ([92.126.223.175]) [92.126.223.175]:43842: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.227.66.92
description:
Feb  4 04:05:18 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.227.66.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.25.233.22
description:
2025-02-04 04:05:17 dovecot_plain authenticator failed for ([218.25.233.2]) [218.25.233.22]:59966: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.252.209.189
description:
Feb  4 04:05:05 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.252.209.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
description:
2025-02-04 04:05:09 dovecot_plain authenticator failed for (scenaets) [88.87.84.104]:50355: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.126.223.175
description:
Feb  4 04:05:12 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.126.223.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.118.234
description:
Feb  4 04:05:30 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.199.118.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.252.209.189
description:
2025-02-04 04:05:07 dovecot_plain authenticator failed for ([195.252.209.189]) [195.252.209.189]:40800: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-02-04 04:05:57 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com (claingly) [83.233.242.245]:60626: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Feb  4 04:06:21 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-02-04 04:06:23 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (partled) [91.56.31.167]:60490: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.80.166
description:
2025-02-04 04:06:43 dovecot_plain authenticator failed for ([1.31.80.166]) [1.31.80.166]:56217: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Feb  4 04:05:55 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.39.89.251
description:
[2025-02-04 04:06:27 +0100] info [webmaild] 196.39.89.251 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.31.80.166
description:
Feb  4 04:06:41 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.31.80.166 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-06.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.141.177.55
description:
Feb  4 04:07:48 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.141.177.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.22
description:
2025-02-04 04:06:56 dovecot_plain authenticator failed for ([122.228.225.22]) [122.228.225.22]:63610: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.198.223.127
description:
[2025-02-04 04:07:11 +0100] info [webmaild] 190.198.223.127 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.221.130.246
description:
Feb  4 04:07:39 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.221.130.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.221.130.246
description:
2025-02-04 04:07:41 dovecot_plain authenticator failed for ([211.221.130.246]) [211.221.130.246]:49512: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.68.72.179
description:
[2025-02-04 04:07:43 +0100] info [webmaild] 186.68.72.179 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.178.42.209
description:
[2025-02-04 04:07:04 +0100] info [webmaild] 191.178.42.209 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 04:07:12 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.228.225.22
description:
Feb  4 04:06:54 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.228.225.22 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.42.51
description:
47.128.42.51 - - [04/Feb/2025:04:07:37 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=22065549 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/12/?filter_course-language=79%2C121&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.42.51


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.48.27
description:
Feb  4 04:08:17 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.48.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.48.27
description:
2025-02-04 04:08:19 dovecot_plain authenticator failed for 111-70-48-27.emome-ip.hinet.net [111.70.48.27]:36071: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.239.246.153
description:
Feb  4 04:08:33 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.239.246.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.141.177.55
description:
2025-02-04 04:07:50 dovecot_plain authenticator failed for ([209.141.177.55]) [209.141.177.55]:40651: 535 Incorrect authentication data (set_id=abs18a00023y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.136
description:
Feb  4 04:07:59 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.136
description:
2025-02-04 04:08:01 dovecot_plain authenticator failed for ([178.178.194.136]) [178.178.194.136]:56130: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.239.246.153
description:
2025-02-04 04:08:35 dovecot_plain authenticator failed for 213-239-246-153.clients.your-server.de [213.239.246.153]:36242: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.157.167.54
description:
[2025-02-04 04:09:35 +0100] info [webmaild] 102.157.167.54 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.125.240.244
description:
[2025-02-04 04:08:58 +0100] info [webmaild] 177.125.240.244 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.218.2.154
description:
2025-02-04 04:09:03 dovecot_plain authenticator failed for (host-196.218.2.154-static.tedata.net) [196.218.2.154]:22434: 535 Incorrect authentication data (set_id=admin@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.250.249.12
description:
Feb  4 04:09:16 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.250.249.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.218.2.154
description:
Feb  4 04:09:01 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.218.2.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.250.249.12
description:
2025-02-04 04:09:18 dovecot_plain authenticator failed for ([45.250.249.12]) [45.250.249.12]:32916: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 04:09:25 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.204.214
description:
2025-02-04 04:10:44 dovecot_plain authenticator failed for ([117.176.204.214]) [117.176.204.214]:57874: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.59.174
description:
2025-02-04 04:10:21 dovecot_plain authenticator failed for ([222.236.59.174]) [222.236.59.174]:34988: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.223.65.15
description:
[2025-02-04 04:10:30 +0100] info [webmaild] 177.223.65.15 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.21.191.178
description:
Feb  4 04:10:28 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.21.191.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.193.168.181
description:
Feb  4 04:10:28 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.193.168.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 04:10:05 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
description:
2025-02-04 04:10:06 dovecot_plain authenticator failed for ([222.114.200.160]) [222.114.200.160]:51455: 535 Incorrect authentication data (set_id=eng19b00228y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.236.59.174
description:
Feb  4 04:10:19 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.236.59.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.108.88.121
description:
2025-02-04 04:10:22 dovecot_plain authenticator failed for ([113.108.88.121]) [113.108.88.121]:44352: 535 Incorrect authentication data (set_id=eng19b00228y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.21.191.178
description:
2025-02-04 04:10:30 dovecot_plain authenticator failed for host-79-21-191-178.retail.telecomitalia.it [79.21.191.178]:36446: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
description:
Feb  4 04:10:04 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.108.88.121
description:
Feb  4 04:10:20 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.108.88.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.181
description:
2025-02-04 04:10:30 dovecot_plain authenticator failed for ([203.193.168.181]) [203.193.168.181]:51598: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.204.214
description:
Feb  4 04:10:42 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.204.214 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.17.106.162
description:
[2025-02-04 04:09:59 +0100] info [webmaild] 197.17.106.162 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.230.214
description:
2025-02-04 04:11:32 dovecot_plain authenticator failed for ([94.204.230.214]) [94.204.230.214]:46875: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.62.67.73
description:
2025-02-04 04:10:56 dovecot_plain authenticator failed for ([85.62.67.73]) [85.62.67.73]:50610: 535 Incorrect authentication data (set_id=admin@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.38.130
description:
2025-02-04 04:11:22 dovecot_plain authenticator failed for (130.38.212.118.adsl-pool.jx.chinaunicom.com) [118.212.38.130]:59328: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.235.159
description:
2025-02-04 04:11:26 dovecot_plain authenticator failed for (tuance) [65.20.235.159]:47321: 535 Incorrect authentication data (set_id=eng20a00113y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.181.41.120
description:
Feb  4 04:11:03 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.181.41.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.212.38.130
description:
Feb  4 04:11:20 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.212.38.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.230.214
description:
Feb  4 04:11:30 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.230.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.62.67.73
description:
Feb  4 04:10:54 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.62.67.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.181.41.120
description:
2025-02-04 04:11:05 dovecot_plain authenticator failed for ([185.181.41.120]) [185.181.41.120]:46164: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.235.159
description:
Feb  4 04:11:24 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.235.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.10.129.139
description:
[2025-02-04 04:11:27 +0100] info [webmaild] 38.10.129.139 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
description:
2025-02-04 04:12:18 dovecot_plain authenticator failed for ([222.114.200.160]) [222.114.200.160]:48133: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
description:
Feb  4 04:12:20 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.97.189.79
description:
[2025-02-04 04:12:37 +0100] info [webmaild] 138.97.189.79 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.28.61
description:
Feb  4 04:12:44 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.26.197
description:
2025-02-04 04:12:17 dovecot_plain authenticator failed for ([61.184.26.197]) [61.184.26.197]:35968: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.179.8.206
description:
2025-02-04 04:12:19 dovecot_plain authenticator failed for ([210.179.8.206]) [210.179.8.206]:36729: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.28.61
description:
2025-02-04 04:12:46 dovecot_plain authenticator failed for ([60.173.88.145]) [111.39.28.61]:36542: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.26.197
description:
Feb  4 04:12:15 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.26.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.157.169.242
description:
2025-02-04 04:12:15 dovecot_plain authenticator failed for (abts-north-dynamic-161.133.176.122.airtelbroadband.in) [103.157.169.242]:57867: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
description:
Feb  4 04:12:21 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.179.8.206
description:
Feb  4 04:12:17 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.179.8.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.191.131
description:
2025-02-04 04:12:31 dovecot_plain authenticator failed for broadband-178-140-191-131.ip.moscow.rt.ru [178.140.191.131]:43662: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.93
description:
Feb  4 04:12:15 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.224.179.58
description:
Feb  4 04:12:30 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.224.179.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.179.58
description:
2025-02-04 04:12:32 dovecot_plain authenticator failed for ([122.224.179.58]) [122.224.179.58]:43807: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.4.150
description:
2025-02-04 04:12:32 dovecot_plain authenticator failed for ([222.180.4.150]) [222.180.4.150]:51865: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.189.77.2
description:
[2025-02-04 04:12:03 +0100] info [webmaild] 95.189.77.2 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.42.226.215
description:
2025-02-04 04:12:10 dovecot_plain authenticator failed for ([58.42.226.215]) [58.42.226.215]:54384: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
description:
2025-02-04 04:12:23 dovecot_plain authenticator failed for ([222.92.61.242]) [222.92.61.242]:46794: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
description:
2025-02-04 04:12:22 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:52140: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.192.242
description:
Feb  4 04:12:27 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.192.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.191.131
description:
Feb  4 04:12:29 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.191.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.125.22.55
description:
2025-02-04 04:12:29 dovecot_plain authenticator failed for ([177.125.22.55]) [177.125.22.55]:49221: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.4.150
description:
Feb  4 04:12:30 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.4.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.42.226.215
description:
Feb  4 04:12:08 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.42.226.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
description:
Feb  4 04:12:16 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.93
description:
2025-02-04 04:12:17 dovecot_plain authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:40836: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.125.22.55
description:
Feb  4 04:12:27 ait auth[3852655]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.125.22.55 has been locked due to Imunify RBL


